Skip to content
Fencer Intel

Latest vulnerabilities

Newest first, late arrivals on top. Also a feed.

  1. 7.1
    CVE-2026-122664 WordPress Broadcast Live Video plugin <= 7.3.14 - Cross Site Scripting (XSS) vulnerability
    WordPress
  2. 7.1
    CVE-2026-123482 WordPress JetFormBuilder plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability
    WordPress
  3. 4.3
    CVE-2026-121612 WordPress WPBruiser {no- Captcha anti-Spam} plugin <= 3.6.2 - Broken Authentication vulnerability
    WordPress
  4. 7.1
    CVE-2026-115340 Insecure Storage of Web Transfer Credentials in Progress WS_FTP Server
  5. 7.5
    CVE-2026-115339 Unauthenticated XFT Memory Exhaustion in Progress WS_FTP Server
  6. 7.7
    CVE-2026-115341 Unauthorized File Disclosure via Path Traversal in Thin Client Web Transfer in Progress WS_FTP Server
  7. 6.3
    CVE-2026-115337 Folder Permission Bypass in Progress WS_FTP Server
  8. 6.5
    CVE-2026-115336 FTP Quota Accounting Bypass in Progress WS_FTP Server
  9. 9.8
    CVE-2026-126542 WWBN AVideo 6.5 through 29.7.1 Authentication Bypass via Hybridauth Social Login
    maintainer advisory
  10. 8.1
    CVE-2026-115338 Insecure XFT Transport in Progress WS_FTP Server
  11. 6.9
    CVE-2026-112165 Disabled TLS Certificate Validation Enables MITM Attacks
  12. 6.7
    CVE-2026-121690 FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) executes code with unnecessary privileges.
  13. 7.5
    CVE-2026-121689 FrodoBots EarthRover Mini+ firmware (v6.2.4_6.2.5_0.614.0) exposes sensitive credentials through multiple insecure mechanisms.
  14. 9.1
    CVE-2026-121688 FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains an insecure STM32 firmware update mechanism.
  15. 9.8
    CVE-2026-121687 FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains several local interfaces that are exposed without authentication.
  16. 9.8
    CVE-2026-121686 FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) is vulnerable to unauthenticated, remote code execution via MQTT.
  17. 9.8
    CVE-2026-121685 FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains multiple sets of hard-coded credentials.
  18. 5.4
    CVE-2026-114594 Time-of-check time-of-use (TOCTOU) race condition in Sandisk Dashboard Installer
  19. 6.6
    CVE-2026-112164 Hardcoded AES Key Enables Credential Disclosure
  20. 7.8
    CVE-2026-103906 AM Club (Hard-coded MQTT Credentials)
  21. 4.3
    CVE-2026-126544 WWBN AVideo 6.5 through 29.7.1 Email Verification Bypass via User::verifyCode()
    maintainer advisory
  22. 8.7
    CVE-2026-124683 IndentationAwareTokenBuilder vulnerable to denial of service via quadratic-time tokenization
    npm maintainer advisory
  23. 3.7
    CVE-2026-90588 Out-of-bounds read in Zephyr HTTP client debug logging of response header fields
    maintainer advisory
  24. 2.0
    CVE-2026-118492 Cross-site scripting via unescaped diagnostic messages in langium-sprotty hover popups
    npm maintainer advisory
  25. 7.2
    CVE-2025-10248 XSS vulnerability in OpenText Filr
  26. 7.1
    CVE-2026-124959 Nmaslib Hnswlib and Spotify Voyager HNSW Index Deserialization Heap Out-of-Bounds Write
  27. 7.0
    GHSA-p79r-mf8q-r78h Shell Command Injection via an Unvalidated Registry Version String
    npm unreviewed · maintainers only
  28. 7.3
    CVE-2026-124850 SQL Injection in Database Migration via Stored Connector Identifiers in flowintel
  29. 7.8
    GHSA-5qr3-w62x-jmwx Code Execution via an Unverified Package Manager Download from a Repository-Named Registry
    npm unreviewed · maintainers only
  30. 8.5
    CVE-2026-104620 PackageKit/ZYpp local privilege escalation using InstallFiles(SIMULATE)