THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
Every cached source, newest first. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
15,844 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates · Some delayed
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUpdates delayed · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-107567 — Use of a less trusted source in the DKIM signing of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauth…
High · CVSS 3.1 7.5 · Assessor: [email protected]
Use of a less trusted source in the DKIM signing of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write signed with the DKIM key of a domain the server hosts, so that it passes DKIM and DMARC for that domain at other receivers. With DKIM signing enabled for a hosted domain, the server signed every message on its first delivery pass as the domain named in its From header, before local delivery, whatever the message's origin and without checking that its…
CVE-2026-107567Read original ↗ (opens in a new tab) - NVD
CVE-2026-107566 — Missing authorization in the Sieve editheader action (6.2.22 through 6.3.6) and in the mail-rule Set header value action (6.…
Medium · CVSS 3.1 6.5 · Assessor: [email protected]
Missing authorization in the Sieve editheader action (6.2.22 through 6.3.6) and in the mail-rule Set header value action (6.0.0 through 6.3.6) of Progressive Robot hMailServer allows an authenticated user to make the server send mail as any address, DKIM-signed where the address is at a domain the server signs for. A Sieve script's editheader (addheader/deleteheader) could add or delete any header field except Received and Return-Path, and the server applies a script's header edits before it queues a redirect, so…
CVE-2026-107566Read original ↗ (opens in a new tab) - NVD
CVE-2026-107081 — SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_…
Critical · CVSS 3.1 9.8 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php, admin/AJAX_vocabolary_control.php) in SENAYAN Library Management System (SLiMS) Bulian 9.8.0 allows any authenticated staff user to extract arbitrary database contents.
CVE-2026-107081Read original ↗ (opens in a new tab) - NVD
CVE-2026-86375 — Dell Application Installer, versions prior to 26.09.0.1, contain a Missing Encryption of Sensitive Data vulnerability. An un…
Medium · CVSS 3.1 6.2 · Assessor: [email protected]
Dell Application Installer, versions prior to 26.09.0.1, contain a Missing Encryption of Sensitive Data vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.
CVE-2026-86375Read original ↗ (opens in a new tab) - NVD
CVE-2026-112329 — The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy save_new_message…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy save_new_message handler hooked on the init action, which validates only a generic nonce without verifying course enrollment or restricting post_id to valid post types. Authenticated attackers, including unprivileged Subscribers, can supply an arbitrary post_id for any course, lesson, or quiz to create a private message addressed to that post's author, bypassing the enrollment checks enforced by the newer RES…
CVE-2026-112329Read original ↗ (opens in a new tab) - NVD
CVE-2026-112328 — The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the add_new_module_term AJAX…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the add_new_module_term AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted course_id, since the handler validates only a generic nonce and checks manage_options solely for slug prefixing rather than verifying course edit permissions. Attackers can reuse a nonce obtained from their own course metabox to call wp_set_object_terms against…
CVE-2026-112328Read original ↗ (opens in a new tab) - NVD
CVE-2026-112151 — A weakness has been identified in vraj404 Criminal Management System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affecte…
Medium · CVSS 4.0 5.5 · Assessor: [email protected]
A weakness has been identified in vraj404 Criminal Management System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this vulnerability is an unknown functionality of the file home.php of the component Submission Form. This manipulation of the argument id/name/offName/crime/dob/arrDate/crimeDate/sex/address/folder/more causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. This product adopts a rolling re…
CVE-2026-112151Read original ↗ (opens in a new tab) - NVD
CVE-2026-112150 — A security flaw has been discovered in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Af…
Medium · CVSS 4.0 5.5 · Assessor: [email protected]
A security flaw has been discovered in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected is an unknown function of the file search.php. The manipulation of the argument Search results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was info…
CVE-2026-112150Read original ↗ (opens in a new tab) - NVD
CVE-2026-112149 — A vulnerability was identified in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This im…
Medium · CVSS 4.0 5.5 · Assessor: [email protected]
A vulnerability was identified in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This impacts the function move_uploaded_file of the file home.php. The manipulation of the argument my_img leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was inform…
CVE-2026-112149Read original ↗ (opens in a new tab) - NVD
CVE-2026-112147 — A vulnerability was found in ai-genius-automations octoally up to 1.0.87. The impacted element is an unknown function of the…
Medium · CVSS 4.0 5.5 · Assessor: [email protected]
A vulnerability was found in ai-genius-automations octoally up to 1.0.87. The impacted element is an unknown function of the file server/src/index.ts. Performing a manipulation of the argument path results in information disclosure. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 1.0.88 is sufficient to resolve this issue. The patch is named 3898085c4e701be21377ebd9e91e10b941e47168. It is recommended to upgrade the affected component.
CVE-2026-112147Read original ↗ (opens in a new tab) - NVD
CVE-2026-8168 — Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause…
High · CVSS 4.0 7.1 · Assessor: a59d8014-47c4-4630-ab43-e1b13cbe58e3
Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements.
CVE-2026-8168Read original ↗ (opens in a new tab) - NVD
CVE-2026-112296 — FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain full control of site content, users and configuration.
CVE-2026-112296Read original ↗ (opens in a new tab) - NVD
CVE-2026-112295 — FlyCms through commit edfdf724 contains a mass assignment vulnerability that allows authenticated users to overwrite protect…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
FlyCms through commit edfdf724 contains a mass assignment vulnerability that allows authenticated users to overwrite protected account columns by submitting extra User bean fields to /ucenter/account_update. Attackers can change their review status, rename themselves, or duplicate another account's username, email or mobile to break that victim's login.
CVE-2026-112295Read original ↗ (opens in a new tab) - NVD
CVE-2026-112294 — FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter() that allows authent…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter() that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered user can send requests to /ucenter/action/{modelCode}/{id}/counter or /ucenter/action/compose to add arbitrary deltas to numeric fields like price, stock, or points.
CVE-2026-112294Read original ↗ (opens in a new tab) - NVD
CVE-2026-112293 — BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team m…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip the team_payments permission check. Authenticated MEMBER or ADMIN users can call create-portal-link, create-checkout-session, and products to open Stripe billing portals, view invoices, change payment methods, or alter subscriptions.
CVE-2026-112293Read original ↗ (opens in a new tab) - NVD
CVE-2026-112292 — CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections//records endpoints to steal server_token values and alert_configurations secrets, disable alerting, alter status pages, or delete monitoring data.
CVE-2026-112292Read original ↗ (opens in a new tab) - NVD
CVE-2026-112291 — Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 lacks authentication and admin checks on the TaskResource index en…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 lacks authentication and admin checks on the TaskResource index endpoint, allowing unauthenticated information disclosure. Remote attackers can send GET requests to /api/extension-manager-tasks to read task output revealing filesystem paths, installed extensions, versions, and PHP version.
CVE-2026-112291Read original ↗ (opens in a new tab) - NVD
CVE-2026-112290 — Intelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 contains a DOM-based cross-…
Low · CVSS 4.0 2.3 · Assessor: [email protected]
Intelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 contains a DOM-based cross-site scripting vulnerability in ic-tree-item that re-parses router-item slot text as HTML. When tree item truncation is enabled, attackers who influence a tree item label can have escaped markup decoded by truncateTreeItemLabel() and executed as JavaScript in visitors' browsers.
CVE-2026-112290Read original ↗ (opens in a new tab) - NVD
CVE-2026-112289 — Koalixcrm through 1.14.0 contains a stored cross-site scripting vulnerability that allows staff users to inject script by st…
Medium · CVSS 4.0 5.1 · Assessor: [email protected]
Koalixcrm through 1.14.0 contains a stored cross-site scripting vulnerability that allows staff users to inject script by storing malicious task titles rendered unescaped by Task.link_to_task(). Attackers can embed HTML or script that executes when administrators open the task changelist or change form, enabling actions like creating a superuser.
CVE-2026-112289Read original ↗ (opens in a new tab) - NVD
CVE-2026-112288 — Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permission…
Low · CVSS 4.0 2.1 · Assessor: [email protected]
Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permissions to reach internal addresses via DNS rebinding. Attackers can return a public address during WebhookService::isSafeEndpoint() validation and an internal address when Guzzle re-resolves, sending blind requests to internal services and cloud metadata endpoints.
CVE-2026-112288Read original ↗ (opens in a new tab) - NVD
CVE-2026-112287 — Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that all…
High · CVSS 4.0 7.1 · Assessor: [email protected]
Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that allows scope-restricted authenticated users to manipulate other users' emails by supplying their numeric IDs. Attackers can call update, destroy, mass-update or mass-destroy endpoints to edit, re-send via is_draft=0, trash or permanently delete emails and disclose their subject, body and linked lead and person data.
CVE-2026-112287Read original ↗ (opens in a new tab) - NVD
CVE-2026-112286 — Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope-restricted authenticate…
High · CVSS 4.0 7.1 · Assessor: [email protected]
Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope-restricted authenticated users to read other users' quotes by bypassing per-user data scope checks in QuoteController. Attackers can query the quotes search and lead-products endpoints to retrieve quote addresses, totals, contact details, and product pricing belonging to any user or lead.
CVE-2026-112286Read original ↗ (opens in a new tab) - NVD
CVE-2026-112285 — Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to by…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to bypass coupon usage limits because usage is counted only when orders become paid. Attackers can place multiple pay-later orders while a usage remains, or cancel paid orders to inflate max_usage, gaining unlimited discounts.
CVE-2026-112285Read original ↗ (opens in a new tab) - NVD
CVE-2026-112284 — libaribcaption 1.1.0 through 1.1.2 contains a global out-of-bounds read in DecoderImpl::HandleGLGR() that reads past the 78-…
Medium · CVSS 4.0 4.8 · Assessor: [email protected]
libaribcaption 1.1.0 through 1.1.2 contains a global out-of-bounds read in DecoderImpl::HandleGLGR() that reads past the 78-entry kLatinSpecialTable without an upper bound check. Attackers can supply crafted captions designating the Latin special set with ESC 28 4C followed by bytes 0x6F-0x7E to leak adjacent read-only data or crash decoding.
CVE-2026-112284Read original ↗ (opens in a new tab) - NVD
CVE-2026-112283 — VideoLAN libbluray through 1.5.1 contains an uncontrolled memory allocation vulnerability in _parse_extent_start_points() in…
Medium · CVSS 4.0 6.8 · Assessor: [email protected]
VideoLAN libbluray through 1.5.1 contains an uncontrolled memory allocation vulnerability in _parse_extent_start_points() in clpi_parse.c that trusts the num_point field without bounds checking. Attackers can supply a crafted .clpi file on a disc, image, or directory with a huge num_point to exhaust memory and CPU, causing denial of service.
CVE-2026-112283Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.