PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

Every cached source, newest first. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

16,317 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates · Some delayed

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  1. NVD

    CVE-2026-101296 — A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non…

    Critical · CVSS 4.0 9.1 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other…

    CVE-2026-101296
    Read original (opens in a new tab)
  2. NVD

    CVE-2026-34485 — Nokia 1830 Global Express (GX) is vulnerable to a CLI ACL Bypass vulnerability where a low-privileged authenticated attacker…

    CVSS unscored / not supplied

    Nokia 1830 Global Express (GX) is vulnerable to a CLI ACL Bypass vulnerability where a low-privileged authenticated attacker can bypass the SSH isolation mechanism and gain access to the underlying operating system shell via a custom SSH command. This issue occurs by default in the system and is not the result of misconfiguration.

    CVE-2026-34485
    Read original (opens in a new tab)
  3. NVD

    CVE-2026-34484 — Nokia 1830 Global Express GX is vulnerable to a local privilege escalation vulnerability which exists in the administrative…

    CVSS unscored / not supplied

    Nokia 1830 Global Express GX is vulnerable to a local privilege escalation vulnerability which exists in the administrative shell interface. An authenticated local attacker with restricted shell access can exploit this vulnerability to bypass local security restrictions and gain root access on the device.

    CVE-2026-34484
    Read original (opens in a new tab)
  4. NVD

    CVE-2026-113620 — In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not veri…

    Critical · CVSS 3.1 9.8 · Assessor: [email protected]

    In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as RBAC subjects. A self-minted token whose groups contain admin matches the built-in admin role, with no account and no RoleBinding. The attacker can open an exec or log session for a microservice or fog whose UUID they already know. HTTP routes are not affected: they verify the token before RBAC. Agent WebSockets ver…

    CVE-2026-113620
    Read original (opens in a new tab)
  5. NVD

    CVE-2026-113619 — In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substit…

    High · CVSS 3.1 7.5 · Assessor: [email protected]

    In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are rendered by an uncapped Liquid engine before authentication and RBAC. The bearer check does not reject a missing or invalid token, and the auth rate limit applies only to user login routes. A small JSON body can stall or abort the Controller process. The anonymous caller does not receive the rendered result; the impact is availability of the control plane, including the agent API an…

    CVE-2026-113619
    Read original (opens in a new tab)
  6. NVD

    CVE-2026-113470 — Cryptographic issue in the Security Block-lists, Allow-lists, and other State component. This vulnerability was fixed in Fir…

    Medium · CVSS 3.1 5.4 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Cryptographic issue in the Security Block-lists, Allow-lists, and other State component. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, Firefox ESR 115.43.1, Thunderbird 158.0.1, Thunderbird 153.5.1, and Firefox 158.0.2.

    CVE-2026-113470
    Read original (opens in a new tab)
  10. NVD

    CVE-2026-113392 — A vulnerability was found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This vulnerability affects unknown code of the file /c…

    Low · CVSS 4.0 2.1 · Assessor: [email protected]

    A vulnerability was found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This vulnerability affects unknown code of the file /cgi-bin/mainfunction.cgi of the component Apmupload. Performing a manipulation of the argument action results in path traversal. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 1.5.1.7 is able to resolve this issue. Upgrading the affected component is advised. The vendor explains: "2960 1.5.1.7 has corrected many secur…

    CVE-2026-113392
    Read original (opens in a new tab)
  11. NVD

    CVE-2026-113391 — A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function uploadlangs of the file…

    High · CVSS 4.0 8.6 · Assessor: [email protected]

    A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function uploadlangs of the file /cgi-bin/mainfunction.cgi of the component Upload Endpoint. Such manipulation leads to command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.7 is able to mitigate this issue. It is recommended to upgrade the affected component. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And…

    CVE-2026-113391
    Read original (opens in a new tab)
  12. NVD

    CVE-2026-113390 — A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the function sub_182B0 of the fi…

    High · CVSS 4.0 8.6 · Assessor: [email protected]

    A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the function sub_182B0 of the file /cgi-bin/mainfunction.cgi of the component CGI Interface. This manipulation of the argument usefile/usescript/option causes os command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. u…

    CVE-2026-113390
    Read original (opens in a new tab)
  13. NVD

    CVE-2026-105941 — The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without fo…

    High · CVSS 3.1 8.1 · Assessor: [email protected]

    The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire record-encryption trust model.

    CVE-2026-105941
    Read original (opens in a new tab)
  14. NVD

    CVE-2026-18205 — Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ticimax Informatics Te…

    Medium · CVSS 3.1 6.1 · Assessor: [email protected]

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ticimax Informatics Technologies Inc. Ticimax E-Commerce Platform allows Reflected XSS. This issue affects Ticimax E-Commerce Platform: through 2026-09-02.

    CVE-2026-18205
    Read original (opens in a new tab)
  15. NVD

    CVE-2026-14933 — Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2…

    High · CVSS 4.0 8.6 · Assessor: [email protected]

    Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part in the attacker's co-browsing session, via content of the co-browsed page that the agent's browser renders as HTML. The JavaScript runs in the context and under the identity of the agent's session in the Agent Desk or the…

    CVE-2026-14933
    Read original (opens in a new tab)
  16. NVD

    CVE-2026-113583 — Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to e…

    Medium · CVSS 4.0 5.3 · Assessor: [email protected]

    Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by crafting malicious alt text or URL values in an HTML email's external image tag when ALLOW_EXTERNAL_IMAGE_SOURCES is enabled. Attackers can send a specially crafted email so that when the victim opens it, the externalResources.js code builds the blocked-image notice using innerHTML with decoded email-derived values, triggering script execution in the victim's au…

    CVE-2026-113583
    Read original (opens in a new tab)
  17. NVD

    CVE-2026-113496 — A flaw was found in cockpit-machines. When saving Virtual Network Computing (VNC) console settings, the configured password…

    Medium · CVSS 3.1 5.0 · Assessor: [email protected]

    A flaw was found in cockpit-machines. When saving Virtual Network Computing (VNC) console settings, the configured password is passed directly as a command-line argument to an underlying system utility. A local unprivileged attacker on a host that allows cross-user process inspection could read the exposed password from the process list while another user modifies settings. This credential disclosure can allow unauthorized access to the guest virtual machine's graphical console.

    CVE-2026-113496
    Read original (opens in a new tab)
  18. NVD

    CVE-2026-113495 — A flaw was found in cockpit-machines. Red Hat Subscription Management (RHSM) authentication tokens are passed as command-lin…

    Medium · CVSS 3.1 5.0 · Assessor: [email protected]

    A flaw was found in cockpit-machines. Red Hat Subscription Management (RHSM) authentication tokens are passed as command-line arguments to background helper processes during image retrieval operations. A local, unprivileged attacker on a system permitting cross-user process inspection can view these arguments while the process is active. This flaw can lead to information disclosure, potentially allowing unauthorized access to RHSM resources within the token's validity period.

    CVE-2026-113495
    Read original (opens in a new tab)
  19. NVD

    CVE-2026-113389 — A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function set_…

    High · CVSS 4.0 8.6 · Assessor: [email protected]

    A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function set_table of the file /cgi-bin/mainfunction.cgi of the component CGI Process. The manipulation of the argument sectiontype results in command injection. The attack may be launched remotely. The exploit is now public and may be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated…

    CVE-2026-113389
    Read original (opens in a new tab)
  20. NVD

    CVE-2026-113388 — A security flaw has been discovered in opensource-socialnetwork up to 9.11/10.1. This affects the function input of the file…

    Low · CVSS 4.0 1.9 · Assessor: [email protected]

    A security flaw has been discovered in opensource-socialnetwork up to 9.11/10.1. This affects the function input of the file actions/administrator/cache/dynamic.php of the component Cache Settings. Performing a manipulation of the argument host/port/username/password/type/status results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The patch is named 40945057cb451f0f35153110bc7e889c094400e1. Applying a patch is the recommended acti…

    CVE-2026-113388
    Read original (opens in a new tab)
  21. NVD

    CVE-2026-113385 — A vulnerability has been found in LeeDrOiD Labs Shortcutter 2 App 9.0.48 on Android. This issue affects the function Class.f…

    Low · CVSS 4.0 1.9 · Assessor: [email protected]

    A vulnerability has been found in LeeDrOiD Labs Shortcutter 2 App 9.0.48 on Android. This issue affects the function Class.forName of the file ToggleGeneric.java. The manipulation of the argument Class leads to improper export of android application components. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 9.0.90 is capable of addressing this issue. It is suggested to upgrade the affected component. The vendor was contacted earl…

    CVE-2026-113385
    Read original (opens in a new tab)
  22. NVD

    CVE-2026-105949 — Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wild…

    High · CVSS 3.1 8.8 · Assessor: [email protected]

    Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true). The servlet routes requests using Path.of(pathInfo).getFileName(), which strips all leading segments and trailing slashes. Requests like POST /kafkacruisecontrol/x/rebalance bypass authentication entirely but still dispatch to admin endpoints. All 15 admin endpoints become reachable without authentication. In AMQ Streams,…

    CVE-2026-105949
    Read original (opens in a new tab)
  23. NVD

    CVE-2026-105312 — A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrar…

    Critical · CVSS 3.1 9.9 · Assessor: [email protected]

    A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all Strimzi CRDs (including KafkaUsers), patch on Kafkas/KafkaRebalances, and cluster-monitoring-view. The attacker's code reads the projected SA token and gains cross-tenant Strimzi control-plane read+write access.

    CVE-2026-105312
    Read original (opens in a new tab)
  24. NVD

    CVE-2026-105311 — The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom re…

    High · CVSS 3.1 7.7 · Assessor: [email protected]

    The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters[].credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets RBAC, reads the victim-namespace KafkaUser Secret (SASL credentials or TLS private keys) and writes the plaintext material into a Secret in the attacker's namespace. No same-namespace check or allowlist exists anywhere in the code path.

    CVE-2026-105311
    Read original (opens in a new tab)
  25. NVD

    CVE-2026-9589 — Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 thro…

    Critical · CVSS 4.0 9.3 · Assessor: [email protected]

    Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren't authorized to access, including other users, other accounts and, in Unblu Cloud, other customers' accounts, via configuration read and write operations that target those entities. The Collaboration Server doesn't check whether t…

    CVE-2026-9589
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.