PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

Every cached source, newest first. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

16,751 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates · Some delayed

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  1. NVD

    CVE-2026-101366 — Vulnerability in Oracle REST Data Services (component: ADP). Supported versions that are affected are 24.2.0-26.1.0. Easily…

    Medium · CVSS 3.1 4.3 · Assessor: [email protected]

    Vulnerability in Oracle REST Data Services (component: ADP). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

    CVE-2026-101366
    Read original (opens in a new tab)
  2. NVD

    CVE-2026-101365 — Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versions that are affected are 24.2.0-26…

    Medium · CVSS 3.1 4.7 · Assessor: [email protected]

    Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as unauthorized read access to a subset of Oracle REST Data Services accessible data and unau…

    CVE-2026-101365
    Read original (opens in a new tab)
  3. NVD

    CVE-2026-101364 — Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versions that are affected are 24.2.0-26…

    Medium · CVSS 3.1 5.4 · Assessor: [email protected]

    Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability c…

    CVE-2026-101364
    Read original (opens in a new tab)
  4. NVD

    CVE-2026-101363 — Vulnerability in Oracle REST Data Services (component: Graph QL). Supported versions that are affected are 24.2.0-26.1.0. Ea…

    Medium · CVSS 3.1 5.3 · Assessor: [email protected]

    Vulnerability in Oracle REST Data Services (component: Graph QL). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

    CVE-2026-101363
    Read original (opens in a new tab)
  5. NVD

    CVE-2026-101362 — Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Diffic…

    Medium · CVSS 3.1 6.9 · Assessor: [email protected]

    Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result…

    CVE-2026-101362
    Read original (opens in a new tab)
  6. NVD

    CVE-2026-101361 — Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Diffic…

    Medium · CVSS 3.1 4.2 · Assessor: [email protected]

    Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Scor…

    CVE-2026-101361
    Read original (opens in a new tab)
  7. NVD

    CVE-2026-101360 — Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily…

    Medium · CVSS 3.1 5.4 · Assessor: [email protected]

    Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score…

    CVE-2026-101360
    Read original (opens in a new tab)
  8. NVD

    CVE-2026-101359 — Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily…

    Medium · CVSS 3.1 5.3 · Assessor: [email protected]

    Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).

    CVE-2026-101359
    Read original (opens in a new tab)
  12. NVD

    CVE-2026-9869 — A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R (version(s): TOTOLINK-…

    Critical · CVSS 3.1 9.1 · Assessor: [email protected]

    A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

    CVE-2026-9869
    Read original (opens in a new tab)
  13. NVD

    CVE-2026-9827 — A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-G…

    Critical · CVSS 3.1 9.1 · Assessor: [email protected]

    A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

    CVE-2026-9827
    Read original (opens in a new tab)
  14. NVD

    CVE-2026-9817 — A stack-based buffer overflow vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X…

    Critical · CVSS 3.1 9.1 · Assessor: [email protected]

    A stack-based buffer overflow vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

    CVE-2026-9817
    Read original (opens in a new tab)
  15. NVD

    CVE-2026-9814 — An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s): TOTOLINK-X20…

    Critical · CVSS 3.1 9.1 · Assessor: [email protected]

    An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

    CVE-2026-9814
    Read original (opens in a new tab)
  16. NVD

    CVE-2026-9660 — Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (versio…

    Critical · CVSS 3.1 9.1 · Assessor: [email protected]

    Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability deals with the vpnPassword parameter.

    CVE-2026-9660
    Read original (opens in a new tab)
  17. NVD

    CVE-2026-9659 — Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (versio…

    Critical · CVSS 3.1 9.1 · Assessor: [email protected]

    Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability deals with the vpnUser parameter.

    CVE-2026-9659
    Read original (opens in a new tab)
  19. NVD

    CVE-2026-94265 — When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might erroneously reta…

    CVSS unscored / not supplied

    When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl to send a freshly minted Kerberos ticket—generated using the ambient identity of the client process to an untrusted third-party host, effectively bypassing the domain-scoping restrictions normally enforced by the absenc…

    CVE-2026-94265
    Read original (opens in a new tab)
  20. NVD

    CVE-2026-92391 — A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cle…

    CVSS unscored / not supplied

    A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process.

    CVE-2026-92391
    Read original (opens in a new tab)
  21. NVD

    CVE-2026-92390 — When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an inte…

    CVSS unscored / not supplied

    When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S) server to overwrite an existing local file specified in the `Content-Disposition` header despite the presence of the `-J` non-overwrite constraint.

    CVE-2026-92390
    Read original (opens in a new tab)
  22. NVD

    CVE-2026-92389 — libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening…

    CVSS unscored / not supplied

    libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.

    CVE-2026-92389
    Read original (opens in a new tab)
  23. NVD

    CVE-2026-92388 — When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the w…

    CVSS unscored / not supplied

    When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via `curl_easy_duphandle()` copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read agains…

    CVE-2026-92388
    Read original (opens in a new tab)
  24. NVD

    CVE-2026-92387 — By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and…

    CVSS unscored / not supplied

    By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle.

    CVE-2026-92387
    Read original (opens in a new tab)
  25. NVD

    CVE-2026-92386 — When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that…

    CVSS unscored / not supplied

    When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its line-length parsing limit. Consequently, any subsequent `curl` invocation reading from that same cookie jar using `--cookie` silently aborts parsing prematurely upon encountering the too long line, ignoring all subsequent valid cookies in the file.

    CVE-2026-92386
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.