PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

Every cached source, newest first. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

16,445 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates · Some delayed

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  1. NVD

    CVE-2026-111998 — Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain…

    Critical · CVSS 4.0 9.3 · Assessor: [email protected]

    Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events.

    CVE-2026-111998
    Read original (opens in a new tab)
  2. NVD

    CVE-2026-111985 — A vulnerability was found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This impacts the function read_metadata_from…

    Low · CVSS 4.0 2.1 · Assessor: [email protected]

    A vulnerability was found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This impacts the function read_metadata_from_safetensors of the file modules/sd_models.py of the component Metadata Extraction. The manipulation of the argument header length field results in allocation of resources. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

    CVE-2026-111985
    Read original (opens in a new tab)
  3. NVD

    CVE-2026-111984 — A vulnerability has been found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This affects the function create_item_h…

    Low · CVSS 4.0 2.1 · Assessor: [email protected]

    A vulnerability has been found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This affects the function create_item_html of the file modules/ui_extra_networks.py of the component Card Builder. The manipulation of the argument filename leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

    CVE-2026-111984
    Read original (opens in a new tab)
  4. NVD

    CVE-2026-110897 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations Powe…

    High · CVSS 3.1 7.1 · Assessor: [email protected]

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-addon-for-beaver-builder allows Stored XSS.This issue affects PowerPack Lite for Beaver Builder: from n/a through 1.3.1.

    CVE-2026-110897
    Read original (opens in a new tab)
  5. NVD

    CVE-2026-110895 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems Support Genix…

    High · CVSS 3.1 8.5 · Assessor: [email protected]

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems Support Genix support-genix-lite allows SQL Injection.This issue affects Support Genix: from n/a through 1.4.54.

    CVE-2026-110895
    Read original (opens in a new tab)
  6. NVD

    CVE-2026-110886 — Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows…

    Critical · CVSS 3.1 9.8 · Assessor: [email protected]

    Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversational Forms for ChatBot: from n/a through 1.5.1.

    CVE-2026-110886
    Read original (opens in a new tab)
  8. NVD

    CVE-2026-110883 — Authentication Bypass by Primary Weakness vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-vide…

    Medium · CVSS 3.1 6.5 · Assessor: [email protected]

    Authentication Bypass by Primary Weakness vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-videochat allows Authentication Abuse.This issue affects 2Way VideoCalls and Random Chat: from n/a through 6.1.5.

    CVE-2026-110883
    Read original (opens in a new tab)
  9. NVD

    CVE-2026-110880 — Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Acc…

    Medium · CVSS 3.1 6.5 · Assessor: [email protected]

    Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.4.6.

    CVE-2026-110880
    Read original (opens in a new tab)
  10. NVD

    CVE-2026-110383 — Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Form…

    High · CVSS 3.1 7.5 · Assessor: [email protected]

    Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms signature-fluent-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Electronic Signature Add-on for Fluent Forms: from n/a through 2.0.5.

    CVE-2026-110383
    Read original (opens in a new tab)
  11. NVD

    CVE-2026-110382 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NSquared Simply Schedu…

    High · CVSS 3.1 7.1 · Assessor: [email protected]

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Stored XSS.This issue affects Simply Schedule Appointments: from n/a through 1.6.12.35.

    CVE-2026-110382
    Read original (opens in a new tab)
  14. NVD

    CVE-2026-110365 — Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows Exploiting Incorrectly C…

    Medium · CVSS 3.1 6.5 · Assessor: [email protected]

    Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced File Manager: from n/a through 5.4.14.

    CVE-2026-110365
    Read original (opens in a new tab)
  19. NVD

    CVE-2026-96534 — The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 doe…

    High · CVSS 3.1 7.7 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing authenticated users with minimal privileges (Subscriber and above) to perform SQL injection attacks.

    CVE-2026-96534
    Read original (opens in a new tab)
  20. NVD

    CVE-2026-87844 — The PickPlugins Product Designer for WooCommerce WordPress plugin through 1.0.40 does not perform any capability check and i…

    Medium · CVSS 3.1 5.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The PickPlugins Product Designer for WooCommerce WordPress plugin through 1.0.40 does not perform any capability check and its nonce verification is inverted, accepting requests with an invalid or absent nonce while rejecting valid ones, and it does not validate the post the data is written to, allowing unauthenticated users to insert design template data into the metadata of any post on the site.

    CVE-2026-87844
    Read original (opens in a new tab)
  21. NVD

    CVE-2026-111942 — A weakness has been identified in hrisikeshpal Blood_Bank_Management_System 1.0.0. Impacted is an unknown function of the fi…

    Low · CVSS 4.0 2.1 · Assessor: [email protected]

    A weakness has been identified in hrisikeshpal Blood_Bank_Management_System 1.0.0. Impacted is an unknown function of the file /abs.php. This manipulation of the argument Search causes cross site scripting. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

    CVE-2026-111942
    Read original (opens in a new tab)
  22. NVD

    CVE-2026-111877 — A vulnerability was determined in dext34-morgan Books4Cash up to a8d3e357db75c07ac5ffbadcbaee2aeb4db3e571. This affects an u…

    Low · CVSS 4.0 2.1 · Assessor: [email protected]

    A vulnerability was determined in dext34-morgan Books4Cash up to a8d3e357db75c07ac5ffbadcbaee2aeb4db3e571. This affects an unknown part of the file search.php. Executing a manipulation of the argument Search can lead to cross site scripting. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The code repository of the project has not been active for many years.

    CVE-2026-111877
    Read original (opens in a new tab)
  23. NVD

    CVE-2026-111041 — The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions own…

    Medium · CVSS 3.1 4.9 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions owns or is otherwise allowed to edit the targeted object, allowing users with the Editor role or above to modify, or change the type of, arbitrary posts on the site, including content they are not permitted to edit.

    CVE-2026-111041
    Read original (opens in a new tab)
  24. NVD

    CVE-2026-110981 — The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before refle…

    High · CVSS 3.1 7.1 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links, allowing unauthenticated attackers to inject arbitrary script that executes in the browser of anyone who follows a crafted gallery link and clicks the breadcrumb, including a logged-in administrator.

    CVE-2026-110981
    Read original (opens in a new tab)
  25. NVD

    CVE-2026-110976 — The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the r…

    Medium · CVSS 3.1 4.9 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the requesting user before converting it to an attachment and permanently deleting it, allowing users with the Editor role and above to delete arbitrary posts of any type, including content they cannot otherwise delete such as navigation menus, block templates and global styles.

    CVE-2026-110976
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.