PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

Every cached source, newest first. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

16,240 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates · Some delayed

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  1. NVD

    CVE-2026-112103 — A vulnerability has been found in f3-factory fatfree-core up to 3.9.2. This vulnerability affects the function _curl of the…

    Medium · CVSS 4.0 6.3 · Assessor: [email protected]

    A vulnerability has been found in f3-factory fatfree-core up to 3.9.2. This vulnerability affects the function _curl of the file web.php of the component HTTP Client. Such manipulation leads to improper certificate validation. The attack may be performed from remote. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. Upgrading to version 3.9.3 is able to resolve this issue. The name of the patch is a2c755c8dc9ad0eb7d5fd261b09aff90f649433c. You should upgrade the affected…

    CVE-2026-112103
    Read original (opens in a new tab)
  2. NVD

    CVE-2026-90910 — Missing authentication for critical function vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2…

    Critical · CVSS 3.1 9.8 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Missing authentication for critical function vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own reactions. Users are recommended to upgrade to version 2.0.3, which fixes the issue.

    CVE-2026-90910
    Read original (opens in a new tab)
  3. NVD

    CVE-2026-86589 — Incorrect implementation of authentication algorithm vulnerability in Apache Answer. This issue affects Apache Answer: throu…

    CVSS unscored / not supplied

    Incorrect implementation of authentication algorithm vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A flaw in the User Center login integration can cause a newly created external user session to omit its external identity, allowing subsequent requests to bypass central account suspension or deletion checks until the session expires or is revoked. Users are recommended to upgrade to version 2.0.3, which fixes the issue.

    CVE-2026-86589
    Read original (opens in a new tab)
  4. NVD

    CVE-2026-79633 — vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Missing authorization checks allowed authen…

    CVSS unscored / not supplied

    vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Missing authorization checks allowed authenticated users to perform actions on non-public content they were not permitted to access. Users are recommended to upgrade to version 2.0.3, which fixes the issue.

    CVE-2026-79633
    Read original (opens in a new tab)
  5. NVD

    CVE-2026-79624 — Insufficient session expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Insufficien…

    CVSS unscored / not supplied

    Insufficient session expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Insufficient session invalidation allowed revoked users to continue accessing known private uploaded files with a stale visit token. Users are recommended to upgrade to version 2.0.3, which fixes the issue.

    CVE-2026-79624
    Read original (opens in a new tab)
  6. NVD

    CVE-2026-79620 — Exposure of sensitive information through data queries vulnerability in Apache Answer. This issue affects Apache Answer: thr…

    CVSS unscored / not supplied

    Exposure of sensitive information through data queries vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An improper authorization check in the similar-question search allowed authenticated users to view metadata of non-public questions. Users are recommended to upgrade to version 2.0.3, which fixes the issue.

    CVE-2026-79620
    Read original (opens in a new tab)
  7. NVD

    CVE-2026-79613 — vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Unauthenticated attackers could access comm…

    CVSS unscored / not supplied

    vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Unauthenticated attackers could access comments associated with non-public content through public user profiles. Users are recommended to upgrade to version 2.0.3, which fixes the issue.

    CVE-2026-79613
    Read original (opens in a new tab)
  8. NVD

    CVE-2026-76994 — Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer:…

    CVSS unscored / not supplied

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Unauthenticated attackers could obtain metadata associated with hidden questions through public answer profiles. Users are recommended to upgrade to version 2.0.3, which fixes the issue.

    CVE-2026-76994
    Read original (opens in a new tab)
  9. NVD

    CVE-2026-71563 — Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An authorization flaw…

    Medium · CVSS 3.1 4.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An authorization flaw in the MCP answer retrieval tool allows holders of a global API key to access answer content associated with hidden, deleted, or pending-review questions. Users are recommended to upgrade to version 2.0.3, which fixes the issue.

    CVE-2026-71563
    Read original (opens in a new tab)
  10. NVD

    CVE-2026-68482 — Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An unauthenticated or…

    CVSS unscored / not supplied

    Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An unauthenticated or unauthorized user can retrieve the invited-user list associated with a non-public question due to missing visibility authorization checks. Users are recommended to upgrade to version 2.0.3, which fixes the issue.

    CVE-2026-68482
    Read original (opens in a new tab)
  11. NVD

    CVE-2026-67249 — A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A verification code issued for one email-…

    Medium · CVSS 3.1 5.4 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A verification code issued for one email-based workflow could be accepted by another sensitive workflow because the code purpose was not properly enforced. Users are recommended to upgrade to version 2.0.3, which fixes the issue.

    CVE-2026-67249
    Read original (opens in a new tab)
  12. NVD

    CVE-2026-64945 — A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The question operation controller gates h…

    CVSS unscored / not supplied

    A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The question operation controller gates hide/show operations on the wrong permission check result (the unpin permission instead of the hide permission), so in custom role configurations that separate these permissions, a user granted only question.unpin can hide or restore questions without holding question.hide or question.show. Users are recommended to upgrade to version 2.0.3, which fixes the issue.

    CVE-2026-64945
    Read original (opens in a new tab)
  13. NVD

    CVE-2026-64944 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer. This is…

    CVSS unscored / not supplied

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The importer stores imported question bodies as raw HTML without passing them through the normal Markdown-to-HTML sanitization path, so attacker-controlled HTML embedded in an imported data source is persisted and rendered to all viewers (including privileged users) as stored XSS. Users are recommended to upgrade to version 2.0.3, which fixes the issu…

    CVE-2026-64944
    Read original (opens in a new tab)
  14. NVD

    CVE-2026-64943 — Insertion of Sensitive Information into Log File vulnerability in Apache Answer. This issue affects Apache Answer: through 2…

    High · CVSS 3.1 8.1 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Insertion of Sensitive Information into Log File vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Full API keys are written to application logs on every authenticated request, allowing anyone with log-read access to recover and replay active bearer credentials. Users are recommended to upgrade to version 2.0.3, which fixes the issue.

    CVE-2026-64943
    Read original (opens in a new tab)
  15. NVD

    CVE-2026-112192 — MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings f…

    Medium · CVSS 4.0 5.3 · Assessor: 5a6e4751-2f3f-4070-9419-94fb35b644e8

    MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the redacted and cli_only flags that a module declares in its own configuration metadata. As a result: - A module that marks a setting (such as an API key) as redacted still has its value returned in full by the servers/getSetting and servers/serverSettingsEdit endpoints, exposing sensitive credentials to any authenticated user who can read server settings. - A mo…

    CVE-2026-112192
    Read original (opens in a new tab)
  16. NVD

    CVE-2026-112188 — MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitiv…

    High · CVSS 4.0 7.1 · Assessor: 5a6e4751-2f3f-4070-9419-94fb35b644e8

    MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted. The settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name (such as Security, MISP, or Plugin) is supplied instead of a specific leaf setting, the function returns the entire sub-tree. Because a branch node does not carry a redaction flag, the redaction check in the settings retrieval…

    CVE-2026-112188
    Read original (opens in a new tab)
  17. NVD

    CVE-2026-112184 — MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returne…

    Medium · CVSS 4.0 4.8 · Assessor: 5a6e4751-2f3f-4070-9419-94fb35b644e8

    MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who can influence the parameter names reported by the misp-modules service can inject arbitrary HTML or JavaScript that executes in the context of an authenticated MISP user's browser. Preconditions: - The attacker must be able to control or influence parameter n…

    CVE-2026-112184
    Read original (opens in a new tab)
  18. NVD

    CVE-2026-112183 — MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked…

    Medium · CVSS 4.0 4.8 · Assessor: 5a6e4751-2f3f-4070-9419-94fb35b644e8

    MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attribute without sufficient validation. Although HTML entity encoding is applied, the value is interpreted as CSS within the style attribute, allowing a malicious or compromised linked server to inject arbitrary CSS declarations. An attacker with the ability to create or modify tags on…

    CVE-2026-112183
    Read original (opens in a new tab)
  19. NVD

    CVE-2026-112102 — A vulnerability was detected in AXA Group NLP.js 4.27.0. This impacts the function Evaluator.walkFunction of the file packag…

    Low · CVSS 4.0 2.1 · Assessor: [email protected]

    A vulnerability was detected in AXA Group NLP.js 4.27.0. This impacts the function Evaluator.walkFunction of the file packages/evaluator/src/evaluator.js of the component Condition Expression Pipeline. The manipulation of the argument condition results in code injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

    CVE-2026-112102
    Read original (opens in a new tab)
  20. NVD

    CVE-2026-112101 — A vulnerability was determined in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. The affected element is an unknown fun…

    Low · CVSS 4.0 2.1 · Assessor: [email protected]

    A vulnerability was determined in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. The affected element is an unknown function of the file /BlackBeltTechnology/pi-agent-dashboard of the component WebSocket Gateway. Executing a manipulation of the argument cwd can lead to origin validation error. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.9.0 is sufficient to fix this issue. This patch is called 48fd0bad5adfe76af9736599699d51a5f60019f6…

    CVE-2026-112101
    Read original (opens in a new tab)
  21. NVD

    CVE-2026-112100 — A vulnerability was determined in DeepPavlov up to 1.7.0. This affects the function MultiTaskPipelinePreprocessor.__init__ o…

    Low · CVSS 4.0 2.0 · Assessor: [email protected]

    A vulnerability was determined in DeepPavlov up to 1.7.0. This affects the function MultiTaskPipelinePreprocessor.__init__ of the file deeppavlov/models/preprocessors/multitask_preprocessor.py. This manipulation of the argument preprocessor causes code injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

    CVE-2026-112100
    Read original (opens in a new tab)
  24. NVD

    CVE-2026-111406 — Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive…

    Critical · CVSS 3.1 9.9 · Assessor: [email protected]

    Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.16.1.

    CVE-2026-111406
    Read original (opens in a new tab)
  25. NVD

    CVE-2026-111398 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PT Norther Lights Production…

    High · CVSS 3.1 7.7 · Assessor: [email protected]

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Path Traversal.This issue affects MapSVG: from n/a through 8.16.1.

    CVE-2026-111398
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.