THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
The complete recent NVD stream, including unscored entries. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
14,837 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates · Some delayed
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUpdates delayed · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-112289 — Koalixcrm through 1.14.0 contains a stored cross-site scripting vulnerability that allows staff users to inject script by st…
Medium · CVSS 4.0 5.1 · Assessor: [email protected]
Koalixcrm through 1.14.0 contains a stored cross-site scripting vulnerability that allows staff users to inject script by storing malicious task titles rendered unescaped by Task.link_to_task(). Attackers can embed HTML or script that executes when administrators open the task changelist or change form, enabling actions like creating a superuser.
CVE-2026-112289Read original ↗ (opens in a new tab) - NVD
CVE-2026-112288 — Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permission…
Low · CVSS 4.0 2.1 · Assessor: [email protected]
Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permissions to reach internal addresses via DNS rebinding. Attackers can return a public address during WebhookService::isSafeEndpoint() validation and an internal address when Guzzle re-resolves, sending blind requests to internal services and cloud metadata endpoints.
CVE-2026-112288Read original ↗ (opens in a new tab) - NVD
CVE-2026-112287 — Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that all…
High · CVSS 4.0 7.1 · Assessor: [email protected]
Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that allows scope-restricted authenticated users to manipulate other users' emails by supplying their numeric IDs. Attackers can call update, destroy, mass-update or mass-destroy endpoints to edit, re-send via is_draft=0, trash or permanently delete emails and disclose their subject, body and linked lead and person data.
CVE-2026-112287Read original ↗ (opens in a new tab) - NVD
CVE-2026-112286 — Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope-restricted authenticate…
High · CVSS 4.0 7.1 · Assessor: [email protected]
Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope-restricted authenticated users to read other users' quotes by bypassing per-user data scope checks in QuoteController. Attackers can query the quotes search and lead-products endpoints to retrieve quote addresses, totals, contact details, and product pricing belonging to any user or lead.
CVE-2026-112286Read original ↗ (opens in a new tab) - NVD
CVE-2026-112285 — Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to by…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to bypass coupon usage limits because usage is counted only when orders become paid. Attackers can place multiple pay-later orders while a usage remains, or cancel paid orders to inflate max_usage, gaining unlimited discounts.
CVE-2026-112285Read original ↗ (opens in a new tab) - NVD
CVE-2026-112284 — libaribcaption 1.1.0 through 1.1.2 contains a global out-of-bounds read in DecoderImpl::HandleGLGR() that reads past the 78-…
Medium · CVSS 4.0 4.8 · Assessor: [email protected]
libaribcaption 1.1.0 through 1.1.2 contains a global out-of-bounds read in DecoderImpl::HandleGLGR() that reads past the 78-entry kLatinSpecialTable without an upper bound check. Attackers can supply crafted captions designating the Latin special set with ESC 28 4C followed by bytes 0x6F-0x7E to leak adjacent read-only data or crash decoding.
CVE-2026-112284Read original ↗ (opens in a new tab) - NVD
CVE-2026-112283 — VideoLAN libbluray through 1.5.1 contains an uncontrolled memory allocation vulnerability in _parse_extent_start_points() in…
Medium · CVSS 4.0 6.8 · Assessor: [email protected]
VideoLAN libbluray through 1.5.1 contains an uncontrolled memory allocation vulnerability in _parse_extent_start_points() in clpi_parse.c that trusts the num_point field without bounds checking. Attackers can supply a crafted .clpi file on a disc, image, or directory with a huge num_point to exhaust memory and CPU, causing denial of service.
CVE-2026-112283Read original ↗ (opens in a new tab) - NVD
CVE-2026-112282 — VideoLAN libbluray through 1.5.1 contains an out-of-bounds read vulnerability in clpi_access_point() that allows attackers t…
Medium · CVSS 4.0 6.8 · Assessor: [email protected]
VideoLAN libbluray through 1.5.1 contains an out-of-bounds read vulnerability in clpi_access_point() that allows attackers to crash applications by supplying a ClipInfo file with an empty EP-map fine table. Attackers can place a crafted .clpi file in BDMV/CLIPINF with num_ep_fine set to zero and an unclamped ref_ep_fine_id, triggering reads during seeking for denial of service.
CVE-2026-112282Read original ↗ (opens in a new tab) - NVD
CVE-2026-112281 — libaribb24 (aribb24) through 1.0.3 contains a stack-based buffer overflow vulnerability in decoder_handle_csi() in src/decod…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
libaribb24 (aribb24) through 1.0.3 contains a stack-based buffer overflow vulnerability in decoder_handle_csi() in src/decoder.c that allows attackers to write past a fixed 256-entry array by supplying unbounded CSI parameter bytes. Attackers can embed a caption statement with a CSI introducer and over 256 parameter bytes in media files or broadcast streams to crash FFmpeg or VLC or corrupt the return address.
CVE-2026-112281Read original ↗ (opens in a new tab) - NVD
CVE-2026-112280 — libaribb24 (aribb24) through 1.0.3 contains a heap-based buffer overflow vulnerability in src/parser.c that allows attackers…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
libaribb24 (aribb24) through 1.0.3 contains a heap-based buffer overflow vulnerability in src/parser.c that allows attackers to corrupt heap memory via an oversized caption data unit. Attackers can supply a crafted caption PES packet in a media file or broadcast stream, processed through arib_parse_pes(), to crash FFmpeg or VLC and possibly corrupt further memory.
CVE-2026-112280Read original ↗ (opens in a new tab) - NVD
CVE-2026-112279 — rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_bmpcache2() in orders.c that allows malic…
High · CVSS 4.0 7.1 · Assessor: [email protected]
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_bmpcache2() in orders.c that allows malicious RDP servers to crash clients via crafted revision-2 bitmap cache orders. Attackers can send an uncompressed order with large width/height or an underflowing mode nibble and short payload, causing memcpy() reads past the receive buffer and denial of service.
CVE-2026-112279Read original ↗ (opens in a new tab) - NVD
CVE-2026-112278 — rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_raw_bmpcache() in orders.c that allows ma…
High · CVSS 4.0 7.1 · Assessor: [email protected]
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_raw_bmpcache() in orders.c that allows malicious RDP servers to crash clients. Attackers can send a raw bitmap cache order declaring large width, height, and bpp values with a tiny payload, causing memcpy() to read past the receive buffer and crash the client.
CVE-2026-112278Read original ↗ (opens in a new tab) - NVD
CVE-2026-112277 — rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_plane() in bitmap.c that allows malicious…
High · CVSS 4.0 7.1 · Assessor: [email protected]
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_plane() in bitmap.c that allows malicious RDP servers to crash clients by sending malformed 32 bpp compressed bitmaps. Attackers can declare a large bitmap geometry with a short compressed body in bitmap update PDUs or bitmap cache orders, causing unbounded reads past the receive buffer and denial of service.
CVE-2026-112277Read original ↗ (opens in a new tab) - NVD
CVE-2026-112276 — Netpbm through 11.16.00 contains a heap out-of-bounds read vulnerability in rasttopnm that allows attackers to read heap mem…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
Netpbm through 11.16.00 contains a heap out-of-bounds read vulnerability in rasttopnm that allows attackers to read heap memory by supplying Sun rasterfiles with short colormaps. Attackers can craft colormapped rasterfiles with pixel bytes exceeding the palette length to leak up to 255 adjacent heap bytes into the PNM output or crash the program.
CVE-2026-112276Read original ↗ (opens in a new tab) - NVD
CVE-2026-112275 — Netpbm through 11.16.00 contains a heap out-of-bounds write vulnerability in the rasttopnm Sun rasterfile run-length decoder…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
Netpbm through 11.16.00 contains a heap out-of-bounds write vulnerability in the rasttopnm Sun rasterfile run-length decoder pr_load_image in converter/other/rast.c. Attackers can supply a byte-encoded rasterfile with tiny dimensions and a long run-length body to write controlled bytes past md_image, causing memory corruption and crashes.
CVE-2026-112275Read original ↗ (opens in a new tab) - NVD
CVE-2026-112274 — libtins through 4.6 contains an out-of-bounds read vulnerability in DNS::soa_record::init that allows remote attackers to re…
Medium · CVSS 4.0 6.3 · Assessor: [email protected]
libtins through 4.6 contains an out-of-bounds read vulnerability in DNS::soa_record::init that allows remote attackers to read past buffer bounds by supplying SOA data lacking NUL terminators. Attackers can feed raw SOA RDATA without a zero byte to applications using the buffer constructor, causing strlen to overrun the heap buffer and possibly crash.
CVE-2026-112274Read original ↗ (opens in a new tab) - NVD
CVE-2026-112273 — libtins through 4.6 contains a heap out-of-bounds read vulnerability in DNS::compose_name in src/dns.cpp that allows remote…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
libtins through 4.6 contains a heap out-of-bounds read vulnerability in DNS::compose_name in src/dns.cpp that allows remote attackers to read past the packet buffer by sending a label ending exactly at the packet end. Attackers can deliver crafted DNS packets whose additional, answer, or authority records trigger a one-byte read when parsed, crashing applications on hardened allocators.
CVE-2026-112273Read original ↗ (opens in a new tab) - NVD
CVE-2026-112272 — Libdisplay-info 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v2 section parser in displayid2.c th…
Medium · CVSS 4.0 6.8 · Assessor: [email protected]
Libdisplay-info 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v2 section parser in displayid2.c that allows attackers to read past the EDID buffer via oversized data block lengths. Attackers can supply a crafted EDID from a malicious monitor, KVM, capture device, or file to over-advance the parse cursor and crash applications.
CVE-2026-112272Read original ↗ (opens in a new tab) - NVD
CVE-2026-112271 — libdisplay-info through 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v1 section parser in display…
Medium · CVSS 4.0 6.8 · Assessor: [email protected]
libdisplay-info through 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v1 section parser in displayid.c that occurs when a data block's declared length exceeds the section. Attackers can supply a crafted EDID from a malicious monitor, KVM, capture device, or EDID file to make is_all_zeroes read past the buffer, causing a possible crash.
CVE-2026-112271Read original ↗ (opens in a new tab) - NVD
CVE-2026-112270 — SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in h…
High · CVSS 4.0 7.1 · Assessor: [email protected]
SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handle_staging_rsp() that lets unauthenticated network-adjacent attackers exhaust Prefill memory. Attackers can obtain the rank address from the /route endpoint and send STAGING_RSP messages with huge chunk_idx values under fresh room IDs, causing the scheduler to be OOM-killed.
CVE-2026-112270Read original ↗ (opens in a new tab) - NVD
CVE-2026-112269 — SGLang through 0.5.22 with the Mooncake disaggregation backend accepts unauthenticated decode registration messages on the P…
High · CVSS 4.0 7.1 · Assessor: [email protected]
SGLang through 0.5.22 with the Mooncake disaggregation backend accepts unauthenticated decode registration messages on the Prefill rank ZMQ PULL socket, allowing denial of service. Network-adjacent attackers can send many registrations with unique mooncake_session_id values and large nested-buffer frames to exhaust Prefill memory until the scheduler is OOM-killed.
CVE-2026-112269Read original ↗ (opens in a new tab) - NVD
CVE-2026-112268 — sglang-router (sgl-model-gateway) through 0.3.2 contains an authorization bypass vulnerability that allows holders of the da…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
sglang-router (sgl-model-gateway) through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA management routes because /ha/* endpoints skip control-plane Admin role checks. Attackers can read cluster topology, write gossiped configuration, change global rate limits, and call POST /ha/shutdown to silently dissolve HA coordination.
CVE-2026-112268Read original ↗ (opens in a new tab) - NVD
CVE-2026-112267 — SGLang through 0.5.22 in prefill/decode disaggregation mode contains a server-side request forgery vulnerability that allows…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
SGLang through 0.5.22 in prefill/decode disaggregation mode contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests via client-supplied bootstrap_host and bootstrap_port fields. Attackers sending crafted requests to the Decode worker's /generate endpoint can probe internal hosts and ports and block the shared scheduler loop, delaying other inference requests.
CVE-2026-112267Read original ↗ (opens in a new tab) - NVD
CVE-2026-112266 — SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight gen…
High · CVSS 4.0 8.2 · Assessor: [email protected]
SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. Attackers can submit streaming /generate requests with single hex character rids and disconnect, triggering prefix-matching abort logic that terminates all other clients' requests.
CVE-2026-112266Read original ↗ (opens in a new tab) - NVD
CVE-2026-112265 — LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to i…
High · CVSS 4.0 8.3 · Assessor: [email protected]
LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to inject forged Lark/Feishu events by skipping signature checks. Attackers knowing a bot UUID can POST fabricated im.message.receive_v1 or card.action.trigger events to drive the LLM pipeline, tools, and approvals as other users.
CVE-2026-112265Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.