Skip to content
Fencer Intel

Latest vulnerabilities

Newest first, late arrivals on top. Also a feed.

  1. 7.5
    CVE-2026-63655 tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS
    npm
  2. 8.2
    CVE-2026-54376 VitaFit Android < 2.8.1.0 Custom URI Scheme Token Hijacking
  3. 4.3
    CVE-2026-122020 NST Labs Tech Nstbrowser Local Agent Management Service stopAll stopAllBrowsers denial of service
  4. 8.4
    CVE-2026-54375 VitaFit Android < 2.8.1.0 Long-Lived Session Token Exposure
  5. 7.5
    CVE-2026-54374 VitaFit Android < 2.8.1.0 Hardcoded Credentials Disclosure
  6. 3.5
    CVE-2026-54373 VitaFit Android < 2.8.1.0 Cleartext Traffic via Missing Network Security Config
  7. 8.8
    CVE-2026-54372 VitaFit Android < 2.8.1.0 Insecure TLS Certificate Validation
  8. 7.3
    CVE-2026-122019 6amTech 6valley Social Login Flow existing-account-check existingAccountCheck authorization
  9. 8.7
    CVE-2026-122266 Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS
    maintainer advisory
  10. 8.8
    CVE-2026-103002 GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover
    pypi
  11. 5.5
    CVE-2026-121746 nvm use --save and nvm install --save write through a symlinked .nvmrc, overwriting any file the user can write
    maintainer advisory
  12. 6.2
    CVE-2026-58128 Alan: Health Insurance for Android 1.450.0 Path Traversal via ShareReceiverActivity
  13. 3.3
    CVE-2026-121749 nvm passes the version pattern to grep without -e, letting a .nvmrc inject grep options and read local files
    maintainer advisory
  14. 5.5
    CVE-2026-121747 nvm prints the contents of any readable file through a symlinked .nvmrc
    maintainer advisory
  15. 6.3
    CVE-2026-122016 yangzongzhuan RuoYi-Vue Permission Service SysPermissionService.java SysPermissionService.getMenuPermission privileges management
  16. 3.6
    CVE-2026-121748 nvm use --delete-prefix lets a project .npmrc choose which file npm rewrites or makes world-writable
    maintainer advisory
  17. 3.1
    CVE-2026-121750 nvm install --offline installs a cached tarball that previously failed checksum verification
    maintainer advisory
  18. 2.5
    CVE-2026-121745 nvm exposes NVM_AUTH_HEADER to other local users on the curl/wget command line
    maintainer advisory
  19. 3.1
    CVE-2026-121751 nvm evaluates a malicious mirror's index.tab version strings as shell arithmetic via stored LTS aliases
    maintainer advisory
  20. 9.1
    CVE-2026-102894 GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover
    pypi
  21. 9.8
    CVE-2026-102895 GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin
    pypi
    kev
  22. 6.3
    CVE-2026-122015 NPC-Worldwide npcpy MLX Provider response.py get_mlx_response input validation
  23. 6.5
    CVE-2026-16725 IBM Watson Speech Services Cartridge is vulnerable to a Path Traversal in LangSmith
  24. 5.3
    CVE-2026-19319 IBM Watson Speech Services Cartridge is vulnerable to an Out-of-bounds Read in Onnx
  25. 9.8
    CVE-2026-82418 IBM Watson Speech Services Cartridge is vulnerable to a Use After Free condition in cryptography wheels OpenSSL
  26. 7.5
    CVE-2026-17493 IBM Watson Speech Services Cartridge is vulnerable to a D.O.S. in Unpacker.
  27. 6.3
    CVE-2026-122014 NPC-Worldwide npcpy sft.py load_sft_model code injection
  28. 6.8
    GHSA-2w5v-vj22-jp27 Path traversal in downloadToDir() via directory entry named '..' from malicious FTP server
    npm unreviewed · maintainers only
  29. 4.3
    CVE-2026-105702 Multiple vulnerabilities that affects IBM Db2 Genius Hub
    IBM Db2
  30. 3.5
    CVE-2026-105991 Multiple vulnerabilities that affects IBM Db2 Genius Hub
    IBM Db2