Skip to content
Fencer Intel

Latest vulnerabilities

Newest first, late arrivals on top. Also a feed.

  1. 8.2
    CVE-2026-118494 Joomla Extension - jreviews.com - Secret configs cached in a web-accessible in JReviews 1.0.0-5.12.0, 6.0.0-6.6.9
  2. 5.5
    CVE-2026-107129 Joomla Extension - balbooa.com - Unauthenticated arbitrary file deletion via path traversal in Gridbox < 2.20.5.0
  3. 6.9
    CVE-2026-107130 Joomla Extension - balbooa.com - Unauthenticated deletion of submission/field files in Gridbox < 2.20.5.0
  4. 8.3
    CVE-2026-107903 Joomla Extension - balbooa.com - Stored XSS in reviews via inconsistent sanitization in Gridbox < 2.20.5.0
  5. 8.8
    CVE-2026-122267 MinIO Signature V4 verification accepts unsigned x-amz-* headers, letting a presigned PUT URL be escalated into a cross-bucket read
    maintainer advisory
  6. 8.3
    CVE-2026-105607 Joomla Extension - balbooa.com - Unauthenticated stored XSS in the "Recent Comments / Recent Reviews" widget in Gridbox < 2.20.5.0
  7. 6.7
    CVE-2026-115452 Joomla Extension - tassos.gr - Privileged stored XSS in Advanced Custom Fields 2.8.2-2.8.15, 3.0.0-3.1.8 and Smile Pack 1.1.2-1.2.9, 2.0.0-2.1.6
  8. 8.1
    CVE-2026-123184 Incorrect Authorization in Altium 365 Git Service Allows Unauthorized Repository Writes
  9. 6.5
    CVE-2026-107359 Malformed Wi-Fi Beacon Causes Crash on WF200
  10. 6.3
    CVE-2026-112110 Privileged file deletion in SafeNet Authentication Client SACSrv
  11. 7.0
    CVE-2026-112109 Local privilege escalation in SafeNet Authentication Client SACSrv
  12. 7.1
    CVE-2026-97847 Keycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority
  13. 8.8
    CVE-2026-97175 Keycloak-services: keycloak-services: unverified idp email auto-linking enables account takeover
  14. 6.8
    CVE-2026-97174 Keycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokens
  15. 8.0
    CVE-2026-96453 Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates
  16. 7.4
    CVE-2026-93998 Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuer
  17. 8.1
    CVE-2026-92857 Keycloak-services: keycloak-services: dcr protocol mapper config not validated, allowing iat holders to forge sub and aud claims in signed tokens
  18. 7.4
    CVE-2026-92855 Keycloak-services: keycloak-services: saml broker accepts holder-of-key assertions without proof of key possession
  19. 7.5
    CVE-2026-82965 Keycloak-services: keycloak-services: unauthenticated denial of service via saml soap endpoint unbounded xml parsing
  20. 5.3
    CVE-2026-126360 OpenTelemetry Python: Denial of service through quadratic-time traceparent parsing in opentelemetry-api
    pypi
  21. 5.3
    CVE-2026-84155 Session Token Remains Valid After Logout in Multi-Worker Deployments
    maintainer advisory
  22. 0.0
    CVE-2026-84164 Stored XSS in the static HTML report export, because json.dumps does not escape the markup character
    maintainer advisory
  23. 7.8
    CVE-2026-119083 GluonTS arbitrary file write during archive extraction
    maintainer advisory
  24. 4.9
    CVE-2026-84161 Authenticated remote denial of service through unbounded zlib decompression in storeAnalysisStatistics
    maintainer advisory
  25. 6.6
    CVE-2026-111253 Dnf5daemon-server: dnf5: dnf5daemon-server: missing session-owner check allows foreign d-bus callers to replace another client's resolved transaction
  26. 7.8
    CVE-2026-120499 h5io before 0.2.6 Arbitrary Code Execution via read_hdf5
    maintainer advisory
  27. 7.4
    GHSA-f7j6-p4qx-gq99 OpenSSH keys with a tab separator and OpenSSH certificates are accepted as HMAC secrets
    pypi unreviewed · maintainers only
  28. 8.8
    CVE-2020-9709 Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have a security bypass vulnerability.
    EPSS 1.2% chance of exploitation in 30 days, percentile 68%
  29. 7.8
    CVE-2019-16447 Adobe Illustrator CC versions 23.1 and earlier have a binary planting vulnerability.
  30. 7.5
    CVE-2026-123151 Gdb: gdb: stack buffer overflow in parse_tsv_definition via stale rs->buf tail