THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
Every cached source, newest first. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
15,786 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates · Some delayed
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUpdates delayed · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-112146 — A vulnerability was detected in D-Link E15, M32, R15 and R32. This issue affects some unknown processing of the file /etc/em…
Low · CVSS 4.0 2.1 · Assessor: [email protected]
A vulnerability was detected in D-Link E15, M32, R15 and R32. This issue affects some unknown processing of the file /etc/emDaemon/passwd of the component MQTT Broker. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. The exploit is now public and may be used.
CVE-2026-112146Read original ↗ (opens in a new tab) - NVD
CVE-2026-112145 — A security vulnerability has been detected in speaches-ai speaches up to 0.9.0-rc.3. This vulnerability affects the function…
Medium · CVSS 4.0 5.5 · Assessor: [email protected]
A security vulnerability has been detected in speaches-ai speaches up to 0.9.0-rc.3. This vulnerability affects the function PyannoteDiarizationModelManager._load_fn of the file src/speaches/executors/pyannote_diarization.py of the component Pyannote Diarization Model Loading. The manipulation of the argument model leads to use of externally-controlled input to select classes or code. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The feature was introduced…
CVE-2026-112145Read original ↗ (opens in a new tab) - NVD
CVE-2026-112144 — A weakness has been identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. This…
Medium · CVSS 4.0 5.5 · Assessor: [email protected]
A weakness has been identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. This affects an unknown part of the file project.sql. Executing a manipulation can lead to files or directories accessible. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed…
CVE-2026-112144Read original ↗ (opens in a new tab) - NVD
CVE-2026-112143 — A security flaw has been discovered in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a.…
Medium · CVSS 4.0 5.5 · Assessor: [email protected]
A security flaw has been discovered in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected by this issue is some unknown functionality. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specif…
CVE-2026-112143Read original ↗ (opens in a new tab) - NVD
CVE-2026-111939 — Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to creat…
Medium · CVSS 4.0 5.1 · Assessor: [email protected]
Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raised_by value. Attackers can call the hd_ticket.api.new endpoint with a victim's email to plant phishing tickets in their portal and read their replies via get_ticket_activities.
CVE-2026-111939Read original ↗ (opens in a new tab) - NVD
CVE-2026-111938 — Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify othe…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by supplying arbitrary call_sid values. Attackers can call the add_note_to_call_log and add_task_to_call_log endpoints to attach attacker-written notes and tasks that appear on victims' call logs, leads, and deals.
CVE-2026-111938Read original ↗ (opens in a new tab) - NVD
CVE-2026-111937 — Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access othe…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users' CRM Notification records due to absent permission hooks. Attackers can query frappe.client endpoints filtering on to_user or call mark_as_read with another user argument to read, mark read, or delete others' notifications.
CVE-2026-111937Read original ↗ (opens in a new tab) - NVD
CVE-2026-111936 — Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validate_remote_url() in secur…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validate_remote_url() in security.rs never checks resolved IP addresses for extension download commands. A malicious extension or catalog entry can use hostnames resolving to loopback, private, or cloud metadata addresses to read internal responses via files written to the extension directory.
CVE-2026-111936Read original ↗ (opens in a new tab) - NVD
CVE-2026-111935 — NoteGen through 0.38.3 contains an external control of file path vulnerability in chat image analysis that allows attackers…
Low · CVSS 4.0 2.1 · Assessor: [email protected]
NoteGen through 0.38.3 contains an external control of file path vulnerability in chat image analysis that allows attackers to read local image files via unvalidated synced sourceUrl paths. Attackers with write access to the victim's sync target can plant absolute paths or file:// URLs, causing image_inspect to send local images to the AI provider.
CVE-2026-111935Read original ↗ (opens in a new tab) - NVD
CVE-2026-111925 — Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outsid…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/media_dirs because FileLibraryProvider.lookup() lacks a containment check. Attackers can call core.library.lookup or core.tracklist.add over JSON-RPC or WebSocket with file:// URIs to probe file existence, read tag metadata, and play out-of-sandbox files.
CVE-2026-111925Read original ↗ (opens in a new tab) - NVD
CVE-2026-111915 — Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitra…
High · CVSS 4.0 8.2 · Assessor: [email protected]
Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files via the path or doc parameter of /api/help. Attackers can supply repeated '../' segments, which bypass the single-replacement sanitization in the publicly allowlisted endpoint, to read SSH keys, configuration, or notes.
CVE-2026-111915Read original ↗ (opens in a new tab) - NVD
CVE-2026-111899 — KitchenOwl through 0.7.10 contains a server-side request forgery vulnerability in recipe import that allows authenticated ho…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
KitchenOwl through 0.7.10 contains a server-side request forgery vulnerability in recipe import that allows authenticated household members to bypass IP filtering via a second unfiltered fetch. Attackers can host a page titled KitchenOwl at a URL matching /recipe/. The follow-up requests.get() call can then be redirected or DNS-rebound to loopback, private-network, or cloud-metadata addresses, exposing internal services.
CVE-2026-111899Read original ↗ (opens in a new tab) - NVD
CVE-2026-111883 — Locust through 2.46.7 contains a cross-site request forgery vulnerability that allows remote attackers to stop load tests or…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Locust through 2.46.7 contains a cross-site request forgery vulnerability that allows remote attackers to stop load tests or reset statistics via GET requests to /stop and /stats/reset. Attackers can lure an operator to a malicious page triggering cross-site GET requests, terminating running swarms and wiping recorded performance results.
CVE-2026-111883Read original ↗ (opens in a new tab) - NVD
CVE-2026-111829 — Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP…
Medium · CVSS 3.1 6.5 · Assessor: [email protected]
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Mailster WP Mailster wp-mailster allows PHP Local File Inclusion.This issue affects WP Mailster: from n/a through 1.9.1.0.
CVE-2026-111829Read original ↗ (opens in a new tab) - NVD
CVE-2026-111828 — Improper Validation of Specified Quantity in Input vulnerability in Mamunur Rashid Classified Listing classified-listing all…
Medium · CVSS 3.1 4.3 · Assessor: [email protected]
Improper Validation of Specified Quantity in Input vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Classified Listing: from n/a through 6.1.5.
CVE-2026-111828Read original ↗ (opens in a new tab) - NVD
CVE-2026-110902 — Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows…
Medium · CVSS 3.1 4.3 · Assessor: [email protected]
Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.1.
CVE-2026-110902Read original ↗ (opens in a new tab) - NVD
CVE-2026-110008 — @fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier co…
Medium · CVSS 3.1 4.2 · Assessor: ce714d77-add3-4f53-aff5-83d477b104bb
@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at the OAuth callback writes them with a root path, so the original cookies survive the callback and the documented single-use guarantee for the state value does not hold. A state value an attacker learns stays valid for the rest of the browser session, letting the attacker drive th…
CVE-2026-110008Read original ↗ (opens in a new tab) - NVD
CVE-2026-38671 — Cross Site Scripting vulnerability in Ellucian Banner Student Registration Self-Service (StudentRegistrationSsb) 9.23 and pr…
Medium · CVSS 3.1 6.1 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Cross Site Scripting vulnerability in Ellucian Banner Student Registration Self-Service (StudentRegistrationSsb) 9.23 and prior (no fixed version available) allows a remote attacker to execute arbitrary code via the mepCode parameter of the /ssb/registration endpoint
CVE-2026-38671Read original ↗ (opens in a new tab) - NVD
CVE-2026-112214 — A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlle…
Medium · CVSS 3.1 6.5 · Assessor: [email protected]
A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object. Processing a crafted ASF, WMV, or WMA file can cause a very large memory allocation request and lead to denial of service if the allocation fails or the process is memory-constrained.
CVE-2026-112214Read original ↗ (opens in a new tab) - NVD
CVE-2026-112199 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce…
Medium · CVSS 3.1 6.5 · Assessor: [email protected]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Wishlist yith-woocommerce-wishlist allows Stored XSS.This issue affects YITH WooCommerce Wishlist: from n/a through 4.18.1.
CVE-2026-112199Read original ↗ (opens in a new tab) - NVD
CVE-2026-112142 — A vulnerability was identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affec…
Medium · CVSS 4.0 5.5 · Assessor: [email protected]
A vulnerability was identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected by this vulnerability is an unknown functionality of the file dodelete.php of the component Registration-Delete Handler. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated…
CVE-2026-112142Read original ↗ (opens in a new tab) - NVD
CVE-2026-112141 — A vulnerability was determined in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affec…
Medium · CVSS 4.0 5.5 · Assessor: [email protected]
A vulnerability was determined in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected is the function mysqli_query of the file doedit.php of the component Registration-Edit Handler. This manipulation of the argument id/name/title/year/gender/fromdate/todate/people causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. This product follows a rolling release approach for continuous delivery, so versio…
CVE-2026-112141Read original ↗ (opens in a new tab) - NVD
CVE-2026-111845 — Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploit…
Medium · CVSS 3.1 5.3 · Assessor: [email protected]
Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: from n/a through 2.29.0.
CVE-2026-111845Read original ↗ (opens in a new tab) - NVD
CVE-2026-111839 — Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows…
Medium · CVSS 3.1 5.3 · Assessor: [email protected]
Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.7.
CVE-2026-111839Read original ↗ (opens in a new tab) - NVD
CVE-2026-111836 — Missing Authorization vulnerability in WP ManageNinja LLC FluentCommunity fluent-community allows Exploiting Incorrectly Con…
Medium · CVSS 3.1 4.3 · Assessor: [email protected]
Missing Authorization vulnerability in WP ManageNinja LLC FluentCommunity fluent-community allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentCommunity: from n/a through 2.11.0.
CVE-2026-111836Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.