Skip to content
Fencer Intel

Latest vulnerabilities

Newest first, late arrivals on top. Also a feed.

  1. 7.5
    CVE-2026-125404 Ettercap through 0.8.4.1 Stack Buffer Overflow via WPA CCMP Decryption
    maintainer advisory
  2. 8.1
    CVE-2026-125403 Ettercap through 0.8.4.1 Out-of-Bounds Read via sslw_remove_sts
    maintainer advisory
  3. 8.1
    CVE-2026-125402 Ettercap through 0.8.4.1 Heap Out-of-Bounds Read via TLS SNI Parsing
    maintainer advisory
  4. 8.1
    CVE-2026-125401 Ettercap through 0.8.4.1 Heap Buffer Overflow via Gadu-Gadu Dissector
    maintainer advisory
  5. 8.8
    CVE-2026-125400 Ettercap through 0.8.4.1 Use-After-Free via PCRE2 Filter Substitution
    maintainer advisory
  6. 7.5
    CVE-2025-71458 FTS3 Web Monitoring 3.12.0 through 3.13.2 and 3.14.0 SQL Injection via /linkinfo
  7. 9.0
    CVE-2026-63774 Subnet Solutions PowerSYSTEM Center SQL Injection
  8. 9.0
    CVE-2026-63017 Subnet Solutions PowerSYSTEM Center Incorrect Authorization
  9. 3.3
    CVE-2026-123269 libyal libvmdk Descriptor File libvmdk_descriptor_file.c libvmdk_descriptor_file_read_header out-of-bounds
  10. 3.5
    CVE-2026-123268 libyal libvmdk Extent Data File libvmdk_extent_table.c libvmdk_extent_table_get_extent_data_file_path memory corruption
  11. —
    GO-2026-6911 SSRF and credential leak via unvalidated Location header in github.com/mark3labs/mcp-go
    go
  12. —
    GO-2026-6909 Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/saml
    go
  13. —
    GO-2026-6905 Panic on negative member size in Reader.Read in github.com/blakesmith/ar
    go
  14. —
    GO-2026-6893 Event type spoofing via UntrustedType in github.com/google/go-eventlog
    go
  15. 8.8
    CVE-2026-113663 AG2: Newline injection in SandboxShellTool bypasses allowed=[...] and readonly=True, enabling arbitrary command execution
    pypi
  16. 6.5
    CVE-2026-102943 Dagu MCP DAG specification read bypasses path containment and workspace isolation
    go
  17. 6.9
    CVE-2026-110390 FlexNet Beacon Missing Authentication Vulnerability
  18. 5.4
    CVE-2026-88982 Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook (multi-user)
    go
  19. 9.6
    CVE-2026-77596 Kubeflow Pipelines API server lacks authorization for shared pipeline uploads
    go
  20. 7.2
    CVE-2026-88984 Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelines
    go
  21. 6.1
    CVE-2026-88986 Kubeflow Pipelines: Reflected XSS in the frontend pod information and events error responses
    go
  22. 6.5
    CVE-2026-88985 Kubeflow Pipelines: SQL injection through unvalidated pagination tokens in Kubeflow Pipelines API server
    go
  23. 5.1
    CVE-2026-111495 API keys, credentials, and configuration parameters embedded in the MatchPoint APK
  24. 5.0
    CVE-2026-88983 Kubeflow Pipelines — API server fetches a caller-supplied pipelineURL without host validation
    go
  25. 9.1
    CVE-2026-111494 Incorrect validation of TLS certificates in the MatchPoint Android app
  26. 8.7
    CVE-2026-111493 Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint
  27. 8.6
    CVE-2026-111492 SQL injection in the push notification handler of the MatchPoint Android app
  28. 6.9
    CVE-2026-111491 Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences
  29. 9.9
    CVE-2026-111490 Insecure direct object reference (IDOR) vulnerability in the MatchPoint API
  30. 9.9
    CVE-2026-111489 A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform