Skip to content
Fencer Intel

Latest vulnerabilities

Newest first, late arrivals on top. Also a feed.

  1. 8.0
    CVE-2026-95741 Authenticated Missing Integrity Verification in API of HPE Networking Fabric Composer
  2. 8.0
    CVE-2026-95740 Unauthenticated Adjacent Improper Certificate Validation Vulnerability leads to Information Disclosure in HPE Networking Fabric Composer
  3. 8.1
    CVE-2026-95739 Unauthenticated Improper Restriction of Excessive Authentication Attempts in the API of HPE Networking Fabric Composer
  4. 8.1
    CVE-2026-95738 Authentication Bypass in the Affected Interface of HPE Networking Fabric Composer
  5. 8.2
    CVE-2026-95737 Local Privilege Escalation in HPE Networking Fabric Composer
  6. 8.3
    CVE-2026-95736 Unauthenticated Adjacent Improper Certificate Validation Vulnerabilities in HPE Networking Fabric Composer
  7. 8.7
    CVE-2026-95735 Improper Certificate Validation in HPE Networking Fabric Composer
  8. 8.8
    CVE-2026-95734 Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer API
  9. 9.6
    CVE-2026-95733 Use of Hardcoded Credentials in HPE Networking Fabric Composer Could Allow Adjacent Arbitrary Code Execution
  10. 9.6
    CVE-2026-95732 Authentication Bypass in HPE Networking Fabric Composer allows Arbitrary Code Execution
  11. 9.8
    CVE-2026-95731 Unauthenticated Hardcoded Password Vulnerabilities in HPE Networking Fabric Composer Command-Line Interface allow Unauthorized Administrative Access
  12. 6.1
    CVE-2025-71452 Vembu BDRSuite < 7.6.0 XSS via restoreprogress.sgp
  13. 6.1
    CVE-2025-71451 Vembu BDRSuite < 7.6.0 XSS via serverbackupprogress.sgp
  14. 8.3
    CVE-2026-105822 Server-Side Request Forgery in Tapo Cloud MQTT Proxy
  15. 8.3
    CVE-2026-105821 Broken Access Control Leading to Cross-Device Token Issuance in Tapo Cloud MQTT Proxy
  16. 5.4
    CVE-2026-120567 EF Core provider: pipeline-form ExecuteUpdate evaluates a user string setter as a $-field reference
  17. 7.5
    CVE-2026-63501 ag-psd: Uncontrolled Memory Allocation in PSD Layer Decoding (totalMemoryLimit bypass)
    npm
  18. 5.6
    CVE-2026-121541 Bake filesystem path entitlements approval can be skipped in some multi-target builds
    maintainer advisory
  19. 1.8
    CVE-2026-121542 Bake filesystem path entitlements approval can be skipped for path using basename prefix
    maintainer advisory
  20. 4.5
    CVE-2026-121520 Malicious client could set xattr value outside of BuildKit state directory
    maintainer advisory
  21. 6.7
    CVE-2026-121522 Possible panic from Git source resolver
    maintainer advisory
  22. 9.3
    CVE-2026-63471 fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator
    pypi
  23. 9.3
    CVE-2026-63469 fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict
    pypi
  24. 5.7
    CVE-2026-85036 Bluetooth Classic AVDTP session reuse re-initializes a queued work item, corrupting the system work queue
    maintainer advisory
  25. 9.3
    CVE-2026-63470 fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring
    pypi
  26. 9.2
    CVE-2026-112917 Docker Desktop WSL2 AF_VSOCK isolation bypass via 32-bit socketcall
    Docker
  27. 6.2
    GHSA-x53g-p3f6-2cwc music-metadata: AIFF parser trusts chunk size for allocation, enabling denial of service
    npm unreviewed · maintainers only
  28. 6.2
    GHSA-5pwx-m48f-hw27 music-metadata: unbounded buffer allocation from crafted DSDIFF ID3 chunk size crashes the Node process
    npm unreviewed · maintainers only
  29. 6.3
    CVE-2026-121501 mathurvishal CloudClassroom-PHP-Project loginlinkadmin.php session_regenerate_id session fixiation
  30. 6.3
    CVE-2026-110826 AshAuthentication log_out_everywhere leaves sessions valid after a password reset or non-atomic password change
    hex