THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
Every cached source, newest first. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,765 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates · Some delayed
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUpdates delayed · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-110024 — @fastify/jwt is a JWT utility plugin for Fastify. In versions prior to 10.2.5, the top-level sign and verify methods replace…
Medium · CVSS 3.1 6.8 · Assessor: ce714d77-add3-4f53-aff5-83d477b104bb
@fastify/jwt is a JWT utility plugin for Fastify. In versions prior to 10.2.5, the top-level sign and verify methods replace the globally configured defaults with the per-call options instead of merging them, so passing any per-call option silently drops every global default that the call does not restate, including temporal protections such as token expiration and maximum accepted token age. A token signed this way carries no expiration claim and never expires, and verification stops enforcing a configured maximu…
CVE-2026-110024Read original ↗ (opens in a new tab) - NVD
CVE-2026-111987 — A vulnerability was identified in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected by this vulnerability is the f…
Low · CVSS 4.0 2.1 · Assessor: [email protected]
A vulnerability was identified in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected by this vulnerability is the function read_metadata_from_safetensors of the file modules/sd_models.py of the component Extra-Networks Card Builder. Such manipulation of the argument __metadata__.sshs_model_hash leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded y…
CVE-2026-111987Read original ↗ (opens in a new tab) - NVD
CVE-2026-112063 — libstrophe through 0.14.0 contains a stack-based buffer overflow vulnerability in SCRAM_Hi that allows malicious XMPP server…
Medium · CVSS 4.0 6.0 · Assessor: [email protected]
libstrophe through 0.14.0 contains a stack-based buffer overflow vulnerability in SCRAM_Hi that allows malicious XMPP servers to overflow a 128-byte stack buffer by sending an oversized SCRAM salt. Attackers can send a server-first-message whose s= attribute decodes to more than 124 bytes, aborting the client or overwriting stack memory in NDEBUG builds.
CVE-2026-112063Read original ↗ (opens in a new tab) - NVD
CVE-2026-112062 — lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdns_handle_response that allows adjacent attackers…
Medium · CVSS 4.0 6.0 · Assessor: [email protected]
lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdns_handle_response that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers with RDLENGTH below 6 during a service search, overflowing a 256-byte stack buffer and crashing the device.
CVE-2026-112062Read original ↗ (opens in a new tab) - NVD
CVE-2026-112061 — librtmp (RTMPDump) through 2.6 contains a heap out-of-bounds read vulnerability in AMFProp_Decode that reads an AMF0 strict-…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
librtmp (RTMPDump) through 2.6 contains a heap out-of-bounds read vulnerability in AMFProp_Decode that reads an AMF0 strict-array element count before checking that four bytes remain. A malicious RTMP server or man in the middle can send an AMF0 body ending with a strict-array type byte and fewer than four trailing bytes to crash the client.
CVE-2026-112061Read original ↗ (opens in a new tab) - NVD
CVE-2026-112060 — librtmp in RTMPDump through 2.6 contains an out-of-bounds read and heap out-of-bounds write vulnerability because AMF3_Decod…
Medium · CVSS 4.0 6.1 · Assessor: [email protected]
librtmp in RTMPDump through 2.6 contains an out-of-bounds read and heap out-of-bounds write vulnerability because AMF3_Decode ignores AMF3 property decode failures. Malicious RTMP servers or man-in-the-middle attackers can send oversized AMF3 string lengths, and with the token option DecodeTEA corrupts heap memory and leaks heap bytes.
CVE-2026-112060Read original ↗ (opens in a new tab) - NVD
CVE-2026-112059 — libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the s…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools like lasinfo, las2las, or las2txt write attacker-controlled bytes past the heap buffer, causing memory corruption and crashes.
CVE-2026-112059Read original ↗ (opens in a new tab) - NVD
CVE-2026-112058 — VideoLAN libdvdnav through 7.0.0 contains an out-of-bounds read vulnerability in set_PTT that allows attackers to crash appl…
Medium · CVSS 4.0 6.8 · Assessor: [email protected]
VideoLAN libdvdnav through 7.0.0 contains an out-of-bounds read vulnerability in set_PTT that allows attackers to crash applications by supplying an invalid JumpTT title number checked only by an assert. Attackers can craft a DVD or disc image whose First Play program chain issues JumpTT with title 0 or an oversized number, reading past the heap title table and crashing the player.
CVE-2026-112058Read original ↗ (opens in a new tab) - NVD
CVE-2026-112057 — libdvdnav before 7.0.0 contains a heap out-of-bounds read vulnerability in dvdnav_describe_title_chapters that allows attack…
Medium · CVSS 4.0 6.8 · Assessor: [email protected]
libdvdnav before 7.0.0 contains a heap out-of-bounds read vulnerability in dvdnav_describe_title_chapters that allows attackers to read beyond the part-of-title array by supplying an oversized vts_ttn value. Attackers can provide a crafted DVD or disc image declaring a larger VMGI title vts_ttn than the title set's entries to crash applications enumerating chapters.
CVE-2026-112057Read original ↗ (opens in a new tab) - NVD
CVE-2026-112056 — wvWare wv through 1.2.9 contains a heap-based out-of-bounds read vulnerability in wvGetSTSH in stylesheet.c that allows atta…
Medium · CVSS 4.0 6.8 · Assessor: [email protected]
wvWare wv through 1.2.9 contains a heap-based out-of-bounds read vulnerability in wvGetSTSH in stylesheet.c that allows attackers to crash applications by supplying crafted Word stylesheets. Attackers can provide a .doc file with ten or fewer styles or out-of-range style base indexes to read past heap arrays, crashing applications such as AbiWord.
CVE-2026-112056Read original ↗ (opens in a new tab) - NVD
CVE-2026-112055 — wvWare wv through 1.2.9 contains a stack-based out-of-bounds read vulnerability in wvGetPAPX_FKP and wvGetCHPX_FKP caused by…
Medium · CVSS 4.0 6.8 · Assessor: [email protected]
wvWare wv through 1.2.9 contains a stack-based out-of-bounds read vulnerability in wvGetPAPX_FKP and wvGetCHPX_FKP caused by an unvalidated FKP run count. Attackers can supply a crafted .doc file with a large crun value to read kilobytes past the 512-byte stack buffer, crashing applications like AbiWord.
CVE-2026-112055Read original ↗ (opens in a new tab) - NVD
CVE-2026-112054 — Schroedinger libschroedinger through 1.0.11 contains a divide by zero vulnerability that allows attackers to crash applicati…
Medium · CVSS 4.0 6.8 · Assessor: [email protected]
Schroedinger libschroedinger through 1.0.11 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a zero slice_bytes_denom or slice count in a Dirac stream. Attackers can provide a crafted low-delay picture parsed by schro_decoder_parse_transform_parameters and schro_decoder_parse_lowdelay_transform_data to trigger a SIGFPE and cause denial of service.
CVE-2026-112054Read original ↗ (opens in a new tab) - NVD
CVE-2026-112053 — Schroedinger libschroedinger through 1.0.11 contains an out-of-bounds read vulnerability that allows attackers to read past…
Medium · CVSS 4.0 6.8 · Assessor: [email protected]
Schroedinger libschroedinger through 1.0.11 contains an out-of-bounds read vulnerability that allows attackers to read past a static quantiser table by supplying unvalidated wavelet filter index or transform depth values. Attackers can deliver a crafted low-delay Dirac stream with a wavelet filter index of 7 or more or transform depth of 5 or 6 to crash decoding applications.
CVE-2026-112053Read original ↗ (opens in a new tab) - NVD
CVE-2026-112052 — libspatialite through 5.1.0 contains an integer overflow vulnerability in the WKB point and vertex count size guard of Parse…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
libspatialite through 5.1.0 contains an integer overflow vulnerability in the WKB point and vertex count size guard of ParseWkbLine and related parsers in gg_wkb.c, allowing out-of-bounds reads. Attackers can supply a crafted geometry BLOB with a large point count, for example in a SpatiaLite database file, to crash the process or corrupt heap memory on 32-bit builds.
CVE-2026-112052Read original ↗ (opens in a new tab) - NVD
CVE-2026-112051 — Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to write a…
High · CVSS 4.0 8.3 · Assessor: [email protected]
Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to write and delete arbitrary .json files via backslash sequences in model_name. Attackers can register a persisted custom model through POST /v1/model_registrations/{model_type} with names like ..\..\evil to overwrite configuration or data files writable by the Xinference process.
CVE-2026-112051Read original ↗ (opens in a new tab) - NVD
CVE-2026-112050 — Gitify before 7.10.0 contains a login cross-site request forgery vulnerability that allows remote attackers to bind a victim…
Low · CVSS 4.0 2.3 · Assessor: [email protected]
Gitify before 7.10.0 contains a login cross-site request forgery vulnerability that allows remote attackers to bind a victim's client to their account because performGitHubWebOAuth() omits OAuth state validation. Attackers can get a gitify://oauth?code= link with their own authorization code opened during a victim's pending login, causing Gitify to display attacker-controlled notifications as the victim's own.
CVE-2026-112050Read original ↗ (opens in a new tab) - NVD
CVE-2026-112049 — Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in install_archive_content() that allows attacke…
Medium · CVSS 4.0 6.7 · Assessor: [email protected]
Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in install_archive_content() that allows attackers to write files outside the install directory via crafted .vpk archives. Attackers can embed '..' segments or absolute paths in zip entry names to write attacker-controlled files anywhere writable by Vita3K, potentially enabling host code execution.
CVE-2026-112049Read original ↗ (opens in a new tab) - NVD
CVE-2026-112048 — libspatialite through 5.1.0 fails to validate the polygon ring count in ParseWkbPolygon, allowing attackers to trigger uncon…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
libspatialite through 5.1.0 fails to validate the polygon ring count in ParseWkbPolygon, allowing attackers to trigger uncontrolled interior-ring allocation via crafted geometry BLOBs. Attackers can supply a crafted polygon in a SpatiaLite database or ST_GeomFromWKB input to crash the process or corrupt heap memory on 32-bit builds.
CVE-2026-112048Read original ↗ (opens in a new tab) - NVD
CVE-2026-112047 — OneUptime 14.0.2 before 14.0.69 contains an incorrect authorization vulnerability that allows authenticated project members…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
OneUptime 14.0.2 before 14.0.69 contains an incorrect authorization vulnerability that allows authenticated project members to act on clusters outside their scope by exploiting project-wide permission checks. Attackers can call the AI access test, agent reset, kubectl plan approval and incident AI conversation features to learn agent RBAC permissions, disconnect agents, approve kubectl changes, or run commands on unauthorized resources.
CVE-2026-112047Read original ↗ (opens in a new tab) - NVD
CVE-2026-112046 — OW2 ASM 9.11 before 9.11.1 contains an infinite loop vulnerability in Label.resolve() caused by 16-bit forward-reference off…
Medium · CVSS 4.0 6.8 · Assessor: [email protected]
OW2 ASM 9.11 before 9.11.1 contains an infinite loop vulnerability in Label.resolve() caused by 16-bit forward-reference offsets truncating when rewritten methods exceed 64 KB. Attackers can supply crafted class files whose transformed code grows past 65535 bytes, hanging ClassReader.accept() and denying service to build tools, instrumenters, agents, or analyzers.
CVE-2026-112046Read original ↗ (opens in a new tab) - NVD
CVE-2026-111986 — A vulnerability was determined in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected is the function get_obj_from_s…
Low · CVSS 4.0 2.1 · Assessor: [email protected]
A vulnerability was determined in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected is the function get_obj_from_str of the file modules/sd_models.py of the component Model Instantiation. This manipulation of the argument Target causes code injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-111986Read original ↗ (opens in a new tab) - NVD
CVE-2026-78497 — JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with strin…
High · CVSS 3.1 8.4 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval. The pattern given to test(), match(), or the match and =~ conditions of select() is placed in a `qr'...'` literal and compiled as source text, so a `(?{ ... })` code block in it runs without `use re 'eval'`. Single quotes in the pattern are escaped, but a code block runs in place and needs none. An attacker who supplies a query, or text that an application inserts into the pattern of…
CVE-2026-78497Read original ↗ (opens in a new tab) - NVD
CVE-2026-112021 — snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated r…
High · CVSS 4.0 8.7 · Assessor: [email protected]
snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing a \u0000 escape. Attackers can send a single crafted application/activity+json POST to activitypub_post_handler(), which parses it before signature checks, overflowing heap allocations and crashing the server.
CVE-2026-112021Read original ↗ (opens in a new tab) - NVD
CVE-2026-112020 — LodePNG through 20261006 contains a heap out-of-bounds read vulnerability in lodepng::getFilterTypesInterlaced() in lodepng_…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
LodePNG through 20261006 contains a heap out-of-bounds read vulnerability in lodepng::getFilterTypesInterlaced() in lodepng_util.cpp that lacks bounds checks on decompressed IDAT data. Attackers can supply a crafted interlaced PNG declaring a raster larger than its IDAT stream to disclose adjacent heap memory or crash applications.
CVE-2026-112020Read original ↗ (opens in a new tab) - NVD
CVE-2026-112019 — cgltf through 1.15 contains a heap out-of-bounds read vulnerability in cgltf_accessor_unpack_floats() that advances the spar…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
cgltf through 1.15 contains a heap out-of-bounds read vulnerability in cgltf_accessor_unpack_floats() that advances the sparse values cursor by the base bufferView byteStride. Attackers can supply a crafted glTF or GLB file that passes cgltf_validate() to read adjacent heap memory into vertex data or crash applications.
CVE-2026-112019Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.