Skip to content
Fencer Intel

Latest vulnerabilities

Newest first, late arrivals on top. Also a feed.

  1. 9.1
    CVE-2026-88800 MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Unauthenticated Arbitrary Role Deletion
    WordPress
  2. 8.8
    CVE-2026-88799 MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Account Takeover via IDOR
    WordPress
  3. 5.9
    CVE-2026-121819 armeria-xds: symbolic link inside an allow-listed DataSource root bypasses SDS file confinement
    maintainer advisory
  4. 8.7
    CVE-2026-121820 Decompression bomb in armeria-saml HTTP-Redirect binding allows unauthenticated denial of service
    maintainer advisory
  5. 8.7
    CVE-2026-121823 Path-scoped decorators can be bypassed with a `.` path segment
    maintainer advisory
  6. 2.4
    CVE-2026-121822 Stored XSS in `FileService` directory listing via crafted file names
    maintainer advisory
  7. 5.3
    CVE-2026-121821 Any-origin `CorsService` ignores `route()` / `pathPatterns`, applying the CORS policy to every path
    maintainer advisory
  8. 8.7
    CVE-2026-121824 Denial of service through excessive memory allocation when decoding malformed Thrift messages
    maintainer advisory
  9. 6.2
    CVE-2026-120749 Dbus: dbus-daemon: dbus-daemon aborts (reply_serial != 0) when a broadcast from the driver cannot be delivered to a monitored bus
  10. —
    CVE-2026-83494 Training-operator: pytorchjob validateupdate casts oldjob from newobj, bypassing managedby immutability (asvs v5.1.3; upstream bug)
  11. 9.1
    CVE-2026-83493 Distributed-workloads: github actions pinned by mutable tag/branch, including third-party snyk/actions/setup@master
  12. 6.5
    CVE-2026-9797 Keycloak: keycloak: privilege escalation via client authentication manipulation by an authenticated administrator
  13. 5.5
    CVE-2026-73473 Gstreamer1-plugins-good: gstreamer: missing subindex entry count validation in avidemux leading to denial of service
  14. 6.1
    CVE-2026-73472 Gstreamer1-plugins-good: gstreamer: integer overflow in avidemux superindex/subindex parsing leading to out-of-bounds read
  15. 6.1
    CVE-2026-73471 Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux nikon metadata tag parsing
  16. 6.5
    CVE-2026-97848 Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitization
  17. 6.4
    CVE-2026-97367 Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeover
  18. 6.5
    CVE-2026-96547 Keycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging realm_access.roles
  19. 5.4
    CVE-2026-96460 Keycloak-services: keycloak-services: indefinite access token renewal via standard token exchange v2
  20. 4.9
    CVE-2026-92856 Keycloak-services: keycloak-services: saml broker ignores proxyrestriction delegation constraints
  21. 6.8
    CVE-2026-19688 Keycloak-services: keycloak-services: admin api missing audience check
  22. 4.2
    CVE-2026-96447 Keycloak-services: keycloak-services: stateless token preferred_username fallback enables identity rebinding
  23. 5.6
    CVE-2026-118239 AutomatorWP < 6.0.7 - Unauthenticated Zoom/AWeber Integration Connection Hijack via OAuth Callback
    WordPress
  24. 4.3
    CVE-2026-118188 PublishPress Revisions 3.9.0 - 4.2.0 - Subscriber+ Unpublished Content Disclosure
    WordPress
  25. 2.7
    CVE-2026-118187 PublishPress Revisions < 4.3.1 - Contributor+ Unpublished Content Disclosure via IDOR
    WordPress
  26. 4.9
    CVE-2026-118186 PublishPress Revisions 3.6.0 - 4.2.0 - Contributor+ Unapproved Content Publishing via Revision Workflow
    WordPress
  27. 5.3
    CVE-2026-118167 MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Subscription Audience Override
    WordPress
  28. 7.5
    CVE-2026-115673 Anti-Spam by CleanTalk < 6.91 - Unauthenticated Stored XSS via Comment Author Email
    WordPress
  29. 9.8
    CVE-2026-113615 GS JWT Authentication <= 1.0.0 - Unauthenticated Privilege Escalation via SQLi
    WordPress
  30. 7.5
    CVE-2026-110813 Advanced Custom Fields (ACF®) < 6.8.11 - Unauthenticated Stored XSS via HTML Attribute Name Injection
    WordPress