PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

The complete recent NVD stream, including unscored entries. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

15,628 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates · Some delayed

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  1. NVD

    CVE-2026-113600 — Fat Free CRM before 0.26.0 contains an insecure direct object reference vulnerability that allows authenticated users to mod…

    Medium · CVSS 4.0 5.3 · Assessor: [email protected]

    Fat Free CRM before 0.26.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify or delete other users' comments because CommentsController#update and #destroy use an unscoped Comment.find without authorization checks. Attackers can send PUT or DELETE requests to /comments/:id with enumerable sequential IDs to edit or delete comments on contacts, accounts, leads, and opportunities owned by others.

    CVE-2026-113600
    Read original (opens in a new tab)
  2. NVD

    CVE-2026-113599 — Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create au…

    Medium · CVSS 4.0 5.3 · Assessor: [email protected]

    Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create auto-reply messages for arbitrary mailboxes by supplying another user's mbox value. Attackers can POST to /api/v2/armessages/ to inject attacker-controlled auto-reply subject and content into victims' settings or break their auto-reply management via MultipleObjectsReturned errors.

    CVE-2026-113599
    Read original (opens in a new tab)
  3. NVD

    CVE-2026-113598 — Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete al…

    Medium · CVSS 4.0 5.3 · Assessor: [email protected]

    Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete alarms of other domains via the POST /api/v2/alarms/bulk_delete/ action. Attackers can enumerate sequential alarm IDs to delete DNS, MX and blocklist monitoring alarms server-wide, hiding problems from responsible administrators.

    CVE-2026-113598
    Read original (opens in a new tab)
  4. NVD

    CVE-2026-113597 — Blinko through 1.8.8 contains an insecure direct object reference vulnerability in the tag tRPC router that allows authentic…

    Medium · CVSS 4.0 5.3 · Assessor: [email protected]

    Blinko through 1.8.8 contains an insecure direct object reference vulnerability in the tag tRPC router that allows authenticated users to read and modify other users' tags by supplying arbitrary tag IDs. Attackers can enumerate sequential IDs via fullTagNameById, updateTagIcon, and updateTagOrder to reveal private note topics and tamper with tag icons and ordering.

    CVE-2026-113597
    Read original (opens in a new tab)
  5. NVD

    CVE-2026-113596 — Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users'…

    Low · CVSS 4.0 2.3 · Assessor: [email protected]

    Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users' project data via the publishedBuilds and findManyByIds tRPC procedures. Attackers who know another user's project UUID can query the /trpc handler to retrieve publish history, titles, domains, preview images, and latest builds.

    CVE-2026-113596
    Read original (opens in a new tab)
  6. NVD

    CVE-2026-113595 — Sharkord before 0.0.26 contains a missing authorization vulnerability in the others.changeLogo tRPC mutation that allows any…

    Medium · CVSS 4.0 5.3 · Assessor: [email protected]

    Sharkord before 0.0.26 contains a missing authorization vulnerability in the others.changeLogo tRPC mutation that allows any authenticated member to modify the server logo without the MANAGE_SETTINGS permission. Attackers can remove the current logo and replace it with an uploaded image that is published to every connected client.

    CVE-2026-113595
    Read original (opens in a new tab)
  7. NVD

    CVE-2026-113594 — Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-w…

    Medium · CVSS 4.0 5.3 · Assessor: [email protected]

    Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-wide settings by calling the others.updateSettings tRPC mutation without the MANAGE_SETTINGS permission. Attackers can set a join password, disable registration, zero upload limits, or toggle plugin loading to deny service to other members.

    CVE-2026-113594
    Read original (opens in a new tab)
  8. NVD

    CVE-2026-113359 — Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values…

    Medium · CVSS 4.0 5.3 · Assessor: [email protected]

    Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other workspaces via the unique_row_values API endpoint. Attackers can enumerate sequential field IDs to retrieve up to 100 distinct cell values per field from tables in workspaces they do not belong to.

    CVE-2026-113359
    Read original (opens in a new tab)
  9. NVD

    CVE-2026-112956 — ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, duplicate-imp…

    Medium · CVSS 3.1 6.5 · Assessor: [email protected]

    ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, duplicate-import continuation accepts client-controlled replacement choices without binding them to a user-owned server-side analysis or authorizing the canonical target. On an import-enabled localized type, a contributor with draft editing authority can cross the publication boundary by selecting a published document for replacement, although the current assessment is based on remediation review rather t…

    CVE-2026-112956
    Read original (opens in a new tab)
  10. NVD

    CVE-2026-112955 — ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authentica…

    Medium · CVSS 3.1 6.5 · Assessor: [email protected]

    ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authenticated importer can submit archives whose decompressed bytes, entry count, and entry sizes are not bounded before document-type authorization, and extraction or parsing failures can leave staging and extracted artifacts without unconditional cleanup. The already-hardened pre-authentication and write-error paths are separate, and current end-to-end denial-of-service impact from this residual path…

    CVE-2026-112955
    Read original (opens in a new tab)
  11. NVD

    CVE-2026-112954 — ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicA…

    Medium · CVSS 3.1 5.3 · Assessor: [email protected]

    ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicApiProjection can expose excluded searchable or sortable field information through search membership and sort ordering oracles. Returned fields remain filtered by the projection, so the issue permits targeted inference about hidden values rather than an unrestricted field dump. This issue is fixed in version 4.34.0.

    CVE-2026-112954
    Read original (opens in a new tab)
  12. NVD

    CVE-2026-112953 — ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, predictable e…

    Medium · CVSS 4.0 6.0 · Assessor: [email protected]

    ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, predictable export archive filenames allow an unauthenticated requester to download another user's export from publicly readable export storage before the archive expires or is removed. A user with export permission must first create the archive, and sites with exports disabled, private upload storage, or authenticated upload delivery are not exposed through this network-download path. This issue is fixed…

    CVE-2026-112953
    Read original (opens in a new tab)
  13. NVD

    CVE-2026-112952 — ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, 'POST /api/v1/@apostrophecms/doc/slugTak…

    Medium · CVSS 3.1 4.3 · Assessor: [email protected]

    ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, 'POST /api/v1/@apostrophecms/doc/slugTaken' with body { "slug": "target-slug" } returns a boolean indicating whether a slug is in use across all document types and visibility levels, with no permission or type filter. Any logged-in user (including editors) can enumerate the slug space of private pages, drafts, and archived content. This issue is fixed in version 4.34.0.

    CVE-2026-112952
    Read original (opens in a new tab)
  14. NVD

    CVE-2026-112951 — ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the color field accepts trailing content…

    Medium · CVSS 3.1 5.4 · Assessor: [email protected]

    ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the color field accepts trailing content after a valid rgb() or hsl() prefix because its TinyColor validation does not require the entire value to match a color. An authenticated user with edit rights can store arbitrary HTML after a valid color prefix. When the stored value is rendered, the payload executes, resulting in stored XSS. This issue is fixed in version 4.34.0.

    CVE-2026-112951
    Read original (opens in a new tab)
  15. NVD

    CVE-2026-112950 — Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFile…

    Medium · CVSS 3.1 5.9 · Assessor: [email protected]

    Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows in packages/mocker/src/node/interceptorPlugin.ts. When a client can reach the Vite dev server on Windows and register a redirect mock containing backslash traversal, POSIX joining preserves a Windows backslash traversal that the later filesystem read interprets as a path separator, so the client can read a fil…

    CVE-2026-112950
    Read original (opens in a new tab)
  16. NVD

    CVE-2026-112949 — Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3,…

    Medium · CVSS 3.1 4.7 · Assessor: [email protected]

    Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock whose attacker-controlled url createManualModuleSource inserts unescaped into generated module source. When the developer browser loads the affected module, attacker-controlled JavaScript executes on the development-server origin. This issue is fixed in versio…

    CVE-2026-112949
    Read original (opens in a new tab)
  17. NVD

    CVE-2026-112948 — Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny…

    Medium · CVSS 3.1 6.5 · Assessor: [email protected]

    Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI, Browser Mode, or API server can read denied project files or the fallback API token at node_modules/.vitest/.vitest-secret-token, and Browser Mode with test.projects can expose JavaScript-compatible .env values through a mali…

    CVE-2026-112948
    Read original (opens in a new tab)
  18. NVD

    CVE-2026-112947 — Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of…

    Medium · CVSS 4.0 6.3 · Assessor: [email protected]

    Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Requests containing the ?vite-wasm-instance query are handled by the internal Wasm plugin's load hook. The hook removes the query and reads the resulting path directly from disk, but the server.fs checks were not applied. After reading the file, Vite attempts to parse it as WebAssembly. When that pa…

    CVE-2026-112947
    Read original (opens in a new tab)
  19. NVD

    CVE-2026-112946 — Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can rec…

    Medium · CVSS 4.0 6.3 · Assessor: [email protected]

    Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can record a root-relative browser URL in safeModulePaths instead of the cleaned resolved module identifier. On a network-accessible, non-Windows development server, an imported project file whose URL matches an absolute host path can authorize a later raw-filesystem request for that host file, provided server.fs.deny does not block it. The request can disclose the matching file outside the project…

    CVE-2026-112946
    Read original (opens in a new tab)
  20. NVD

    CVE-2026-112945 — Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using cust…

    Low · CVSS 4.0 2.1 · Assessor: [email protected]

    Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an unchanged browser request URL to server.transformIndexHtml. getHtmlFilename uses the query-bearing request URL to resolve an existing local file while preserving attacker-supplied leading slashes in the generated proxy module URL. If the transformed HTML contains an inline module script and a victim browser loads the crafted development-server pa…

    CVE-2026-112945
    Read original (opens in a new tab)
  24. NVD

    CVE-2026-112824 — Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat…

    Medium · CVSS 3.1 5.3 · Assessor: [email protected]

    Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through 5.9.7.

    CVE-2026-112824
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.