PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

Every cached source, newest first. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

16,297 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates · Some delayed

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  1. NVD

    CVE-2026-112069 — The extension no longer applied its access protection to files in file storages that use a non-default relative base path. T…

    Medium · CVSS 4.0 6.3 · Assessor: f4fb688c-4412-4426-b4b8-421ecf27b14a

    The extension no longer applied its access protection to files in file storages that use a non-default relative base path. These files were served directly by the web server, without any authentication or permission check. The issue is only exploitable when the extension is used on a website running TYPO3 14.3.

    CVE-2026-112069
    Read original (opens in a new tab)
  3. NVD

    CVE-2026-112067 — The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself. Anyone who can request a…

    Medium · CVSS 4.0 6.9 · Assessor: f4fb688c-4412-4426-b4b8-421ecf27b14a

    The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself. Anyone who can request a CAPTCHA image can read the answer from it and submit it, so automated clients can pass the challenge. This applies to the default configuration, because the audio feature that causes the answer to be embedded is enabled by default. Forms that rely on the CAPTCHA as their only protection against automated submissions are exposed to abuse by bots.

    CVE-2026-112067
    Read original (opens in a new tab)
  4. NVD

    CVE-2026-112066 — The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users…

    High · CVSS 4.0 7.1 · Assessor: f4fb688c-4412-4426-b4b8-421ecf27b14a

    The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website.

    CVE-2026-112066
    Read original (opens in a new tab)
  5. NVD

    CVE-2026-112065 — The routes that provide consent history and statistics data did not check whether the backend user had access to the module…

    Medium · CVSS 4.0 5.3 · Assessor: f4fb688c-4412-4426-b4b8-421ecf27b14a

    The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the requested page. Any authenticated backend user, regardless of permissions, could therefore retrieve consent data of any site in the installation.

    CVE-2026-112065
    Read original (opens in a new tab)
  6. NVD

    CVE-2026-112064 — The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used…

    High · CVSS 4.0 7.1 · Assessor: f4fb688c-4412-4426-b4b8-421ecf27b14a

    The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the filter conditions of that query were bound as parameters. A backend user with access to the history or statistics functions could use this to read arbitrary data from the database, including password hashes of backend and frontend users.

    CVE-2026-112064
    Read original (opens in a new tab)
  8. NVD

    CVE-2026-92287 — Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects…

    CVSS unscored / not supplied

    Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects users who read Parquet files and configure Parquet decryption properties with a KmsClient implementation. On the reader side, the KMS URL can be application-controlled (specified in the KmsConnectionConfig) or file-controlled. If the user does not leverage application control for this parameter, a file-controlled KMS URL is forwarded to a pluggable KmsClient implementation. If the KMS implem…

    CVE-2026-92287
    Read original (opens in a new tab)
  22. NVD

    CVE-2026-11960 — Enumeration of unauthenticated users in FacturaScripts, version 2025.61. The application returns different responses when at…

    Medium · CVSS 4.0 6.9 · Assessor: [email protected]

    Enumeration of unauthenticated users in FacturaScripts, version 2025.61. The application returns different responses when attempting to log in with a valid username compared to an invalid one. An unauthenticated attacker could systematically identify valid usernames by examining variations in the application’s responses, such as changes in response time, discrepancies between error messages or differences in HTTP status codes. A successful exploit allows the attacker to compile a list of valid user accounts. This…

    CVE-2026-11960
    Read original (opens in a new tab)
  23. NVD

    CVE-2026-11959 — Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisatio…

    Medium · CVSS 4.0 6.9 · Assessor: [email protected]

    Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisation of user input in the ‘city’ and ‘province’ fields in the ‘ListAlmacen’ endpoint. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim’s browser (the application user) or to escalate privileges from a normal user to an administrator by executing specially crafted JavaScript code, thereby compromising the system’s confidentia…

    CVE-2026-11959
    Read original (opens in a new tab)
  24. NVD

    CVE-2026-113469 — A failure has been identified in the SNS during dynamic data files signature check. A logic error in the signature verificat…

    High · CVSS 3.1 7.5 · Assessor: [email protected]

    A failure has been identified in the SNS during dynamic data files signature check. A logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine.

    CVE-2026-113469
    Read original (opens in a new tab)
  25. NVD

    CVE-2026-113465 — It is possible to execute a DOM-based Cross-Site Scripting attack against Stormshield’s web administration panel. To exploit…

    Medium · CVSS 3.1 6.6 · Assessor: [email protected]

    It is possible to execute a DOM-based Cross-Site Scripting attack against Stormshield’s web administration panel. To exploit this vulnerability, an attacker would need to craft a URL containing a malicious script payload within a specific parameter and lure an authenticated administrator into visiting that link.

    CVE-2026-113465
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.