Skip to content
Fencer Intel

Latest vulnerabilities

Newest first, late arrivals on top. Also a feed.

  1. 7.4
    CVE-2026-124328 FlowCI flow-core-x Groovy Script Evaluation ConditionManagerImpl.java ConditionManagerImpl.run code injection
  2. 5.4
    CVE-2026-124326 DataLinkDC Dinky Catalogue Upload CatalogueController.java file.getOriginalFilename path traversal
  3. 9.8
    CVE-2026-110963 Userplace <= 1.2.0 - Unauthenticated Privilege Escalation
    WordPress
  4. 4.9
    CVE-2026-110132 Sync Post With Other Site 1.9.3 - Contributor+ Arbitrary Custom Post Type Creation and Modification
    WordPress
  5. 8.6
    CVE-2026-109925 Productive Commerce < 1.1.54 - Unauthenticated SQLi via Wishlist and Compare Handlers
    WordPress
  6. 8.1
    CVE-2026-106015 Ecommerce Affiliate <= 1.0.0 - Unauthenticated Account Takeover via Email OTP Brute Force
    WordPress
  7. 5.3
    CVE-2026-105970 BCK Auto-confirm Bank Transfer <= 2.0.1 - Unauthenticated WooCommerce Order Payment Confirmation
    WordPress
  8. 4.1
    CVE-2026-104639 Razorpay for WooCommerce < 4.8.9 - Admin+ SQLi via Webhook
    WordPress
  9. 3.7
    CVE-2026-104338 Razorpay for WooCommerce < 4.8.9 - Unauthenticated User Context Switch via 1cc Coupon Route
    WordPress
  10. 5.3
    CVE-2026-104337 Razorpay for WooCommerce < 4.8.9 - Unauthenticated Order Data Disclosure via 1CC Coupon Apply
    WordPress
  11. 5.4
    CVE-2026-104307 BackUpWordPress < 3.15 - Subscriber+ Backup Directory File Deletion via hmbkp_dismiss_error
    WordPress
  12. 8.8
    CVE-2026-103303 Turisbook Booking System <= 1.3.8 - Unauthenticated Stored XSS via Cart Background Setting
    WordPress
  13. 9.8
    CVE-2026-114432 Contact Form 7 6.2 - 6.2.3 - Unauthenticated Arbitrary File Upload via Invalid UTF-8 Filename
    WordPress
  14. 2.7
    CVE-2026-96963 Pie Register <= 3.8.4.15 - Contributor+ Invitation Code Modification
    WordPress
  15. 6.5
    CVE-2026-96961 Pie Register <= 3.8.4.15 - Unauthenticated Plugin Settings Reset and Redirect Data Destruction
    WordPress
  16. 5.3
    CVE-2026-103375 Antom Payments <= 2.0.11 - Unauthenticated WooCommerce Order Data Disclosure
    WordPress
  17. 3.5
    CVE-2026-97195 Secure Custom Fields < 6.9.8 - Admin+ Stored XSS via HTML Attribute Name Injection into Field Definition
    WordPress
  18. 2.7
    CVE-2026-97194 Secure Custom Fields < 6.9.8 - Contributor+ Unpublished Post Title and Status Disclosure via Relational Fields
    WordPress
  19. 2.7
    CVE-2026-97193 Secure Custom Fields < 6.9.8 - Contributor+ Relationship Field Update on Arbitrary Objects via IDOR
    WordPress
  20. 2.7
    CVE-2026-97192 Secure Custom Fields < 6.9.8 - Contributor+ Admin-Restricted Custom Field Update via Post Save Path
    WordPress
  21. 4.3
    CVE-2026-85344 FV Player < 7.5.57.7212 - Subscriber+ Bulk Post Modification via Missing Authorization
    WordPress
  22. 6.5
    CVE-2026-122085 Event Tickets Manager for WooCommerce < 1.6.0 - Unauthenticated Ticket Transfer and Attendee PII Disclosure
    WordPress
  23. 5.3
    CVE-2026-122062 Pronamic Pay & Pronamic Pay doneren met Mollie - Unauthenticated Form Submission Disclosure via REST API
    WordPress
  24. 5.3
    CVE-2026-122060 WP Recipe Maker < 10.9.2 - Unauthenticated Password-Protected Recipe Disclosure
    WordPress
  25. 5.5
    GHSA-cfp4-m43r-v9q4 Incorrect configuration parsing in YAML causes DoS through exponential aliases & alias recursion
    unreviewed · maintainers only
  26. 10.0
    GHSA-5c3q-hp86-xjr8 OpenAM: unauthenticated disclosure of live session tokens via the notification WebSocket, enabling session hijacking and administrative compromise
    unreviewed · maintainers only
    published 2026-10-22
  27. 10.0
    CVE-2026-123551 OpenAM 14.0.0 before 16.1.4 Session Token Disclosure via Notification WebSocket
  28. 5.3
    CVE-2026-119613 AshAi sends unrecognized tool errors verbatim to MCP clients and the model, disclosing internal details
    hex
  29. 7.5
    CVE-2026-124553 BabelDOC from 0.3.61 before 0.7.0 Denial of Service via ToUnicode CMap Parsing
    maintainer advisory
  30. 7.2
    CVE-2026-120531 Subscribe2 – Form, Email Subscribers & Newsletters <= 10.47 - Unauthenticated Stored Cross-Site Scripting via 'data[ip]' Parameter
    WordPress