PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

CISA KEV additions, CISA industrial advisories and CERT-EU advisories. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

61 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates · Some delayed

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  3. CERT-EU

    2026-017: Critical Vulnerability in Cisco Secure Email Gateway

    On 14 October 2026, Cisco published a security advisory addressing a critical vulnerability affecting the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway. This vulnerability could allow an unauthenticated, remote attacker to write arbitrary files and execute commands with root privileges on the underlying operating system. The Cisco PSIRT is aware of active exploitation of this vulnerability. CERT-EU strongly recommends updating the Content Scanner Tools package or upgrading Cisco AsyncOS S…

    Read original (opens in a new tab)
  4. CISA · Known Exploited

    Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

    Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.

    CVE-2026-21589
    Read original (opens in a new tab)
  7. CISA · Known Exploited

    Ahsay AhsayCBS Command Injection Vulnerability

    Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.

    CVE-2026-105134
    Read original (opens in a new tab)
  11. CERT-EU

    2026-016: Critical Vulnerability in GitLab CE and EE

    On 12 October 2026, GitLab released versions 19.4.2, 19.3.4 and 19.2.8 of GitLab Community Edition (CE) and Enterprise Edition (EE), fixing 24 security issues among which a critical vulnerability that could allow an unauthenticated attacker to execute arbitrary code on the server. CERT-EU strongly recommends upgrading self-managed GitLab CE/EE instances to a fixed version as soon as possible, starting with internet-facing instances.

    Read original (opens in a new tab)
  16. CISA · Known Exploited

    Strapi Cleartext Storage of Sensitive Information Vulnerability

    Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.

    CVE-2023-22894
    Read original (opens in a new tab)
  17. CERT-EU

    2026-015: Critical Vulnerability in Multiple Atlassian Products

    On 5 October 2026, Atlassian published a security advisory addressing a critical arbitrary file access vulnerability. It affects Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye. CERT-EU strongly recommends upgrading all affected installations to a fixed version as soon as possible, starting with instances accessible from the internet. CERT-EU also recommends checking access logs for signs of e…

    Read original (opens in a new tab)
  23. CISA · Industrial

    Armatura LLC Armatura One

    Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access to the database, execute arbitrary code on the host with the highest level of privilege, or gain control of the physical access-control system.

    CVE-2023-46604CVE-2026-94591CVE-2026-94592CVE-2026-94593CVE-2026-94594
    Read original (opens in a new tab)
  24. CISA · Industrial

    Monta monta.app

    Successful exploitation of these vulnerabilities could enable attackers to gain unauthorized administrative control over vulnerable charging stations or disrupt charging services through denial-of-service attacks.

    CVE-2026-95102CVE-2026-97363CVE-2026-97212CVE-2026-93474
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.