PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

Every cached source, newest first. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

16,819 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates · Some delayed

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  1. NVD

    CVE-2026-111900 — phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php t…

    Medium · CVSS 4.0 5.3 · Assessor: [email protected]

    phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php that fails to verify whether an attachment's parent FAQ is published or visible to the requester. Authenticated users with the dlattachment permission can request index.php?action=attachment&id= to download complete attachment files belonging to draft FAQs.

    CVE-2026-111900
    Read original (opens in a new tab)
  2. NVD

    CVE-2026-111898 — phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take ov…

    High · CVSS 4.0 7.7 · Assessor: [email protected]

    phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferred_username or email. Attackers controlling a Keycloak identity with a colliding username or unverified email can log in through /auth/keycloak/authorize to bind their subject and gain superadmin privileges.

    CVE-2026-111898
    Read original (opens in a new tab)
  3. NVD

    CVE-2026-111897 — phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted editor…

    High · CVSS 4.0 7.1 · Assessor: [email protected]

    phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted editors to manage attachments of FAQs outside their categories by supplying arbitrary record IDs. Attackers in medium permission mode can send upload or delete requests with a target record_id or attachment ID to tamper with or remove files on unauthorized FAQs.

    CVE-2026-111897
    Read original (opens in a new tab)
  4. NVD

    CVE-2026-111896 — phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows…

    Medium · CVSS 4.0 5.1 · Assessor: [email protected]

    phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows FAQ editors to store executable SVG files. Attackers can split script tags around removed tokens like processing instructions so single-pass removal reassembles them, executing script in the application origin when victims open the file.

    CVE-2026-111896
    Read original (opens in a new tab)
  5. NVD

    CVE-2026-111895 — phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login fl…

    High · CVSS 4.0 7.6 · Assessor: [email protected]

    phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferred_username claim and whose AuthEntraId::create() ignores the duplicate-login exception while continuing with the existing local account. Attackers controlling an Entra identity in the configured tenant with a matching preferred_username can take over that local account, including super-admin accounts.

    CVE-2026-111895
    Read original (opens in a new tab)
  6. NVD

    CVE-2026-111894 — phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that allo…

    Medium · CVSS 4.0 5.1 · Assessor: [email protected]

    phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that allows authenticated content authors to inject JavaScript by embedding iframes with data:text/html sources in FAQ or News content. Attackers can bypass the hostless media-host allowlist in FaqHelper::cleanUpContent(), which is rendered via Twig's raw filter, to run phishing interfaces or top-frame redirects for viewers.

    CVE-2026-111894
    Read original (opens in a new tab)
  7. NVD

    CVE-2026-111893 — phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerability in GroupController::saveCategoryRestric…

    High · CVSS 4.0 8.5 · Assessor: [email protected]

    phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerability in GroupController::saveCategoryRestrictions() that lets delegated administrators assign categories outside their own scope. Category-restricted administrators can POST to /admin/api/group/category-restrictions with out-of-scope or empty categoryIds to grant groups unrestricted category access.

    CVE-2026-111893
    Read original (opens in a new tab)
  8. NVD

    CVE-2026-111892 — phpMyFAQ 4.2.0-alpha before 4.2.0-beta lacks effective rate limiting on the unauthenticated user/password/update and user/pa…

    Medium · CVSS 4.0 6.9 · Assessor: [email protected]

    phpMyFAQ 4.2.0-alpha before 4.2.0-beta lacks effective rate limiting on the unauthenticated user/password/update and user/password/reset endpoints. Unauthenticated attackers can send unlimited reset requests to flood a registered user's inbox with reset emails, exhausting mailer and server resources.

    CVE-2026-111892
    Read original (opens in a new tab)
  9. NVD

    CVE-2026-111891 — phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in the group permission API, who…

    High · CVSS 4.0 7.0 · Assessor: [email protected]

    phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in the group permission API, whose updatePermissions and updateMembers endpoints check held rights without regard to language or category scope and write unrestricted group grants. Non-superadmin administrators holding GROUP_EDIT can grant a group a right they hold only in a narrow scope and self-join it via updateMembers, gaining unrestricted FAQ create, edit, and publish access across all languages and categories.

    CVE-2026-111891
    Read original (opens in a new tab)
  10. NVD

    CVE-2026-111890 — phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRig…

    High · CVSS 4.0 7.0 · Assessor: [email protected]

    phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops per-right language restrictions when rights are re-granted. Administrators holding USER_EDIT can submit language-scoped rights to the update-rights API, including for themselves, to gain unrestricted FAQ create, edit, and publish access across all languages.

    CVE-2026-111890
    Read original (opens in a new tab)
  11. NVD

    CVE-2026-111889 — phpMyFAQ from 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in the adm…

    Medium · CVSS 4.0 5.3 · Assessor: [email protected]

    phpMyFAQ from 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in the admin dashboard that allows authenticated users without admin rights to view restricted data. Attackers with any activated account can request /admin/index.php/ to read unpublished FAQ questions, admin edit URLs, recent user identities, and site statistics.

    CVE-2026-111889
    Read original (opens in a new tab)
  12. NVD

    CVE-2026-111888 — phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the…

    Medium · CVSS 4.0 5.1 · Assessor: [email protected]

    phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right to modify news by calling PUT /admin/api/news/update, which checks NEWS_DELETE instead of NEWS_EDIT. Attackers holding addnews and delnews can read the update-news CSRF token from their own cookie and rewrite any news item's header, body, author, link and active flag shown on the public front page.

    CVE-2026-111888
    Read original (opens in a new tab)
  13. NVD

    CVE-2026-111887 — phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enumeration vulnerability that allows unauthenti…

    Medium · CVSS 4.0 6.9 · Assessor: [email protected]

    phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enumeration vulnerability that allows unauthenticated attackers to confirm registered display names and emails via a distinct HTTP 409 response. Attackers can submit guest comments to the comment create endpoint with candidate user and mail values to link names to emails for targeted phishing.

    CVE-2026-111887
    Read original (opens in a new tab)
  14. NVD

    CVE-2026-111886 — phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta lacks brute-force lockout in the removeTwofactorConfig() 2FA removal endpoint,…

    High · CVSS 4.0 7.1 · Assessor: [email protected]

    phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta lacks brute-force lockout in the removeTwofactorConfig() 2FA removal endpoint, allowing authenticated attackers to guess TOTP codes without limit. Attackers holding a hijacked session and CSRF token can repeatedly POST guesses to /api/user/remove-twofactor to permanently disable the victim's 2FA.

    CVE-2026-111886
    Read original (opens in a new tab)
  15. NVD

    CVE-2026-111885 — phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup()…

    High · CVSS 4.0 7.0 · Assessor: [email protected]

    phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() that omits privilege-level checks on target groups. Authenticated non-SuperAdmin administrators holding GROUP_DELETE can send a crafted groupId to /admin/api/group/delete to permanently destroy higher-privileged groups and strip members' inherited rights.

    CVE-2026-111885
    Read original (opens in a new tab)
  16. NVD

    CVE-2026-111884 — phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mai…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel (UserController::updateData, api/user/data/update), checking only the session and CSRF token. An attacker with a hijacked session can set the e-mail to their own mailbox and use the password-reset flow to take over non-2FA accounts, including superadmin.

    CVE-2026-111884
    Read original (opens in a new tab)
  17. NVD

    CVE-2026-111882 — phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that all…

    High · CVSS 4.0 8.6 · Assessor: [email protected]

    phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. Attackers holding a valid or phished IdP identity linked to a 2FA-enabled account can complete the OIDC flow and obtain a fully authenticated session, including administrator accounts.

    CVE-2026-111882
    Read original (opens in a new tab)
  18. NVD

    CVE-2026-111881 — FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculati…

    High · CVSS 4.0 7.2 · Assessor: [email protected]

    FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZE_MAX - 3 to Stream_Zero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboard_synthesize_image_format_to_bmp for CF_DIB/CF_DIBV5, crashing the client or causing an out-of-bounds write.

    CVE-2026-111881
    Read original (opens in a new tab)
  19. NVD

    CVE-2026-111880 — FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fail…

    High · CVSS 4.0 8.3 · Assessor: [email protected]

    FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate the MIC offset. Unauthenticated attackers can send a crafted AUTHENTICATE_MESSAGE with a backward session-key offset and MIC offset to write 16 zero bytes beyond the allocation.

    CVE-2026-111880
    Read original (opens in a new tab)
  20. NVD

    CVE-2026-110882 — Missing Authorization vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Exp…

    Medium · CVSS 3.1 4.3 · Assessor: [email protected]

    Missing Authorization vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMS Alert Order Notifications: from n/a through 4.0.1.

    CVE-2026-110882
    Read original (opens in a new tab)
  21. NVD

    CVE-2025-71435 — Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access afte…

    Low · CVSS 4.0 2.3 · Assessor: [email protected]

    Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every 24 hours to access Coder indefinitely after losing OIDC authorization.

    CVE-2025-71435
    Read original (opens in a new tab)
  22. NVD

    CVE-2024-58398 — Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the log…

    Medium · CVSS 4.0 5.3 · Assessor: [email protected]

    Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the redirect query parameter is improperly sanitized. Attackers can craft a Coder login URL that, when clicked by a logged-in user, redirects the victim to an attacker-controlled website for phishing.

    CVE-2024-58398
    Read original (opens in a new tab)
  23. NVD

    CVE-2026-109701 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PAYCOMET PAYCOMET for…

    High · CVSS 3.1 7.1 · Assessor: [email protected]

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PAYCOMET PAYCOMET for WooCommerce paytpv-for-woocommerce allows Reflected XSS.This issue affects PAYCOMET for WooCommerce: from n/a through 5.45.

    CVE-2026-109701
    Read original (opens in a new tab)
  25. NVD

    CVE-2026-111110 — The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Site S…

    High · CVSS 3.1 7.2 · Assessor: [email protected]

    The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mmdwqzpoxadd' parameter in all versions up to, and including, 2.8.61 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The required nonce (getpaid_form_nonce) is publicly emitted to all visitors via wp_localize_s…

    CVE-2026-111110
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.