Skip to content
Fencer Intel

Latest vulnerabilities

Newest first, late arrivals on top. Also a feed.

  1. 4.3
    CVE-2026-120953 Atlas SQL JDBC Driver <=4.0.0: OIDC discovery endpoints not scheme-validated - attacker-controlled URI dispatched to OS protocol handler
  2. 3.7
    CVE-2026-120954 Silent element-count truncation via 32-bit bit-length overflow in packed-bit vector views
  3. 7.5
    CVE-2026-121382 Netcore NBR100V2 auto_ac msg_aes_dec integer overflow
  4. 4.8
    CVE-2026-87043 sys_rand_get() silently returns an unwritten buffer when the entropy device is not ready
    maintainer advisory
  5. 7.5
    CVE-2026-120955 MongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Application on Malformed GridFS Metadata
  6. 5.4
    CVE-2026-121652 Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering
    npm maintainer advisory
  7. 7.1
    CVE-2026-120956 remote abort and memory disclosure from a malformed cursor.ns
  8. 6.5
    CVE-2026-120684 MongoDB C Driver GridFS gap lets a shared writer recover a protected client's password
  9. 7.5
    CVE-2026-120678 MongoDB C Driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to parse (denial of service)
  10. 7.3
    CVE-2026-63198 traQ: Privilege escalation by OAuth prompt=none request
    go
  11. 7.1
    CVE-2026-82976 Image-customization-controller: unauthenticated plaintext image server with directory listing exposes ignition images containing cluster pull secret
  12. 5.5
    CVE-2026-120673 Rust Driver 3.9.1 exports CSFLE plaintext in `db.query.text` before encrypting the command
  13. 7.3
    CVE-2026-63197 traQ: XSS in the User Uploaded File Retrieval API
    go
  14. 8.2
    CVE-2026-63417 Logging Redactor: PII data in str/repr of non primitive objects was not being redacted
    pypi
  15. 8.8
    CVE-2026-119922 Babelfish for PostgreSQL Privilege Escalation
    maintainer advisory
  16. 6.9
    CVE-2026-63499 zt-zip: ZipUtil.unpack can change file permissions of output directory
    maven
  17. 6.1
    CVE-2026-63436 zt-zip: Path traversal in fluent API unpack
    maven
  18. 6.5
    CVE-2026-121734 ZaneOps 1.14.0 before 1.15.2 Cross-Workspace Information Disclosure via ReviewPreviewEnvDeployAPIView
    maintainer advisory
  19. 9.8
    CVE-2026-44267 Elo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitter
    npm
  20. 9.8
    CVE-2026-44266 Elo: Remote Code Execution in Elo Ruby backend via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels
    npm
  21. 5.4
    CVE-2026-116845 NetBox from 2.9.0 before 4.7.4 Authorization Bypass via BulkComponentCreateView
  22. 7.4
    CVE-2026-44265 Elo: Code injection in Elo backends via unvalidated emission of programmatic AST fields
    npm
  23. 6.2
    GHSA-6fmh-662p-w6f5 MP4 trun sample count can exhaust the parser heap through per-sample object expansion
    npm unreviewed · maintainers only
  24. 8.1
    GHSA-p3jp-9v83-76w9 Microsoft Security Advisory CVE-2026-111497 - .NET Brotli Decoder Out-of-bounds Write Vulnerability
    nuget
  25. 3.7
    CVE-2026-121735 blueprintUE Self-Hosted Edition before 4.3.4 Non-Expiring Account Confirmation Tokens
    maintainer advisory
  26. 6.3
    CVE-2026-121263 phpMyAdmin MoTranslator Loader.php getTranslator path traversal
  27. 3.7
    CVE-2026-121628 Bagisto before 2.3.16 and 2.4.x before 2.4.1 Race Condition in Coupon Usage Accounting
  28. 6.1
    CVE-2026-121627 buku 5.0 through 5.1.1 Stored XSS via bukuserver Bookmark List URL
  29. 3.7
    CVE-2026-121626 GNU Gatekeeper before 5.16 Out-of-Bounds Read in H.460.24 RTCP Probe Handler
  30. 3.7
    CVE-2026-121625 GNU Gatekeeper before 5.16 Out-of-Bounds Read via RTCP SDES Parsing