Skip to content
Fencer Intel

Latest vulnerabilities

Newest first, late arrivals on top. Also a feed.

  1. 4.3
    CVE-2026-92080 Path Traversal Leading to Arbitrary Mount in TÜBİTAK BİLGEM's pardus-boot-repair
  2. 7.1
    CVE-2026-115431 WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.6 - Broken Access Control vulnerability
    WordPress
  3. 6.5
    CVE-2026-115952 WordPress Forminator plugin <= 1.58.3 - Cross Site Scripting (XSS) vulnerability
    WordPress
  4. 6.6
    CVE-2026-105422 Path Traversal in TÜBİTAK BİLGEM's pardus-boot-repair
  5. —
    OSEC-2026-30 Ephemeron data is freed while still referenced when the key is an `Infix_tag` closure
    opam
  6. —
    GHSA-mwj3-fpmc-hjcv File identifier allows placeholder recovery for encrypted templated documents
    pypi unreviewed · maintainers only
  7. —
    GHSA-59jv-x5x2-gg4c Possible large memory usage when parsing cross-reference streams with identical offsets
    pypi unreviewed · maintainers only
  8. —
    GHSA-cmpx-464x-82c3 Possible large memory usage for XFA forms
    pypi unreviewed · maintainers only
  9. —
    GHSA-rfv5-695j-j993 Possible large memory usage for some image formats
    pypi unreviewed · maintainers only
  10. —
    GHSA-g7p9-v9rc-c6rj Possible large memory usage when performing image operations
    pypi unreviewed · maintainers only
  11. 7.1
    CVE-2026-109883 WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability
    WordPress
  12. 7.1
    CVE-2026-109884 WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability
    WordPress
  13. —
    GHSA-v27v-f96q-qhjq Degraded secret zeroization capabilities
    crates.io
  14. —
    GHSA-mxcm-mrw6-c446 Degraded secret zeroization capabilities
    crates.io
  15. —
    GHSA-8hcm-m7r7-frwc Hidden file disclosure through Windows short names
    crates.io
  16. —
    GHSA-7p9w-p5qm-5gc5 Large-window Brotli bodies bypass decompression memory limits
    crates.io
  17. —
    GHSA-2q7f-mf9f-5qhr Request smuggling through malformed chunked request trailers
    crates.io
  18. 7.5
    CVE-2026-128242 actix-http before 3.20.1 and actix-web before 4.18.2 Decompression Bomb DoS via encoding::Decoder
    crates.io
  19. 8.7
    CVE-2026-85111 Apache James: Denial of service upon MIME parsing
    maven
  20. 7.5
    CVE-2026-85108 Apache James MIME4J: Denial of service due to Allocation of Resources Without Limits or Throttling
    maven
  21. 7.5
    CVE-2026-123655 Moodle: missing access checks on h5p content files
  22. 9.8
    CVE-2026-76168 Apache James: ManageSieve file implementation cross-user path traversal
  23. 9.1
    CVE-2026-74756 Apache James: WebAdmin exposed without authentication on official Docker default
  24. 9.1
    CVE-2026-76171 Apache James: SSRF filter bypass in the JMAP PushSubscription web-push client
  25. 7.5
    CVE-2026-49939 Apache James: Negative IMAP ACL administer authorization bypass through JMAP protocol
  26. —
    CVE-2025-66621 Apache James: SASL OAUTHBEARER do not validate aud in JWT payload if misconfigred
  27. 5.4
    CVE-2026-103908 AMP for WP <= 1.1.18 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Author Biographical Info
    WordPress
  28. 5.4
    CVE-2026-120035 RSS Aggregator by Feedzy <= 5.2.13 - Unauthenticated Stored Cross-Site Scripting via Feed Item Title
    WordPress
  29. 5.4
    CVE-2026-107658 BuddyForms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via 'bf_post_type' Parameter via Post-Type Confusion
    WordPress
  30. 5.4
    CVE-2026-119178 Smart Cookie Kit <= 2.3.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Bundled Simple HTML DOM Noise Restoration
    WordPress