THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
Every cached source, newest first. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
14,773 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates · Some delayed
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUpdates delayed · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-112274 — libtins through 4.6 contains an out-of-bounds read vulnerability in DNS::soa_record::init that allows remote attackers to re…
Medium · CVSS 4.0 6.3 · Assessor: [email protected]
libtins through 4.6 contains an out-of-bounds read vulnerability in DNS::soa_record::init that allows remote attackers to read past buffer bounds by supplying SOA data lacking NUL terminators. Attackers can feed raw SOA RDATA without a zero byte to applications using the buffer constructor, causing strlen to overrun the heap buffer and possibly crash.
CVE-2026-112274Read original ↗ (opens in a new tab) - NVD
CVE-2026-112273 — libtins through 4.6 contains a heap out-of-bounds read vulnerability in DNS::compose_name in src/dns.cpp that allows remote…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
libtins through 4.6 contains a heap out-of-bounds read vulnerability in DNS::compose_name in src/dns.cpp that allows remote attackers to read past the packet buffer by sending a label ending exactly at the packet end. Attackers can deliver crafted DNS packets whose additional, answer, or authority records trigger a one-byte read when parsed, crashing applications on hardened allocators.
CVE-2026-112273Read original ↗ (opens in a new tab) - NVD
CVE-2026-112272 — Libdisplay-info 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v2 section parser in displayid2.c th…
Medium · CVSS 4.0 6.8 · Assessor: [email protected]
Libdisplay-info 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v2 section parser in displayid2.c that allows attackers to read past the EDID buffer via oversized data block lengths. Attackers can supply a crafted EDID from a malicious monitor, KVM, capture device, or file to over-advance the parse cursor and crash applications.
CVE-2026-112272Read original ↗ (opens in a new tab) - NVD
CVE-2026-112271 — libdisplay-info through 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v1 section parser in display…
Medium · CVSS 4.0 6.8 · Assessor: [email protected]
libdisplay-info through 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v1 section parser in displayid.c that occurs when a data block's declared length exceeds the section. Attackers can supply a crafted EDID from a malicious monitor, KVM, capture device, or EDID file to make is_all_zeroes read past the buffer, causing a possible crash.
CVE-2026-112271Read original ↗ (opens in a new tab) - NVD
CVE-2026-112270 — SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in h…
High · CVSS 4.0 7.1 · Assessor: [email protected]
SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handle_staging_rsp() that lets unauthenticated network-adjacent attackers exhaust Prefill memory. Attackers can obtain the rank address from the /route endpoint and send STAGING_RSP messages with huge chunk_idx values under fresh room IDs, causing the scheduler to be OOM-killed.
CVE-2026-112270Read original ↗ (opens in a new tab) - NVD
CVE-2026-112269 — SGLang through 0.5.22 with the Mooncake disaggregation backend accepts unauthenticated decode registration messages on the P…
High · CVSS 4.0 7.1 · Assessor: [email protected]
SGLang through 0.5.22 with the Mooncake disaggregation backend accepts unauthenticated decode registration messages on the Prefill rank ZMQ PULL socket, allowing denial of service. Network-adjacent attackers can send many registrations with unique mooncake_session_id values and large nested-buffer frames to exhaust Prefill memory until the scheduler is OOM-killed.
CVE-2026-112269Read original ↗ (opens in a new tab) - NVD
CVE-2026-112268 — sglang-router (sgl-model-gateway) through 0.3.2 contains an authorization bypass vulnerability that allows holders of the da…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
sglang-router (sgl-model-gateway) through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA management routes because /ha/* endpoints skip control-plane Admin role checks. Attackers can read cluster topology, write gossiped configuration, change global rate limits, and call POST /ha/shutdown to silently dissolve HA coordination.
CVE-2026-112268Read original ↗ (opens in a new tab) - NVD
CVE-2026-112267 — SGLang through 0.5.22 in prefill/decode disaggregation mode contains a server-side request forgery vulnerability that allows…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
SGLang through 0.5.22 in prefill/decode disaggregation mode contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests via client-supplied bootstrap_host and bootstrap_port fields. Attackers sending crafted requests to the Decode worker's /generate endpoint can probe internal hosts and ports and block the shared scheduler loop, delaying other inference requests.
CVE-2026-112267Read original ↗ (opens in a new tab) - NVD
CVE-2026-112266 — SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight gen…
High · CVSS 4.0 8.2 · Assessor: [email protected]
SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. Attackers can submit streaming /generate requests with single hex character rids and disconnect, triggering prefix-matching abort logic that terminates all other clients' requests.
CVE-2026-112266Read original ↗ (opens in a new tab) - NVD
CVE-2026-112265 — LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to i…
High · CVSS 4.0 8.3 · Assessor: [email protected]
LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to inject forged Lark/Feishu events by skipping signature checks. Attackers knowing a bot UUID can POST fabricated im.message.receive_v1 or card.action.trigger events to drive the LLM pipeline, tools, and approvals as other users.
CVE-2026-112265Read original ↗ (opens in a new tab) - NVD
CVE-2026-112264 — BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary buil…
High · CVSS 4.0 8.5 · Assessor: [email protected]
BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. Attackers can supply a crafted bentofile.yaml or imported bento archive so that bentoml containerize executes injected RUN instructions during docker build, accessing build secrets and poisoning images.
CVE-2026-112264Read original ↗ (opens in a new tab) - NVD
CVE-2026-112263 — Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell comm…
High · CVSS 4.0 8.5 · Assessor: [email protected]
Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in format_command. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the default edit action executes commands with victim privileges.
CVE-2026-112263Read original ↗ (opens in a new tab) - NVD
CVE-2026-112262 — RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQL users to read and writ…
High · CVSS 4.0 7.1 · Assessor: [email protected]
RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQL users to read and write arbitrary server files by creating posix_fs sources and fs sinks. Attackers holding schema CREATE privilege can set posix_fs.root or fs.path to any directory to read credentials and keys or write files as root.
CVE-2026-112262Read original ↗ (opens in a new tab) - NVD
CVE-2026-112222 — Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Secur…
Medium · CVSS 3.1 5.4 · Assessor: [email protected]
Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfer: from n/a through 1.8.0.744.
CVE-2026-112222Read original ↗ (opens in a new tab) - NVD
CVE-2026-112146 — A vulnerability was detected in D-Link E15, M32, R15 and R32. This issue affects some unknown processing of the file /etc/em…
Low · CVSS 4.0 2.1 · Assessor: [email protected]
A vulnerability was detected in D-Link E15, M32, R15 and R32. This issue affects some unknown processing of the file /etc/emDaemon/passwd of the component MQTT Broker. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. The exploit is now public and may be used.
CVE-2026-112146Read original ↗ (opens in a new tab) - NVD
CVE-2026-112145 — A security vulnerability has been detected in speaches-ai speaches up to 0.9.0-rc.3. This vulnerability affects the function…
Medium · CVSS 4.0 5.5 · Assessor: [email protected]
A security vulnerability has been detected in speaches-ai speaches up to 0.9.0-rc.3. This vulnerability affects the function PyannoteDiarizationModelManager._load_fn of the file src/speaches/executors/pyannote_diarization.py of the component Pyannote Diarization Model Loading. The manipulation of the argument model leads to use of externally-controlled input to select classes or code. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The feature was introduced…
CVE-2026-112145Read original ↗ (opens in a new tab) - NVD
CVE-2026-112144 — A weakness has been identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. This…
Medium · CVSS 4.0 5.5 · Assessor: [email protected]
A weakness has been identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. This affects an unknown part of the file project.sql. Executing a manipulation can lead to files or directories accessible. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed…
CVE-2026-112144Read original ↗ (opens in a new tab) - NVD
CVE-2026-112143 — A security flaw has been discovered in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a.…
Medium · CVSS 4.0 5.5 · Assessor: [email protected]
A security flaw has been discovered in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected by this issue is some unknown functionality. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specif…
CVE-2026-112143Read original ↗ (opens in a new tab) - NVD
CVE-2026-111939 — Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to creat…
Medium · CVSS 4.0 5.1 · Assessor: [email protected]
Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raised_by value. Attackers can call the hd_ticket.api.new endpoint with a victim's email to plant phishing tickets in their portal and read their replies via get_ticket_activities.
CVE-2026-111939Read original ↗ (opens in a new tab) - NVD
CVE-2026-111938 — Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify othe…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by supplying arbitrary call_sid values. Attackers can call the add_note_to_call_log and add_task_to_call_log endpoints to attach attacker-written notes and tasks that appear on victims' call logs, leads, and deals.
CVE-2026-111938Read original ↗ (opens in a new tab) - NVD
CVE-2026-111937 — Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access othe…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users' CRM Notification records due to absent permission hooks. Attackers can query frappe.client endpoints filtering on to_user or call mark_as_read with another user argument to read, mark read, or delete others' notifications.
CVE-2026-111937Read original ↗ (opens in a new tab) - NVD
CVE-2026-111936 — Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validate_remote_url() in secur…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validate_remote_url() in security.rs never checks resolved IP addresses for extension download commands. A malicious extension or catalog entry can use hostnames resolving to loopback, private, or cloud metadata addresses to read internal responses via files written to the extension directory.
CVE-2026-111936Read original ↗ (opens in a new tab) - NVD
CVE-2026-111935 — NoteGen through 0.38.3 contains an external control of file path vulnerability in chat image analysis that allows attackers…
Low · CVSS 4.0 2.1 · Assessor: [email protected]
NoteGen through 0.38.3 contains an external control of file path vulnerability in chat image analysis that allows attackers to read local image files via unvalidated synced sourceUrl paths. Attackers with write access to the victim's sync target can plant absolute paths or file:// URLs, causing image_inspect to send local images to the AI provider.
CVE-2026-111935Read original ↗ (opens in a new tab) - NVD
CVE-2026-111925 — Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outsid…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/media_dirs because FileLibraryProvider.lookup() lacks a containment check. Attackers can call core.library.lookup or core.tracklist.add over JSON-RPC or WebSocket with file:// URIs to probe file existence, read tag metadata, and play out-of-sandbox files.
CVE-2026-111925Read original ↗ (opens in a new tab) - NVD
CVE-2026-111915 — Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitra…
High · CVSS 4.0 8.2 · Assessor: [email protected]
Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files via the path or doc parameter of /api/help. Attackers can supply repeated '../' segments, which bypass the single-replacement sanitization in the publicly allowlisted endpoint, to read SSH keys, configuration, or notes.
CVE-2026-111915Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.