Skip to content
Fencer Intel

Latest vulnerabilities

Newest first, late arrivals on top. Also a feed.

  1. 7.3
    CVE-2026-121007 SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl allow SQL injection via the where values of a nested statement in an identifier position
  2. 6.1
    CVE-2026-114627 Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output
  3. 5.3
    CVE-2026-122138 BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 Login Rate Limit Bypass
    maintainer advisory
  4. 5.3
    CVE-2026-122139 blueprintUE Self-Hosted Edition before 4.3.3 Account Enumeration via Password Reset
    maintainer advisory
  5. 6.1
    CVE-2026-121632 Data::MuForm versions through 0.05 for Perl render attribute values and option labels into HTML without escaping
  6. 6.1
    CVE-2026-119776 frr: ospf6d fails to enforce all OSPFv3 packets use IPv6 link-local addresses
  7. 4.3
    CVE-2026-119745 Sender WordPress Plugin < 2.11.3 Broken Access Control via admin_post_sender_debug_download
    WordPress
  8. —
    GHSA-x25m-vx33-v837 Selector limit does not cover empty comma slots in forgiving pseudos
    pypi unreviewed · maintainers only
  9. 7.5
    CVE-2026-126191 Soup Sieve: Exponential ReDoS in selector compilation via \9-run in CSS_ESCAPES/IDENTIFIER
    pypi
  10. 6.3
    CVE-2026-126192 Soup Sieve: General sibling combinator inside :has() matches untrusted HTML in quadratic time
    pypi
  11. 5.3
    CVE-2026-126193 Soup Sieve: Uncontrolled recursion in Soup Sieve CSS parser lets nested pseudo-class selectors exhaust the Python call stack
    pypi
  12. 4.3
    CVE-2026-121993 wePOS before 2.0.3 Missing Authorization via payment/process Endpoint
    WordPress
  13. 3.7
    CVE-2026-121970 Pay with Vipps and MobilePay for WooCommerce before 6.4.1 Webhook Signature Forgery
    WordPress
  14. 5.3
    GHSA-pcfh-3f5v-gp2c SVG rejection bypass in image optimization via false-positive AVIF/HEIC detection
    npm unreviewed · maintainers only
  15. 9.4
    HSEC-2026-0013 HTTP Request Smuggling in warp
    hackage
  16. 8.5
    CVE-2026-121147 Security Misconfiguration Vulnerability in Tata Motors iRA and iRA.ev mobile application
  17. 6.8
    CVE-2026-121146 Information Disclosure Vulnerability in Tata Motors iRA and iRA.ev mobile application
  18. 6.5
    CVE-2026-121620 CoopCycle coopcycle-web 5.6.0 before 6.20.0 Missing Zelty Webhook Signature Verification
  19. 7.1
    CVE-2026-121145 Insecure Configuration Vulnerability in Tata Motors iRA and iRA.ev mobile application
  20. 7.6
    CVE-2026-121945 CoopCycle coopcycle-web before 6.20.1 IDOR via Incident Resource and Action Endpoint
  21. 5.5
    CVE-2026-121944 sngrep through 1.9.0 Infinite Loop DoS via Crafted NFLOG TLV
  22. 4.8
    CVE-2026-121943 Irontec sngrep through 1.9.0 Out-of-Bounds Stack Read via sip_check_packet
    EPSS 5.6% chance of exploitation in 30 days, percentile 92%
  23. 6.1
    CVE-2026-121942 ZBar through 0.23.95 Out-of-Bounds Read via _zbar_sq_decode() in sqcode.c
  24. 7.8
    CVE-2026-121941 libmt32emu before 2.8.4 Heap Buffer Overflow via MidiStreamParserImpl::parseSysex
  25. 8.8
    CVE-2026-121940 Stonewuu ai-fusion-video before 1.3.0 IDOR via Project, Asset and Script Controllers
  26. 5.3
    CVE-2026-121938 langchain4j-aideepin before 3.31.0 IDOR via GET /character/{uuid}
  27. 3.1
    CVE-2026-121937 loonflow before r3.2.3 IDOR via ticket_flow_history Endpoint
  28. 6.5
    CVE-2026-121936 easyVoice before 0.0.23 SSRF via openaiBaseUrl in TTS API
  29. 8.8
    CVE-2026-121144 Hardcoded Credentials Vulnerability in Tata Motors iRA and iRA.ev mobile application
  30. 1.7
    CVE-2026-107479 Integer truncation vulnerability in QTextCodec conversion functions impacts Qt Framework