Skip to content
Fencer Intel

Latest vulnerabilities

Newest first, late arrivals on top. Also a feed.

  1. 9.1
    CVE-2026-22058 CVE-2026-22058 Authentication Bypass Vulnerability in StorageGRID (formerly StorageGRID Webscale)
  2. 3.1
    GHSA-gv75-j3v8-3crm @better-auth/passkey: Passkey verification does not enforce origin or user verification
    npm unreviewed · maintainers only
  3. 4.2
    GHSA-fvxx-76fc-893x better-auth: Revoked sessions can stay valid with secondary storage or the cookie cache
    npm unreviewed · maintainers only
  4. 4.9
    GHSA-c85h-5mrr-mgx4 better-auth: Organization admins can invite an owner with a padded role name
    npm unreviewed · maintainers only
  5. 5.9
    GHSA-x8j7-xh58-rv6x @better-auth/stripe: Billing actions can target another customer's Stripe account
    npm unreviewed · maintainers only
  6. 5.9
    GHSA-9hm7-xhfp-cx58 better-auth: OAuth sign-in can treat an unverified provider email as verified
    npm unreviewed · maintainers only
  7. 6.8
    GHSA-48c2-w96j-mv3m @better-auth/kysely-adapter: MySQL serial IDs can return another request's record
    npm unreviewed · maintainers only
  8. 4.8
    GHSA-2f9c-7xj7-gh55 better-auth: Email OTP attempt limit can be raced and codes are loosely bound to addresses
    npm unreviewed · maintainers only
  9. 8.1
    GHSA-9p5w-h4pr-fcrc @better-auth/electron: Desktop sign-in can return the server secret and skip two-factor
    npm unreviewed · maintainers only
  10. 8.1
    GHSA-q747-mqgr-4gh7 better-auth: Phone numbers can be claimed before they are verified
    npm unreviewed · maintainers only
  11. 9.1
    CVE-2026-121802 @better-auth/expo: Authorization proxy can sign values it did not issue
    npm maintainer advisory
  12. 7.3
    CVE-2026-121524 sumiie24 School-Management-System Public Search Feature parent_Login.php sql injection
  13. 5.4
    CVE-2026-120930 Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafte…
    Google Chrome
  14. 9.6
    CVE-2026-120931 Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outs…
    Google Chrome
  15. 8.1
    CVE-2026-119084 Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver Connection Parameters
    maintainer advisory
  16. 9.8
    CVE-2026-112354 Etrel INCH AC Charging Station Hard-coded Default Credentials
  17. 8.8
    CVE-2026-121621 Github.com/argoproj-labs/argocd-image-updater: argocd-image-updater: arbitrary command execution via crafted ssh repository proxy configuration
    EPSS 1.8% chance of exploitation in 30 days, percentile 79%
  18. 5.0
    CVE-2026-121517 IrfanView TIFF Wang Annotation heap-based overflow
  19. 3.3
    CVE-2026-82160 Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-…
  20. 6.8
    CVE-2026-82161 Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-…
  21. 9.0
    CVE-2026-82158 Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-…
  22. 8.8
    CVE-2026-82159 Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-…
  23. 7.4
    GHSA-23w8-wx9r-vm57 better-call: Requests through a router can see another user's middleware values
    npm unreviewed · maintainers only
  24. 5.3
    GHSA-fw37-f9mw-x9rx better-call: Form-only endpoints accept JSON bodies sent with a crafted content type
    npm unreviewed · maintainers only
  25. 6.3
    CVE-2026-121514 EasySoft ZenTao PMS User model.php checkGroupChange privileges management
  26. 5.4
    CVE-2026-121141 Improper input validation in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to byp…
    Google Chrome
  27. 8.8
    CVE-2026-121195 Incorrect authorization in TrustedTypes in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a…
    Google Chrome
  28. 7.8
    CVE-2026-121064 Improper input validation in Performance in Google Chrome prior to 157.0.8103.38 allowed a local attacker to potentially execute arbitrary…
    Google Chrome
  29. 6.5
    CVE-2026-121169 Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass…
    Google Chrome
  30. 8.8
    CVE-2026-121069 Use after free in Track in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via…
    Google Chrome