Skip to content
Fencer Intel

Latest vulnerabilities

Newest first, late arrivals on top. Also a feed.

  1. 6.1
    CVE-2026-112169 Undocumented backdoor allows authentication bypass in Magistra software
  2. 8.1
    CVE-2026-71519 PrestaShop Webservice API Broken Access Control via Customer Endpoint
    maintainer advisory
  3. 5.4
    CVE-2026-124916 PrestaShop Performance Debug Configuration PHP Code Injection
    maintainer advisory
  4. 8.1
    CVE-2026-71531 PrestaShop Webservice API Authorization Bypass via id_shop Parameter
    maintainer advisory
  5. 6.0
    CVE-2026-112168 Multiple embedded secrets and weak algorithms in Magistra
  6. 8.1
    CVE-2026-95648 Privilege Escalation in C-Prot's C-Prot AppDefense
  7. 9.8
    CVE-2026-124079 rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 RCE via Unauthenticated Redis Queue Poisoning
  8. 6.3
    CVE-2026-126364 Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems
    npm
  9. 2.3
    CVE-2026-126361 Astro: XSS via attribute injection in dynamic tag names
    npm
  10. 8.8
    CVE-2026-94434 OS Command Injection Leading to Root Code Execution in TÜBİTAK BİLGEM's Pardus Boot Repair
    EPSS 1.3% chance of exploitation in 30 days, percentile 70%
  11. 7.5
    CVE-2026-120854 WordPress iubenda plugin <= 3.13.6 - Denial of Service Attack vulnerability
    WordPress
  12. 7.1
    CVE-2026-120856 WordPress Invoice Gateway for WooCommerce – Invoice Payment Gateway plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerability
    WordPress
  13. 4.4
    CVE-2026-118798 Multiple sensitive authentication data exposed
  14. 5.9
    CVE-2026-118795 AIS stores authorization state in locally modifiable databases
  15. 6.1
    CVE-2026-118792 Default ODBC credentials
  16. 7.2
    CVE-2026-118791 Insecure software update mechanism
  17. 7.2
    CVE-2026-118790 Multiple Hardcoded Credentials
  18. 7.2
    CVE-2026-118468 AIS XML parsers allow external entity resolution
  19. 4.3
    CVE-2026-118467 AIS products expose clinical and personal data via logs and telemetry
  20. 5.8
    CVE-2026-118465 AIS products use vendor-wide hard-coded database credentials
  21. 5.8
    CVE-2026-118464 AIS shared cryptographic services use fixed cryptographic secrets
  22. 9.2
    CVE-2026-118462 AIS update mechanism executes unverified code
  23. 8.0
    CVE-2026-118461 AIS PersonnelService client performs unauthenticated doctor-specific operations
  24. 8.0
    CVE-2026-118460 AIS embedded private keys enable practitioner impersonation
  25. 6.3
    CVE-2026-118459 AIS PasswordSOS permits authentication without legitimate credentials
  26. 8.1
    CVE-2026-118458 AIS shared test login provider contains fixed administrative credentials
  27. 5.9
    CVE-2026-118450 Venere loads replaceable unsigned components from a writable installation location
  28. 8.1
    CVE-2026-112172 Unauthenticated SQL Execution in XDent/XMedical Synchronization Infrastructure
  29. 7.5
    CVE-2026-121629 Gst-plugins-good: gst-plugins-good: local file disclosure via unvalidated file:// uris in adaptivedemux2 manifest handling
  30. 5.7
    CVE-2026-124684 A use-after-free vulnerability exists in Samsung Escargot 5.0.2 in the buffer-access paths for ReloadableString and CompressibleString.