Skip to content
Fencer Intel

Latest vulnerabilities

Newest first, late arrivals on top. Also a feed.

  1. 6.5
    CVE-2026-120640 CGI versions before 5.00 for Perl allow the POSTDATA, PUTDATA, PATCHDATA and XForms:Model parameters to be set from the query string or form fields
  2. 7.2
    CVE-2026-120639 CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in multipart_start and do_push
  3. 6.1
    CVE-2026-120638 CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect
  4. 9.8
    CVE-2026-120637 CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHOD
  5. 6.1
    CVE-2026-120636 CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_form
  6. 8.1
    CVE-2026-120635 CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs
  7. 6.5
    CVE-2026-120634 CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer
  8. 6.1
    CVE-2026-120633 CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, self_url, virtual_host and virtual_port
  9. 6.5
    CVE-2026-120632 CGI versions before 5.00 for Perl allow CPU exhaustion via a backtracking regex on the XForms multipart/related Content-Type
  10. 7.5
    CVE-2026-120631 CGI::Cookie versions from 4.67 before 5.00 for Perl allow denial of service via the client cookie expires value used as a regex in parse
  11. 4.3
    CVE-2026-121585 InfiniFlow RAGFlow Text To SQL Retrieval sql.go RunSQL authorization
  12. 8.1
    CVE-2026-121939 Databasement before 1.10.9 Account Takeover via OIDC Email Auto-Linking
    maintainer advisory
  13. 6.3
    CVE-2026-121583 Sanluan PublicCMS TradePaymentService.java TradePaymentService.pendingRefund authorization
  14. 7.5
    CVE-2022-30267 Emerson Ovation Insufficient Verification of Data Authenticity
  15. 9.8
    CVE-2022-29966 Emerson Ovation Missing Authentication for Critical Functionality
  16. 6.5
    CVE-2026-121582 Umami Record API Endpoint route.ts authorization
  17. 5.4
    CVE-2026-121733 Bagisto before 2.4.5 Stored XSS via RMA Conversation Attachment Upload
  18. 2.7
    CVE-2026-121732 RosarioSIS before 12.9 Improper Authorization via Student Billing Mass Assignment
  19. 8.8
    CVE-2026-121731 RosarioSIS before 12.9 SQL Injection via period_id in Attendance Absence Report
  20. 6.5
    CVE-2026-121730 emailflare before commit cf31f33 Missing Authorization via Inbox Compose Endpoint
  21. 8.3
    CVE-2026-121729 emailflare before commit cf31f33 Missing Authorization via /api/keys Routes
  22. 5.3
    CVE-2026-121728 SourceHut meta.sr.ht 0.56.11 before 0.89.0 Registration Authorization Bypass via /register/step2
  23. 7.5
    CVE-2026-121727 Kore before 4.3.0 Integer Underflow Memory Exhaustion via http_header_recv()
  24. 6.7
    CVE-2026-109836 The Core Temp kernel driver provided by ALCPU is vulnerable to insufficient access control in an exposed IOCTL, which may allow physical me…
  25. 5.3
    CVE-2026-118237 Out-of-bounds read vulnerability in GitHub Enterprise Server allowed disclosure of process memory in the Git service
  26. 5.3
    CVE-2026-110288 Cross-site request forgery vulnerability in GitHub Enterprise Server allowed deletion of stored ChatOps configuration through the Management Console
  27. 7.7
    CVE-2026-104608 Use-after-free vulnerability in GitHub Enterprise Server allowed remote code execution in the Git service
  28. 4.3
    CVE-2026-121581 ArcReel Provider Test-Connection Endpoint test server-side request forgery
  29. 8.2
    HSEC-2026-0012 Out-of-bounds read in Eq and Ord on numbers with extreme exponents
    hackage
  30. 7.5
    HSEC-2026-0011 Superlinear encoding of numbers with large coefficients
    hackage