Skip to content
Fencer Intel

Latest vulnerabilities

Newest first, late arrivals on top. Also a feed.

  1. 8.1
    CVE-2026-92895 Live2DWebCanvas <= 2.2.1 - Unauthenticated Arbitrary File Upload via 'modelApi' Parameter
    WordPress
  2. 8.8
    CVE-2026-116624 Advanced Members for ACF <= 1.3.0 - Authenticated (Subscriber+) Privilege Escalation via Account Change-Password Form
    WordPress
  3. 6.4
    CVE-2026-116545 All-in-One Video Gallery <= 5.0.0 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'track' Post Meta 'label' Field
    WordPress
  4. 4.9
    CVE-2026-119211 AAA Autoload Optimizer <= 1.7.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'option_page' Parameter via 'all' Hook
    WordPress
  5. 6.4
    CVE-2026-116551 WP Customer Area <= 8.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter
    WordPress
  6. 7.5
    CVE-2026-104010 WPSyncSheets For Contact Form 7 <= 1.8.0 - Unauthenticated PHP Object Injection to Remote Code Execution via Untrusted CF7 Submission Field via maybe_unserialize()
    WordPress
  7. 9.8
    CVE-2026-107622 BuddyForms <= 2.10.5 - Unauthenticated Privilege Escalation to Form-Type Confusion via 'bf_post_type' Parameter
    WordPress
  8. 9.1
    CVE-2026-114630 ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.8 - Unauthenticated Arbitrary File Deletion via 'ticket_attachment_path' Parameter
    WordPress
    EPSS 1.3% chance of exploitation in 30 days, percentile 71%
  9. 6.5
    CVE-2026-89101 Everest Forms <= 3.6.2 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Entry/Form Disclosure and Deletion via MCP /tools/call JSON-RPC Endpoint
    WordPress
  10. 7.6
    CVE-2026-103479 Pubjet | پاب‌جت <= 5.4.8 - Authenticated (Subscriber+) Privilege Escalation to 'check-token' AJAX Action
    WordPress
  11. 6.5
    CVE-2026-112341 Wazuh before 4.14.9 SQL Injection via WazuhDBBackend _substitute_params
    maintainer advisory
  12. 8.2
    CVE-2026-112340 Wazuh 4.9.0 before 4.14.9 Authorization Header Override via /api/request
    maintainer advisory
  13. 8.2
    CVE-2026-115701 Cowboy HTTP/1.1 Unbounded Buffering of Pipelined Data During Request Handling Enables Memory Exhaustion
    hex
  14. 5.9
    CVE-2026-112339 Wazuh 3.9.0 before 4.14.9 Missing TLS Hostname Verification in fluent-forward Module
    maintainer advisory
  15. 5.9
    CVE-2026-112338 Wazuh from 4.3.0 before 4.14.9 SSRF via GitHub Module Link Pagination
    maintainer advisory
  16. 8.7
    CVE-2026-113431 Unbounded decoded HTTP/2 header-list size in cowlib cow_http2_machine enables HPACK amplification memory exhaustion
    hex
  17. 3.7
    CVE-2026-112337 Wazuh 3.7.0 before 4.14.9 SSRF via Azure Graph nextLink Pagination
    maintainer advisory
  18. 3.1
    CVE-2026-123337 In JetBrains YouTrack before 2026.2.19656 users without update permission could change issue visibility
  19. 3.1
    CVE-2026-123336 In JetBrains YouTrack before 2026.2.19728 the attachment size limit could be bypassed via AI assistant thread conversion
  20. 3.5
    CVE-2026-123335 In JetBrains YouTrack before 2026.2.19562, 2026.1.14137, 2025.3.169041 missing authorization allowed attaching tags to any issue via the ta…
  21. 3.8
    CVE-2026-123334 In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS integrations owned by another project
  22. 3.8
    CVE-2026-123333 In JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible projects between sprints
  23. 4.7
    CVE-2026-123332 In JetBrains YouTrack before 2026.2.19562 missing authorization allowed Project Admin to manage VCS hosting server configurations
  24. 5.4
    CVE-2026-123331 In JetBrains YouTrack before 2026.2.19197 article editors could change visibility of restricted child articles
  25. 5.4
    CVE-2026-123330 In JetBrains YouTrack before 2026.2.19562 missing authorization allowed users with read-only access to change issue visibility settings
  26. 5.4
    CVE-2026-123329 In JetBrains YouTrack before 2026.2.19562 missing authorization in TeamCity integration allowed disclosure of other projects' actions
  27. 6.4
    CVE-2026-123328 In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tab
  28. 7.5
    CVE-2026-123327 In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure of issue descriptions
  29. 7.1
    CVE-2026-123326 In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspension
  30. 7.1
    CVE-2026-123325 In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible via the plugin sandb…