PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

Every cached source, newest first. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

16,236 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates · Some delayed

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  1. NVD

    CVE-2026-110676 — Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits…

    CVSS unscored / not supplied

    Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum. With allow_bignum, a JSON number with a fraction or exponent decodes to a Math::BigFloat, which stores the exponent separately and so decodes cheaply. Encoding it untyped or as JSON_TYPE_FLOAT writes the plain decimal form with one digit per unit of exponent. Nothing bounds the exponent, so the 12-byte text [1e30000000] encodes to 30 MB. Untrusted JSON decoded with allow_b…

    CVE-2026-110676
    Read original (opens in a new tab)
  2. NVD

    CVE-2026-110675 — Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in dec…

    CVSS unscored / not supplied

    Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv. With utf8 and allow_barekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key's bytes are stored as a UTF-8 flagged string without any check. Malformed UTF-8, control bytes and backslashes reach the decoded hash, while malformed UTF-8 and control bytes in a quoted key or a value are rejected. Later operations on the key, including lc, uc or encoding the hash ag…

    CVE-2026-110675
    Read original (opens in a new tab)
  3. NVD

    CVE-2026-110674 — Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under d…

    CVSS unscored / not supplied

    Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv. With allow_barekey, which relaxed enables, a bare key containing a non-ASCII byte is stored as UTF-8 but looked up as raw bytes, so a repeated key escapes the duplicate-key check and replaces the earlier value. From 4.41, under dupkeys_as_arrayref, a bare repeat replaces the array that collects a key's values with a plain value, and the next quoted repeat push…

    CVE-2026-110674
    Read original (opens in a new tab)
  4. NVD

    CVE-2026-110673 — Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_ta…

    CVSS unscored / not supplied

    Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag. With allow_tags, "(" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not counted against max_depth. A run of "(" bytes exhausts the C stack and triggers an uncatchable segmentation fault regardless of max_depth.

    CVE-2026-110673
    Read original (opens in a new tab)
  5. NVD

    CVE-2026-110672 — Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing c…

    CVSS unscored / not supplied

    Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv. A quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when the object is rejected for a missing ':' after the key or, from 4.09, for a duplicate key. Duplicate keys are an error unless allow_dupkeys, dupkeys_as_arrayref or relaxed is set. A process that keeps running after a failed…

    CVE-2026-110672
    Read original (opens in a new tab)
  6. NVD

    CVE-2026-109437 — Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox…

    Critical · CVSS 4.0 9.2 · Assessor: [email protected]

    Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API. Attackers can create a session via POST /sessions and post a message via POST /sessions/{id}/messages without credentials, causing the Deep Agents ReAct loop to run attacker-directed shell commands through the local shell backend, resulting in remote code execution as the server process.

    CVE-2026-109437
    Read original (opens in a new tab)
  7. NVD

    CVE-2026-109434 — Fenrir Sleipnir Browser for Android before 3.9.0 contains a UI spoofing vulnerability that allows remote attackers to impers…

    Medium · CVSS 4.0 5.1 · Assessor: [email protected]

    Fenrir Sleipnir Browser for Android before 3.9.0 contains a UI spoofing vulnerability that allows remote attackers to impersonate the browser's trusted address bar by entering fullscreen mode via the Fullscreen API without displaying a persistent notification or trusted-origin indicator. Attackers can render a counterfeit address bar showing a trusted origin over attacker-controlled content after a single user tap, enabling credential harvesting, malware delivery, or social engineering through fake login, update,…

    CVE-2026-109434
    Read original (opens in a new tab)
  10. NVD

    CVE-2026-55644 — Element X iOS is a Matrix iOS Client provided by Element. Element X iOS before version 26.05.0 fails to check the URL allowl…

    Medium · CVSS 4.0 5.1 · Assessor: [email protected]

    Element X iOS is a Matrix iOS Client provided by Element. Element X iOS before version 26.05.0 fails to check the URL allowlist when parsing io.element.call://. If an attacker is able to trick the user into opening a maliciously crafted io.element.call:// URL, they are able to load an attacker-controlled origin inside the call screen's WKWebView which will be granted device microphone and camera permissions (provided the user has previously granted these permissions to Element X iOS). This issue has been patched i…

    CVE-2026-55644
    Read original (opens in a new tab)
  11. NVD

    CVE-2026-4418 — IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated attacker could inject ma…

    Medium · CVSS 3.1 5.4 · Assessor: [email protected]

    IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.

    CVE-2026-4418
    Read original (opens in a new tab)
  12. NVD

    CVE-2026-4413 — IBM Concert 1.0 through 3.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker t…

    Medium · CVSS 3.1 6.1 · Assessor: [email protected]

    IBM Concert 1.0 through 3.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

    CVE-2026-4413
    Read original (opens in a new tab)
  16. NVD

    CVE-2026-3295 — IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. The web app user‑supplied input is not prop…

    High · CVSS 3.1 7.4 · Assessor: [email protected]

    IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. The web app user‑supplied input is not properly sanitized or HTML‑encoded before being stored and rendered. An authenticated attacker could exploit this vulnerability by entering specially crafted payloads containing malicious JavaScript which are saved within the app and later executed automatically when user views affected pages, resulting in Stored Cross‑Site Scripting (Stored XSS).

    CVE-2026-3295
    Read original (opens in a new tab)
  20. NVD

    CVE-2026-11319 — TickTick Android application (com.ticktick.task) 8.2.2.0 contains a path traversal vulnerability in its exported ShareReceiv…

    Medium · CVSS 4.0 6.9 · Assessor: [email protected]

    TickTick Android application (com.ticktick.task) 8.2.2.0 contains a path traversal vulnerability in its exported ShareReceiveActivity that allows a malicious local application to write files outside the intended attachment directory by supplying a crafted content:// URI with a traversal filename via ACTION_SEND intents. A malicious application can register a ContentProvider returning a _display_name value containing traversal sequences, which is passed unsanitized through FileManager.getDisplayNameFromUri and Atta…

    CVE-2026-11319
    Read original (opens in a new tab)
  21. NVD

    CVE-2026-112377 — CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connection,…

    Critical · CVSS 4.0 9.1 · Assessor: [email protected]

    CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connection, allowing attackers to relay valid Evidence from a genuine attester. Attackers holding an extracted attested TLS private key can forward the relying party's nonce to a genuine attester and replay its Evidence to impersonate the attested workload and intercept data.

    CVE-2026-112377
    Read original (opens in a new tab)
  22. NVD

    CVE-2026-112248 — A security vulnerability has been detected in grandnode grandnode2 up to 2.3.0. This impacts the function ProductImportDataO…

    Medium · CVSS 4.0 5.1 · Assessor: [email protected]

    A security vulnerability has been detected in grandnode grandnode2 up to 2.3.0. This impacts the function ProductImportDataObject.PrepareProductPictures of the component Excel Import. The manipulation of the argument Picture1/Picture2/Picture3 leads to path traversal. The attack can be initiated remotely. Upgrading to version 2.4.0 will fix this issue. The identifier of the patch is 2abbaed232080ad74949c6f35581f0351e309972. It is suggested to upgrade the affected component. The vendor was contacted early about thi…

    CVE-2026-112248
    Read original (opens in a new tab)
  23. NVD

    CVE-2026-112247 — A weakness has been identified in Wuxi Wubang Security Software Five-in-One Safety Production Management Information System…

    Medium · CVSS 4.0 5.3 · Assessor: [email protected]

    A weakness has been identified in Wuxi Wubang Security Software Five-in-One Safety Production Management Information System up to 3.5. This affects an unknown function of the file /FCKeditor/editor/filemanager/connectors/aspx/upload.aspx of the component Upload Endpoint. Executing a manipulation of the argument NewFile can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about…

    CVE-2026-112247
    Read original (opens in a new tab)
  24. NVD

    CVE-2026-111759 — markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2, when typographer: true is enabled, specially crafted Markdown…

    High · CVSS 3.1 7.5 · Assessor: [email protected]

    markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2, when typographer: true is enabled, specially crafted Markdown can cause quadratic processing time in the smartquotes rule, potentially leading to denial of service in applications processing untrusted input. Many opening double quotes followed by unmatched closing single quotes cause repeated scans of the entire opener stack. The same issue occurs with the quote types reversed. The default configuration (typographer: false) is not affected, but this opt…

    CVE-2026-111759
    Read original (opens in a new tab)
  25. NVD

    CVE-2026-111757 — Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic…

    Medium · CVSS 3.1 5.3 · Assessor: [email protected]

    Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing middleware and bypass protection for a static prefix. The root cause is serveStatic decodes a routed request path a second time before filesystem lookup. The attack mechanism is malformed percent encoding survives the first routing interpretation and becomes a protected path only during the later static-file dec…

    CVE-2026-111757
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.