Skip to content
Fencer Intel

Latest vulnerabilities

Newest first, late arrivals on top. Also a feed.

  1. 6.5
    CVE-2026-113504 Apache Airflow: Secrets masker: pattern-based masking bounded at depth 5 returns deeply-nested registered secrets in cleartext
  2. 6.5
    CVE-2026-107474 Apache Airflow: Connections API: apprise connection "config" extra returned in cleartext
  3. 8.2
    CVE-2026-111395 Apache Airflow: Reserved serialization keys in Dag run conf crash the scheduler or are rebuilt as objects in the Triggerer via deadline callbacks
  4. 5.3
    CVE-2026-124637 Stored Cross-Site Scripting (XSS) in Tankuam Places
  5. 8.8
    CVE-2026-111421 Apache Airflow: Execution API: set_xcom skips the reserved-key check, so task-written XComs instantiate airflow.* classes on the API server
  6. 7.3
    CVE-2026-124586 Tencent RapidJSON diyfp.h GetCachedPowerByIndex out-of-bounds
  7. 6.5
    CVE-2026-111452 Apache Airflow: Secrets masker: camelCase key names (privateKey, connectionString, webhookUrl) not matched against the sensitive-field list
  8. 4.3
    CVE-2026-111453 Apache Airflow: API: asset queuedEvents DELETE checks Dag edit on a ?dag_id query value but deletes rows for every readable Dag
  9. 6.5
    CVE-2026-111454 Apache Airflow: API: asset endpoints return scheduled/producing/consuming Dag IDs the caller cannot read
  10. 6.5
    CVE-2026-111455 Apache Airflow: Connections API: async connection test authorizes create at enqueue but overwrites a later-created connection at commit
  11. 9.9
    CVE-2026-124585 Chengdu Feiyuxing Technology VW2100/VEC10GP Web Administration webserver add_expmac os command injection
    EPSS 2.2% chance of exploitation in 30 days, percentile 82%
  12. 9.5
    CVE-2026-123870 [Eclipse CSI - otterdog] Unauthenticated remote code execution via eval() on format-string-injected webhook body when GITHUB_WEBHOOK_SECRET is unset
    maintainer advisory
  13. 0.6
    CVE-2026-116337 Uncontrolled resource consumption vulnerability in HTTP response handling of Qt Network impacts Qt Framework
  14. 6.1
    CVE-2026-125389 Group-Office before 6.8.181, 25.0.116, and 26.0.58 Stored XSS via filterXSS Bypass
    maintainer advisory
  15. 6.5
    CVE-2026-125390 Group-Office before 6.8.181, 25.0.116, and 26.0.58 Local File Read via processUploadQueue
    maintainer advisory
  16. 4.4
    CVE-2026-124584 wummel patool Gzip Extraction fileutil.py extract_gzip symlink
  17. 6.0
    CVE-2026-92606 TOCTOU Race Condition in TÜBİTAK BİLGEM's Pardus MyComputer
  18. 4.3
    CVE-2026-124582 WebTorrent File Path torrent.js getFileModtimes path traversal
  19. 6.5
    CVE-2026-125388 Group-Office before 6.8.181, 25.0.116, and 26.0.58 Missing Authorization in Forms Report Download
    maintainer advisory
  20. 6.3
    GHSA-ffj9-42qx-f38h Cross-Site Scripting (XSS) via AngularJS Double Compilation in @angular/upgrade's downgradeComponent()
    npm unreviewed · maintainers only
  21. 8.1
    CVE-2026-94249 Missing Authorization in TÜBİTAK BİLGEM's Liderahenk
  22. 7.3
    CVE-2026-124581 itsourcecode Airline Reservation System manage_flight.php sql injection
  23. 10.0
    CVE-2026-124580 Chengdu Feiyuxing Technology VW2100/VEC10GP Weixin Auth Endpoint webserver handle_wechat_cn_wifi os command injection
    EPSS 2.8% chance of exploitation in 30 days, percentile 86%
  24. 5.3
    CVE-2026-113437 Path Traversal vulnerability exists in SS1/ SS1 Cloud provided by DOS Co., Ltd.
  25. 4.0
    CVE-2026-109582 Insecure storage of sensitive information issue exists in SS1 provided by DOS Co., Ltd.
  26. 7.4
    CVE-2026-124579 aaPanel BillionMail Relay Configuration API relay.go injection
  27. 4.3
    CVE-2026-120386 Effekseer improperly validates "effect" files.
  28. 5.3
    CVE-2026-124578 Pantum BP5100DW Web omDB.shtml missing authentication
  29. 9.8
    CVE-2026-124577 Intelbras SG 2404 PoE L2+ Web Management EXCU_SHELL improper authentication
    EPSS 2.1% chance of exploitation in 30 days, percentile 81%
  30. 7.3
    CVE-2026-124576 BeikeShop Guest Order Lookup OrderRepo.php getOrderByNumber behavioral workflow