Skip to content
Fencer Intel

Latest vulnerabilities

Newest first, late arrivals on top. Also a feed.

  1. 5.3
    CVE-2026-103327 CryptoCloud - Crypto Payment Gateway 3.0.0 - 3.0.1 - Unauthenticated Arbitrary Order Payment Forgery via Empty-Default Webhook Secret
    WordPress
  2. 9.8
    CVE-2026-4052 Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)
  3. 7.5
    CVE-2026-74846 Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier
  4. 7.5
    CVE-2026-16900 Authentication Bypass
    EPSS 1.5% chance of exploitation in 30 days, percentile 75%
  5. 6.7
    CVE-2026-103653 Out-of-bounds read vulnerability in CoAP message parsing impacts Qt CoAP
  6. 9.1
    CVE-2026-13594 Improper Access Control vulnerability
    EPSS 1.1% chance of exploitation in 30 days, percentile 67%
  7. 7.5
    CVE-2026-120987 Whale Browser before 5.39.412.57 allows an attacker to bypass the iframe sandbox in a dual-tab environment.
  8. 6.1
    CVE-2025-5769 Reflected Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Browser Redirection and UI Modification
  9. 4.8
    CVE-2025-1397 Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providers
  10. 3.8
    CVE-2026-104647 weMail <= 2.1.6 - Editor+ Incorrect Authorization via User::can()
    WordPress
  11. 4.9
    CVE-2026-104648 weMail <= 2.1.6 - Editor+ API Key Disclosure
    WordPress
  12. 5.3
    CVE-2026-103379 WATI Chat and Notification <= 1.1.8 - Unauthenticated Customer Order PII Disclosure via Leaked API Token
    WordPress
  13. 5.8
    CVE-2026-105967 Gallery for Social Photo <= 1.0.0.41 - Unauthenticated SSRF via next_url Parameter
    WordPress
  14. 5.3
    CVE-2026-106004 DT LMS <= 1.2 - Unauthenticated Arbitrary Course Completion Revocation
    WordPress
  15. 5.3
    CVE-2026-105993 DT Directory Lite Addon <= 1.1 - Unauthenticated Plugin Settings Update
    WordPress
  16. 6.5
    CVE-2026-115205 AZEXO Store Locator <= 1.4 - Subscriber+ Arbitrary Post Deletion via azt_delete_item
    WordPress
  17. 7.7
    CVE-2026-77800 Authentication bypass vulnerability
  18. 4.4
    GHSA-fhwm-j4g4-mgcj A stalled X display can block interpreter discovery
    pypi unreviewed · maintainers only
  19. 6.7
    GHSA-8qjg-m544-m2r9 Shim discovery can execute a binary outside the version manager root
    pypi unreviewed · maintainers only
  20. 6.7
    GHSA-jc2v-76fw-vpp4 An unparseable interpreter spec can execute a file from the working directory
    pypi unreviewed · maintainers only
  21. 6.7
    GHSA-6f2v-wgxq-cjgm A relative APPDATA value can execute a uv interpreter from the working directory
    pypi unreviewed · maintainers only
  22. 6.7
    GHSA-gcrp-r23f-7vc6 Tk detection can execute a working-directory startup file
    pypi unreviewed · maintainers only
  23. 6.7
    GHSA-82vc-9vh8-c844 A shared DiskCache can run another user’s program
    pypi unreviewed · maintainers only
  24. 6.7
    GHSA-gh83-4x8h-mw58 A relative PEP 514 executable path can run a file from the working directory
    pypi unreviewed · maintainers only
  25. 6.7
    GHSA-2jmw-r89g-9cgw Zipapp interpreter probes can import code from a shared temp directory
    pypi unreviewed · maintainers only
  26. 4.4
    GHSA-fp4v-735f-2cpw A readable DiskCache lock can stall interpreter discovery
    pypi unreviewed · maintainers only
  27. 4.4
    GHSA-m7cj-pw75-p87f A large .python-version file can exhaust discovery memory
    pypi unreviewed · maintainers only
  28. 2.5
    GHSA-c9vx-gr9v-mw7f A checkout can poison interpreter discovery cache for unrelated projects
    pypi unreviewed · maintainers only
  29. 7.0
    GHSA-828q-59cf-rgp5 uv discovery can execute an interpreter outside the supplied environment
    pypi unreviewed · maintainers only
  30. 6.7
    GHSA-4g3x-jm5r-x4qp Windows interpreter discovery can execute code from the working directory
    pypi unreviewed · maintainers only