Skip to content
Fencer Intel

Latest vulnerabilities

Newest first, late arrivals on top. Also a feed.

  1. 6.3
    CVE-2026-124249 `http.cookiejar` applies expired `Set-Cookie` to cookie store before policy validation
  2. 7.8
    CVE-2026-119474 Privilege Escalation in HAVELSAN's Liman Render Engine
  3. 0.0
    CVE-2026-19552 ssl.get_server_certificate(addr, ca_certs=...) verifies the chain but never the identity
  4. 3.8
    CVE-2026-124636 kevquirk PureBlog Page Editor content.php save_page path traversal
  5. 8.8
    CVE-2026-95779 An exposure of the appliance’s confidential certificate information vulnerability exists in HPE Morpheus manager software.
  6. 8.8
    CVE-2026-95778 A remote code execution vulnerability exists in HPE Morpheus Software.
  7. 4.7
    CVE-2026-124635 kevquirk PureBlog Admin Image Upload Endpoint upload-image.php unrestricted upload
  8. —
    GHSA-wmvf-3hv6-r972 Login CSRF in OpenID callbacks through return-URL-selected session restoration
    pypi unreviewed · maintainers only
  9. 4.2
    CVE-2026-126775 Social-auth-core 4.7.0 before 7.0.0 Login CSRF via SAML RelayState
    pypi maintainer advisory
  10. 6.3
    CVE-2026-124625 PipraPay Admin Panel pp-functions.php deleteData sql injection
  11. 7.3
    CVE-2026-121841 Other issue in Firefox for iOS
  12. 8.8
    CVE-2026-121843 Privilege escalation in Firefox for iOS
  13. 8.8
    CVE-2026-121842 Privilege escalation in the Reader View component in Firefox for iOS
  14. 5.4
    CVE-2026-125394 FreeRDP before 3.33.0 Use-After-Free via Stale Brush Cache Pointer
    maintainer advisory
  15. 8.8
    CVE-2026-16283 Command Injection in Osbil Technology's Ltd's oPanel
  16. 4.8
    CVE-2026-119743 pdfmake < 0.3.14 Shared Cache Access Policy Bypass
  17. 4.8
    CVE-2026-119274 Infoblox NIOS version upto 9.1.0 contain a vulnerability related to improper input validation that allows a stored XSS
  18. 5.3
    CVE-2026-124624 PipraPay pp-token anti-CSRF pp-adapter.php hash_hmac hard-coded credentials
  19. 6.5
    CVE-2026-121611 Gstreamer1-plugins-bad-free: gst-plugins-bad: use of uninitialized gsth265hrdparams in gst_h265_parse_vps() multi-hrd workaround loop
  20. 6.1
    CVE-2026-121601 Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: out-of-bounds read in mxfdemux via unchecked delta_id and slice index
  21. 8.2
    CVE-2026-119610 Gstreamer1-plugins-good: gstreamer1-plugins-good: out-of-bounds heap read in mtap16/mtap24 h.264 rtp depayloader via signed/unsigned underflow
  22. 4.7
    CVE-2026-124623 PipraPay ZIP Archive system-settings-import unrestricted upload
  23. 6.5
    CVE-2026-122673 WordPress ShopEngine plugin <= 4.9.8 - Cross Site Scripting (XSS) vulnerability
    WordPress
  24. 6.9
    CVE-2026-112205 Bruteforce Protection Bypass in WidzialniCMS
  25. 5.1
    CVE-2026-112204 Reflected XSS in WidzialniCMS
  26. 10.0
    CVE-2026-110469 Remote Code Execution via Unrestricted File Upload in WidzialniCMS
  27. 10.0
    CVE-2026-110468 Remote Code Execution via Unrestricted File Upload in WidzialniCMS
  28. 5.3
    CVE-2026-124622 olivier-ls PHP-FTS Storage.php open toctou
  29. 4.4
    CVE-2026-112171 SQL injection vulnerability in Magistra software
  30. 6.3
    CVE-2026-112170 Improper verification of downloaded upgrades