THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
Every cached source, newest first. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,746 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates · Some delayed
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUpdates delayed · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-113662 — ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authentica…
Medium · CVSS 3.1 5.4 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated user with import access to a target type can supply an object or operator as an update-key value, causing the import query to match an unidentified existing document that the user has generic edit permission to modify. The normal findForEditing permission filter still limits the candidate documents, so the issue does not permit permission-free overwrite of arbitrary protected content. Thi…
CVE-2026-113662Read original ↗ (opens in a new tab) - NVD
CVE-2026-113661 — ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a…
Medium · CVSS 3.1 5.4 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default configuration that allows meta refresh elements and their http-equiv and content attributes can retain unsafe script or redirect destinations embedded in the refresh content value. This issue is fixed in sanitize-html 2.18.0.
CVE-2026-113661Read original ↗ (opens in a new tab) - NVD
CVE-2026-113660 — ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, ApostropheCMS’s exist-in-locale API allo…
Medium · CVSS 3.1 4.3 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorization criteria. This issue is fixed in version 4.33.0.
CVE-2026-113660Read original ↗ (opens in a new tab) - NVD
CVE-2026-113659 — ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an unauthenticated attacker can send a c…
Medium · CVSS 3.1 6.1 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an unauthenticated attacker can send a crafted link whose query string is automatically parsed by apos.http.parseQuery when an authenticated victim loads a page with the admin bundle. The parser accepts the special __proto__, constructor, and prototype path keys, allowing browser prototype mutation that can reach an unsafe DOM sink and execute script in the victim's session; anonymous visitors do not load the affected admin context…
CVE-2026-113659Read original ↗ (opens in a new tab) - NVD
CVE-2026-113507 — A vulnerability was found in aaPanel up to 8.25.0. The impacted element is the function GetClientIp of the file class/public…
Medium · CVSS 4.0 5.5 · Assessor: [email protected]
A vulnerability was found in aaPanel up to 8.25.0. The impacted element is the function GetClientIp of the file class/public/common.py. The manipulation of the argument X-Real-Ip results in improper access controls. The attack may be performed from remote. The exploit has been made public and could be used. The vendor confirms: "The reported X-Real-Ip IP-bypass vulnerability has already been fixed".
CVE-2026-113507Read original ↗ (opens in a new tab) - NVD
CVE-2026-113506 — A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class/pub…
High · CVSS 4.0 8.6 · Assessor: [email protected]
A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class/public/common.py of the component File Manager. The manipulation of the argument sfile/dfile/access/user leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: "The reported RCE and LFI vulnerabilities require authentication."
CVE-2026-113506Read original ↗ (opens in a new tab) - NVD
CVE-2026-112861 — Authorization Bypass Through User-Controlled Key vulnerability in xnau webdesign Participants Database participants-database…
Medium · CVSS 3.1 6.3 · Assessor: [email protected]
Authorization Bypass Through User-Controlled Key vulnerability in xnau webdesign Participants Database participants-database allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Participants Database: from n/a through 2.7.8.5.
CVE-2026-112861Read original ↗ (opens in a new tab) - NVD
CVE-2026-111756 — follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to bef…
High · CVSS 4.0 8.2 · Assessor: [email protected]
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller's headers container with for...in and matches header names against a filter. This assumes th…
CVE-2026-111756Read original ↗ (opens in a new tab) - NVD
CVE-2026-105772 — Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScript (@google/adk) versions 0.4.0 before 0.6.0 allows a r…
Critical · CVSS 4.0 9.1 · Assessor: [email protected]
Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScript (@google/adk) versions 0.4.0 before 0.6.0 allows a remote unauthenticated attacker to read files matching the artifact directory layout or write files (when an agent tool invokes saveArtifact) outside the intended artifact storage root via crafted relative or percent-encoded path traversal sequences (such as ../ or ..%2F) in the userId or sessionId parameters when the ADK API server is exposed with the non-default FileArtifactService enabled.…
CVE-2026-105772Read original ↗ (opens in a new tab) - NVD
CVE-2026-92539 — A service account with user-management permissions in one organization can read, modify, disable or delete users belonging t…
Medium · CVSS 3.1 6.7 · Assessor: [email protected]
A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.
CVE-2026-92539Read original ↗ (opens in a new tab) - NVD
CVE-2026-28331 — SolarWinds Patch Manager exposes sensitive information accessible to local users, which could be used to gain elevated privi…
Medium · CVSS 3.1 4.4 · Assessor: [email protected]
SolarWinds Patch Manager exposes sensitive information accessible to local users, which could be used to gain elevated privileges.
CVE-2026-28331Read original ↗ (opens in a new tab) - NVD
CVE-2026-28330 — SolarWinds Observability Self-Hosted was found to be affected by a stored Cross-Site Scripting (XSS) vulnerability that allo…
Medium · CVSS 3.1 4.6 · Assessor: [email protected]
SolarWinds Observability Self-Hosted was found to be affected by a stored Cross-Site Scripting (XSS) vulnerability that allows authenticated attackers to inject malicious content or JavaScript, which is displayed or executed in the browsers of other authenticated users who access the affected pages.
CVE-2026-28330Read original ↗ (opens in a new tab) - NVD
CVE-2026-28329 — SolarWinds Observability Self-Hosted was found to be affected by a Server-Side Request Forgery (SSRF) vulnerability that all…
Medium · CVSS 3.1 6.4 · Assessor: [email protected]
SolarWinds Observability Self-Hosted was found to be affected by a Server-Side Request Forgery (SSRF) vulnerability that allows authenticated attackers to cause the application server to send requests to attacker-controlled or internal destinations.
CVE-2026-28329Read original ↗ (opens in a new tab) - NVD
CVE-2026-28328 — SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged…
High · CVSS 3.1 8.8 · Assessor: [email protected]
SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access and modify information beyond their assigned permissions.
CVE-2026-28328Read original ↗ (opens in a new tab) - NVD
CVE-2026-113658 — ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conver…
High · CVSS 3.1 7.5 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conversion route writes a multipart upload to the system temporary directory before checking its extension and does not remove the staged file when that validation rejects it. Repeated large rejected uploads, using the normal public CSRF cookie, can persistently consume temporary-disk capacity and may disrupt ApostropheCMS and other services that depend on the same partition. This issue is fixed in…
CVE-2026-113658Read original ↗ (opens in a new tab) - NVD
CVE-2026-113657 — ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a…
Low · CVSS 3.1 3.7 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From sanitize-html 2.17.7 until 2.18.0, an application configuration that permits namespace-prefixed SVG animation elements and the relevant URL-targeting attributes can bypass the SMIL URL protection because prefixed tag names do not match the unprefixed animation-element check. The bypass can rewrite a link destination to an unsafe URI after the sanitized SVG is rendered, with s…
CVE-2026-113657Read original ↗ (opens in a new tab) - NVD
CVE-2026-113656 — ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its form…
Medium · CVSS 3.1 5.3 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its form submission route stages unbounded multipart uploads before form validation or authentication and lacks upload size, count, and rate limits. Repeated unauthenticated submissions can consume temporary disk storage and disrupt form handling or other host services. This issue is fixed in ApostropheCMS Form 1.5.5.
CVE-2026-113656Read original ↗ (opens in a new tab) - NVD
CVE-2026-113655 — ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an authenticated editor with legitimate…
Medium · CVSS 3.1 4.3 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an authenticated editor with legitimate edit rights on a pre-existing ordinary page nested under a restricted parent can use the same-parent page move operation to change sibling ranks without create authorization on that parent. The non-default nesting must already exist, and the bypass is limited to sibling ordering rather than arbitrary content modification, confidentiality loss, or creation of the restricted nesting. This issue…
CVE-2026-113655Read original ↗ (opens in a new tab) - NVD
CVE-2026-113654 — ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default nonTextTags configuration that includes noscript can end its discard region early when htmlparser2 emits an implied ancestor close inside noscript. Because scripting-enabled browsers treat noscript content as raw text while the parser does not model that mode, content intended to remain inert can survive sanitization and render; the iss…
CVE-2026-113654Read original ↗ (opens in a new tab) - NVD
CVE-2026-113653 — ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, viewRole is not applied to anonymous vis…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, viewRole is not applied to anonymous visitors when a developer exposes user objects through a publicly rendered relationship or expressly enabled public API. Inadequately limited templates, including serialization of an entire related user object, can conditionally disclose user fields, but relationships do not automatically publish full user objects and password hashes are stored separately and are not affected. This issue is fixe…
CVE-2026-113653Read original ↗ (opens in a new tab) - NVD
CVE-2026-113652 — ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leaks ac…
Medium · CVSS 3.1 5.6 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leaks account-level SAS token into every public attachment URL. When uploadfs is configured with the Azure backend and sas: true, createContainer() builds the BlobServiceClient from a URL that embeds the full SAS query string, and Azure SDK v12 derived clients inherit that query string. This issue is fixed in version 1.28.0.
CVE-2026-113652Read original ↗ (opens in a new tab) - NVD
CVE-2026-113651 — ApostropheCMS is an open-source Node.js content management system, and uploadfs is its file storage library. Prior to upload…
Low · CVSS 3.1 3.3 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system, and uploadfs is its file storage library. Prior to uploadfs 1.28.0, attacker-controlled paths that reach the local backend can contain parent-directory segments that escape the configured upload directory and affect file reads, writes, and deletion on the host filesystem. Exploitability depends on an application exposing the relevant uploadfs operations to untrusted path. This issue is fixed in uploadfs 1.28.0.
CVE-2026-113651Read original ↗ (opens in a new tab) - NVD
CVE-2026-113650 — ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an is not allowed and disal…
Medium · CVSS 3.1 5.3 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an is not allowed and disallowedTagsMode is 'discard' (the defaults), its raw-text content is re-sanitized by a recursive call to sanitizeHtml(text, options). The recursion has no bound and starts each nested call with a fresh state. This vulnerability is fixed in 2.18.1.
CVE-2026-113650Read original ↗ (opens in a new tab) - NVD
CVE-2026-113649 — ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module and 4.34.0 of…
Medium · CVSS 3.1 6.5 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module and 4.34.0 of core ApostropheCMS, an editor who can import an enabled content type but lacks its stronger publication role can cause import write helpers to create, replace, or remove published variants without the normal publish permission and lifecycle checks. This issue is fixed in import-export 3.7.1 and ApostropheCMS 4.34.0.
CVE-2026-113649Read original ↗ (opens in a new tab) - NVD
CVE-2026-113648 — ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpo…
Low · CVSS 3.1 3.1 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticated anonymous users who have obtained the standard CSRF cookie from visiting the site—can directly invoke this route and trigger the underlying self.cleanExport(req) method. This issue is fixed in version 3.7.1.
CVE-2026-113648Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.