Skip to content
Fencer Intel

Latest vulnerabilities

Newest first, late arrivals on top. Also a feed.

  1. —
    CVE-2026-122067 The REST & JSON API Authentication module provides API authentication for Drupal sites.
    packagist
  2. —
    CVE-2026-122066 This module enables you to send messages ("Notifications") to users upon a certain Workflow state change.
    packagist
  3. —
    CVE-2026-122058 This module introduces an OAuth 2.0 authorization server, which can be configured to protect your Drupal instance with access tokens, or al…
    packagist
  4. —
    CVE-2026-122057 This module enables you to upload files from the browser directly to Amazon S3 and register them as Drupal files, bypassing normal PHP file…
    packagist
  5. —
    CVE-2026-118566 The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive files.
    packagist
  6. —
    CVE-2026-118547 The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive files.
    packagist
  7. 5.9
    CVE-2026-122054 BIG-HKSCS decoding hang on crafted input
  8. 7.3
    CVE-2026-121926 yezhihao jt808-server Web Management API WebMvcConfig.addInterceptors missing authentication
  9. 7.5
    CVE-2026-119749 GetPaid WordPress Plugin < 2.8.63 Negative Quantity Payment Bypass
    WordPress
  10. 6.5
    CVE-2026-119748 GetPaid WordPress Plugin < 2.8.63 Authorization Bypass via maybe_use_invoice
    WordPress
  11. 7.1
    CVE-2026-119747 GetPaid WordPress Plugin < 2.8.63 Incorrect Authorization via REST API
    WordPress
  12. 5.3
    CVE-2026-126189 Soup Sieve: Quadratic-time denial of service when matching `:has()`
    pypi maintainer advisory
  13. 5.3
    CVE-2026-20241 Cisco Identity Services Engine Authorization Bypass Vulnerability
  14. 6.1
    CVE-2026-76419 Cisco Unified Communications Manager Cross-Site Scripting Vulnerability
  15. 7.6
    CVE-2026-76506 Cisco Unified Computing System Central Remote Code Execution Vulnerability
    EPSS 1.4% chance of exploitation in 30 days, percentile 72%
  16. 7.5
    CVE-2026-126190 Soup Sieve: Polynomial-time denial of service in the descendant combinator
    pypi
  17. 7.7
    CVE-2026-109518 APT RCE via hard link reuse
  18. 5.9
    CVE-2026-119746 ProSoft ICX35 Login Lockout Bypass via Client-Side Cookies
  19. 6.5
    CVE-2026-122032 SPIP before 4.4.29 Authenticated SQL Injection via where Parameter
  20. 6.1
    CVE-2026-120421 Reflected XSS via client window id in URL client window mode
  21. 7.8
    CVE-2026-120859 PyMoDAQ before 5.3.10 Arbitrary Code Execution via Crafted HDF5, Dock Layout, and XML Settings Files
    maintainer advisory
  22. 5.0
    CVE-2026-122008 Oqtane Framework before 10.3.0 SSRF via File Upload From URL
  23. 6.5
    CVE-2026-122007 Oqtane Framework before 10.3.0 Broken Access Control via SettingController
  24. 8.9
    CVE-2026-121637 WatchGuard AuthPoint Gateway Improper HMAC Validation in LDAP Authentication Callback Allows Forged Authentication Results
  25. 9.2
    CVE-2026-121639 WatchGuard AuthPoint Gateway Improper Authentication Allows Unauthenticated Denial of Service
  26. 9.1
    CVE-2026-121638 WatchGuard AuthPoint Gateway Improper Certificate Validation Allows Man-in-the-Middle Attacks
  27. 9.1
    CVE-2026-121640 WatchGuard AuthPoint Gateway Capture-replay Allows Unauthorized Administrative Actions
  28. 7.5
    GHSA-58xq-375p-x9cm Granian RSGI WebSocket rejection path aborts worker process via invalid default close status
    pypi unreviewed · maintainers only
  29. 7.3
    CVE-2026-121009 SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func
  30. 5.4
    CVE-2026-121008 SQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile