Skip to content
Fencer Intel

Latest vulnerabilities

Newest first, late arrivals on top. Also a feed.

  1. —
    CVE-2026-99259 soc/tegra: pmc: Fix uninitialised clock rate
    Linux kernel
  2. —
    CVE-2026-99258 x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()
    Linux kernel
  3. —
    CVE-2026-99257 gpio: shared: gracefully handle no-device lookup of shared GPIOs
    Linux kernel
  4. —
    CVE-2026-99256 dm cache: fix issue with background work locking
    Linux kernel
  5. —
    CVE-2026-99255 io_uring/io-wq: don't hide a link from cancellations
    Linux kernel
  6. —
    CVE-2026-99254 io_uring: don't flood a cancelling task with task_work
    Linux kernel
  7. —
    CVE-2026-99253 io_uring/cancel: rearm local work wake up before sleep
    Linux kernel
  8. —
    CVE-2026-99251 Drivers: hv: Avoid infinite retry loop in init_vp_index()
    Linux kernel
  9. —
    CVE-2026-99250 printk: Postpone kthread startup
    Linux kernel
  10. —
    CVE-2026-99249 pid_namespace: make zap_pid_ns_processes() freezable
    Linux kernel
  11. —
    CVE-2026-99248 i2c: xiic: restore non-managed runtime PM to fix clk WARN flood
    Linux kernel
  12. —
    CVE-2026-99247 tracing: Do not initialize tracefs work if tracing is disabled
    Linux kernel
  13. 8.1
    CVE-2026-99246 tipc: protect node reset trace dump with node lock
    Linux kernel
  14. —
    CVE-2026-99245 KEYS: Fix key_reject_and_link() race with keyring restriction
    Linux kernel
  15. —
    CVE-2026-99244 pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper
    Linux kernel
  16. 7.2
    GHSA-jrxq-gc2q-9357 sanitizeTranslatedHtml allows XSS via <script> in translations rendered on the server
    npm unreviewed · maintainers only
  17. 7.4
    GHSA-vvgp-wfq3-pjxj joserfc OctKey accepts DER-encoded RSA public keys as HMAC secrets (key-type confusion enables HS256 forgery)
    pypi unreviewed · maintainers only
  18. 3.1
    GHSA-mcm9-p458-pjmc List-valued jti is accepted by exact-value JWT claim validation
    pypi unreviewed · maintainers only
  19. 7.5
    GHSA-hwgg-pgp5-r4ch JWE JSON aad segment is decoded with no size limit, bypassing every other JWERegistry cap
    pypi unreviewed · maintainers only
  20. 6.5
    CVE-2026-114442 Apache HertzBeat: incomplete XPath expression validation in aliasFields
  21. 6.5
    CVE-2026-121458 Instatic before 0.0.21 Authorization Bypass via MCP Content Read Tools
    maintainer advisory
  22. 7.5
    CVE-2026-118487 Heap exhaustion via unbounded line accumulation in Vert.x STOMP FrameParser
    maintainer advisory
  23. 7.5
    CVE-2026-118489 CachingWebClient shares user-specific HTTP responses across users via the shared cache tier
    maintainer advisory
  24. 5.9
    CVE-2026-118488 Heap exhaustion via unbounded simple string or bulk string allocation in Vert.x Redis client
    maintainer advisory
  25. 5.3
    CVE-2026-120327 Open Redirection in extension "Mail" (mail)
  26. 6.9
    CVE-2026-120328 Information Disclosure in extension "Mail" (mail)
  27. 5.3
    CVE-2026-120329 Broken Access Control in extension "Mail" (mail)
  28. 7.1
    CVE-2026-120330 Broken Access Control in extension "Mail" (mail)
  29. 5.3
    CVE-2026-120331 Server-Side Request Forgery in extension "Mail" (mail)
  30. 5.1
    CVE-2026-120332 Cross-Site Scripting in extension "Mail" (mail)