Skip to content
Fencer Intel

Latest vulnerabilities

Newest first, late arrivals on top. Also a feed.

  1. —
    CVE-2026-99284 net: skbuff: propagate shared-frag marker in skb_zerocopy()
    Linux kernel
  2. 9.1
    CVE-2026-124060 TOTOLINK CA300-PoE cstecgi.cgi UploadCustomModule buffer overflow
  3. —
    CVE-2026-99283 netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets
    Linux kernel
  4. 9.1
    CVE-2026-124059 TOTOLINK CA300-PoE cstecgi.cgi setWiFiWdsAddConfig buffer overflow
  5. 6.1
    CVE-2026-124474 MRBS before 1.12.3 Reflected XSS via error parameter of view_entry.php
    maintainer advisory
  6. 9.1
    CVE-2026-124058 TOTOLINK CA300-PoE cstecgi.cgi setWiFiRepeaterConfig buffer overflow
  7. 9.1
    CVE-2026-124057 TOTOLINK CA300-PoE cstecgi.cgi setWiFiMultipleConfig buffer overflow
  8. 6.5
    CVE-2026-123472 WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.3 - Cross Site Scripting (XSS) vulnerability
    WordPress
  9. 5.3
    CVE-2026-119522 WordPress User Registration plugin <= 5.3.1 - Broken Access Control vulnerability
    WordPress
  10. 5.3
    CVE-2026-123461 WordPress FOX plugin <= 1.5.6 - Broken Access Control vulnerability
    WordPress
  11. 6.5
    CVE-2026-120836 WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.3 - Broken Access Control vulnerability
    WordPress
  12. 5.3
    CVE-2026-124258 WordPress User Registration plugin <= 5.3.1 - Broken Access Control vulnerability
    WordPress
  13. 4.3
    CVE-2026-123992 DataEase SVG StaticResourceServer.java StaticResourceServer.validateSvgContent cross site scripting
  14. 7.3
    CVE-2026-123991 DataEase Authentication Filter WhitelistUtils.java WhitelistUtils.endsWithAny unrestricted upload
  15. 5.3
    CVE-2026-126955 Glance 0.8.0 before 0.8.8 Page Slug Enumeration via Response Discrepancy
    maintainer advisory
  16. 7.3
    CVE-2026-123990 DataEase Chart Data ExtWhere2Str.java ExtWhere2Str.extWhere2sqlOjb sql injection
  17. 4.7
    CVE-2026-126954 Glance 0.7.9 before 0.8.8 Stored XSS via Widget-Title-URL Header
    maintainer advisory
  18. 7.5
    GHSA-mw73-8637-g65g pymdownx.keys: exponential ReDoS in RE_EARLY_KBD quoted-key branches
    pypi unreviewed · maintainers only
  19. 7.5
    GHSA-j5pm-9mx9-pggq Exponential ReDoS in pymdownx.blocks.html/caption selector parsing enables unauthenticated remote DoS
    pypi unreviewed · maintainers only
  20. 7.5
    GHSA-w3p6-xvp9-c78v Quadratic ReDoS in pymdownx.tilde and pymdownx.caret default smart processor
    pypi unreviewed · maintainers only
  21. 5.3
    GHSA-g663-53r6-cjv5 Quadratic-time denial of service in pymdownx caret, tilde, and mark delimiter processing
    pypi unreviewed · maintainers only
  22. 7.2
    CVE-2026-124318 Treeio through 2.0 Insecure Deserialization RCE via Admin-Editable Pickle Fields
  23. 4.8
    CVE-2026-124317 libexpat through 2.10.0 Out-of-Bounds Read via unknown_toUtf8 and unknown_toUtf16
  24. 4.7
    CVE-2026-124312 Fraunhofer HHI VVdeC through 3.2.1 Heap Out-of-Bounds Read via CodingStructure::getColInfo
  25. 5.5
    CVE-2026-124311 Fraunhofer HHI VVdeC through 3.2.1 NULL Pointer Dereference via InterPrediction::xPredInterBlk
  26. 6.1
    CVE-2026-124310 Fraunhofer HHI VVdeC before 3.2.1 Out-of-Bounds Read via Slice::getRefPic
  27. 6.1
    CVE-2026-124309 Fraunhofer HHI VVdeC before 3.2.1 Heap Out-of-Bounds Read via SEIReader::xParseSEIScalableNesting
  28. 5.8
    CVE-2026-124308 Fraunhofer HHI VVdeC before 3.2.1 Use-After-Free via DecLibRecon::createSubPicRefBufs
  29. 5.8
    CVE-2026-124307 Fraunhofer HHI VVdeC before 3.2.1 Heap Use-After-Free via ALF APS Redefinition
  30. —
    CVE-2026-99282 net/sched: sch_teql: fix use-after-free on lower qdisc drop
    Linux kernel