Skip to content
Fencer Intel

Latest vulnerabilities

Newest first, late arrivals on top. Also a feed.

  1. 7.5
    CVE-2026-103866 Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling
  2. 7.5
    CVE-2026-103864 Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization
  3. 5.4
    CVE-2026-103863 Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths
  4. 6.6
    CVE-2026-95652 Improper Device Validation Allows Privileged Disk Formatting in TÜBİTAK BİLGEM's pardus-usb-formatter
  5. 7.5
    CVE-2026-123047 Keycloak admin user password stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts
  6. 5.4
    CVE-2026-125363 MikroDash before 0.8.79 SSRF via Personal Notification Channels
    maintainer advisory
  7. 7.3
    CVE-2026-123019 eosphoros-ai DB-GPT HuggingFace Adapter hf_adapter.py exec_module inclusion of functionality from untrusted control sphere
  8. —
    RUSTSEC-2026-0449 `ocipkg` is unmaintained
    crates.io
  9. 6.5
    GHSA-c9f9-cp8h-jcj5 Unbounded response body buffering in Streamable HTTP clients
    crates.io
  10. 10.0
    CVE-2026-121489 Apache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directory
    maven
  11. 10.0
    CVE-2026-96677 Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome
    maven
  12. 10.0
    CVE-2026-73117 Apache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request data
    maven
  13. 10.0
    CVE-2026-73116 Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirects
    maven
  14. 10.0
    CVE-2026-73101 Apache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaults
    maven
  15. 10.0
    CVE-2026-73100 Apache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errors
    maven
  16. 10.0
    CVE-2026-73099 Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body override
    maven
  17. 10.0
    CVE-2026-73098 Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during parsing
    maven
  18. 8.7
    CVE-2026-73095 Apache Juneau: Denial of service via unbounded memory allocation in parsers and REST request handling
    maven
  19. 8.3
    CVE-2026-123018 eosphoros-ai DB-GPT CodeAction code_utils.py execute_code code injection
  20. 5.9
    CVE-2026-116630 undici vulnerable to cross-user information disclosure via cross-origin redirect revalidation
    npm maintainer advisory
  21. 5.9
    CVE-2026-120415 undici vulnerable to cross-origin credential disclosure via array-of-tuples headers bypassing redirect stripping
    npm maintainer advisory
  22. 5.9
    CVE-2026-120423 undici vulnerable to Subresource Integrity bypass via whitespace in integrity metadata
    npm maintainer advisory
  23. 7.4
    CVE-2026-116592 undici vulnerable to cache poisoning and cross-user disclosure via intermediate redirect hops
    npm maintainer advisory
  24. 5.9
    CVE-2026-120222 undici vulnerable to Denial of Service via unhandled exception in cache-interceptor response replay
    npm maintainer advisory
  25. 6.5
    CVE-2026-120474 undici vulnerable to cross-user cache disclosure via same-origin redirect
    npm maintainer advisory
  26. 5.5
    CVE-2026-123036 A flaw was found in ansible-core.
  27. 8.8
    CVE-2026-118869 An OS command injection vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary OS commands on th…
    EPSS 1.1% chance of exploitation in 30 days, percentile 65%
  28. 5.4
    CVE-2026-117679 A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary script in a user's…
  29. 6.5
    CVE-2026-112072 vault-java-driver: stored deeply nested JSON kills every thread that reads it
  30. 7.4
    CVE-2026-109408 vault-java-driver: SslConfig silently disables requested TLS verification