Skip to content
Fencer Intel

Latest vulnerabilities

Newest first, late arrivals on top. Also a feed.

  1. 6.8
    CVE-2026-92396 Blocks for ShopEngine < 2.4.4 - Contributor+ Stored XSS via gutenova_store_css
    WordPress
  2. 8.8
    CVE-2026-87784 Cool Media Filter <= 1.0.1 - Subscriber+ Privilege Escalation via role_permission
    WordPress
  3. 7.5
    CVE-2026-86606 iubenda < 3.13.7 - Unauthenticated Stored XSS via Cookie Block HTML Parser
    WordPress
  4. 6.5
    CVE-2026-12967 WCFM Membership < 2.12.1 - Subscriber+ Payment Verification Bypass
    WordPress
  5. 8.0
    CVE-2026-120408 All-in-One Video Gallery < 5.1.0 - Subscriber+ Stored XSS via 'image' Post Meta
    WordPress
  6. 5.3
    CVE-2026-119259 All-in-One Video Gallery < 5.1.0 - Unauthenticated Views and Duration Post Meta Write
    WordPress
  7. 6.5
    CVE-2026-118639 Surfer < 1.8.1.759 - Contributor+ Privilege Escalation via Editor API Key Disclosure
    WordPress
  8. 8.7
    CVE-2026-118045 Ever Accounting < 2.3.3 - Accounting Manager+ Arbitrary File Deletion via CSV Import
    WordPress
  9. 9.8
    CVE-2026-116533 Static Snapshot <= 0.2.1 - Unauthenticated RCE via 'name' Parameter
    WordPress
  10. 9.8
    CVE-2026-115230 WHIZZ <= 1.1.8 - Unauthenticated Arbitrary User Password Reset
    WordPress
  11. 6.8
    CVE-2026-114427 GutenKit 2.5.0 - 2.5.4 - Author+ Stored XSS via Page Settings Custom CSS
    WordPress
  12. 9.8
    CVE-2026-113584 Real Estate Website Builder <= 1.4.3 - Unauthenticated Account Takeover via User Email Update
    WordPress
  13. 9.8
    CVE-2026-110955 Wurdey <= 1.0.0 - Unauthenticated Administrator Authentication Bypass
    WordPress
  14. 8.6
    CVE-2026-110532 Mail Mage <= 0.0.25 - Unauthenticated SQLi via 'ewp_unsubscribe' Parameter
    WordPress
  15. 8.8
    CVE-2026-110525 MCB Stats <= 1.0.0 - Unauthenticated Stored XSS via User-Agent
    WordPress
  16. 6.8
    CVE-2026-109081 Keycloak-services: keycloak-services: injection of roles into realm default-roles via dcr endpoint
  17. 6.4
    CVE-2026-107124 Keycloak-services: keycloak-services: oidc logout endpoint session fixation via id_token_hint leading to account takeover
  18. 4.3
    CVE-2026-121837 Quarkus-rest-data-panache: quarkus-rest-data-panache: getter-level @securefield ignored for filter and sort
  19. 6.7
    CVE-2026-123037 Ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of cve-2024-9902)
  20. 2.3
    CVE-2026-114366 Information disclosure vulnerability in authentication handling of QWebSocket impacts Qt Framework
  21. 8.7
    CVE-2026-119432 Foxit Workspace Stored XSS in shared artifacts
  22. 7.7
    CVE-2026-119431 Server-Side Request Forgery in Foxit Workspace File Upload
  23. 7.7
    CVE-2026-119433 Server-Side Request Forgery in Foxit Workspace PDF Export
  24. 6.5
    CVE-2026-124315 Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_bom_items
    maintainer advisory
  25. 6.3
    CVE-2026-89142 Out-of-bounds Write in Wi-Fi NPU
  26. 4.3
    CVE-2026-124313 Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_payments_for_doc
    maintainer advisory
  27. 6.5
    CVE-2026-124314 Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_open_activities
    maintainer advisory
  28. 4.3
    CVE-2026-124316 Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_material_requests
    maintainer advisory
  29. 8.8
    CVE-2026-125406 Ettercap through 0.8.4.1 Stack Buffer Underwrite via Telnet Dissector Backspace Handling
    maintainer advisory
  30. 8.1
    CVE-2026-125405 Ettercap through 0.8.4.1 Out-of-Bounds Read via HTTP NTLM Authentication Parsing
    maintainer advisory