THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
Every cached source, newest first. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
17,115 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates · Some delayed
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUpdates delayed · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-109208 — The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-…
High · CVSS 3.1 7.2 · Assessor: [email protected]
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity (REST) / order_comments (checkout)' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. With guest checkout enabled the attack is fully unauthen…
CVE-2026-109208Read original ↗ (opens in a new tab) - NVD
CVE-2026-107763 — The Fastcache by Host.it plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.…
Medium · CVSS 3.1 4.3 · Assessor: [email protected]
The Fastcache by Host.it plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to add or remove the plugin's page-cache rewrite rules in the site's root .htaccess file.
CVE-2026-107763Read original ↗ (opens in a new tab) - NVD
CVE-2026-107762 — The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object…
High · CVSS 3.1 7.5 · Assessor: [email protected]
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to expose arbitrary users' sensitive profile data — including email address, display name, nicename, registration date, profile image URL, and any string-valued user meta fields such as first name, last name…
CVE-2026-107762Read original ↗ (opens in a new tab) - NVD
CVE-2026-104734 — The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection i…
High · CVSS 3.1 7.2 · Assessor: [email protected]
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.3.2 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP…
CVE-2026-104734Read original ↗ (opens in a new tab) - NVD
CVE-2026-111855 — An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability exists in the web ma…
High · CVSS 3.1 7.5 · Assessor: [email protected]
An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability exists in the web management interface of the device. Insufficient validation of user-supplied file paths allows remote attackers to read arbitrary files accessible to the application. Depending on configuration, exploitation may be possible without authentication.
CVE-2026-111855Read original ↗ (opens in a new tab) - NVD
CVE-2026-111854 — An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESyst…
High · CVSS 3.1 8.1 · Assessor: [email protected]
An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESystem command interface allows remote attackers to read or modify arbitrary files on the device through insufficient validation of file paths supplied to filesystem access commands.
CVE-2026-111854Read original ↗ (opens in a new tab) - NVD
CVE-2026-111853 — An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command injection vulnerability exists in the…
High · CVSS 3.1 8.8 · Assessor: [email protected]
An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command injection vulnerability exists in the FILESystem:MOUNT:DRIve SCPI command handler. Insufficient neutralization of user-supplied input allows remote attackers to execute arbitrary operating system commands with elevated privileges.
CVE-2026-111853Read original ↗ (opens in a new tab) - NVD
CVE-2026-111823 — Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.
Critical · CVSS 3.1 9.8 · Assessor: [email protected]
Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.
CVE-2026-111823Read original ↗ (opens in a new tab) - NVD
CVE-2026-89096 — A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated…
Medium · CVSS 3.1 5.9 · Assessor: [email protected]
A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth. Sustained requests can exhaust system resources, eventually causing the service to degrade or crash.
CVE-2026-89096Read original ↗ (opens in a new tab) - NVD
CVE-2026-89088 — A flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT1…
Medium · CVSS 3.1 5.5 · Assessor: [email protected]
A flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16 volumes. By convincing a user or administrator to resize a specially crafted FAT16 file system image with malformed directory metadata, an attacker can trigger an oversized read into a fixed-size memory buffer. This issue causes memory corruption, resulting in an application crash and a denial of service (DoS).
CVE-2026-89088Read original ↗ (opens in a new tab) - NVD
CVE-2026-89085 — A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due…
Medium · CVSS 3.1 6.6 · Assessor: [email protected]
A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer calculation error during buffer allocation. A local attacker could exploit this by enticing a user or automated service to open a malicious filesystem image, resulting in an application crash leading to a Denial of Service (DoS) or potential memory corruption.
CVE-2026-89085Read original ↗ (opens in a new tab) - NVD
CVE-2026-17591 — A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a…
Low · CVSS 3.1 3.6 · Assessor: [email protected]
A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issue arises when the archive_entry_copy_mac_metadata() function deallocates an internal buffer before completing a data copy. An attacker who can supply input to an application utilizing this function can trigger the flaw to crash the application or read uninitialized memory data.
CVE-2026-17591Read original ↗ (opens in a new tab) - NVD
CVE-2026-111802 — A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to emp…
Medium · CVSS 3.1 6.6 · Assessor: [email protected]
A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash without verifying whether the trash directory paths are symbolic links. An attacker can exploit this flaw by tricking a user into mounting a crafted storage volume and confirming the prompt to empty the trash, leading to the arbitrary deletion of files accessible to that user.
CVE-2026-111802Read original ↗ (opens in a new tab) - NVD
CVE-2026-110759 — Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a…
Critical · CVSS 3.1 9.8 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse. When the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker in the field as the byte 0xFF. With binary set, parse("a,\r") returns the fields "a" and "\xFF". On UTF-8 flagged input the last field is a UTF-8 flagged string holding that lone byte, which is malformed UTF-8. The same in…
CVE-2026-110759Read original ↗ (opens in a new tab) - NVD
CVE-2026-110758 — Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail…
High · CVSS 3.1 7.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace. Under allow_whitespace, strip_trail_whitespace removes trailing spaces and tabs from each unquoted field without stopping at the start of the field. For a field of only blanks it reads the byte before the field's heap buffer. If that byte is also a space or tab, it may be zeroed and the walk continue backwards, depending on what the allocator placed there. Leading blanks are norm…
CVE-2026-110758Read original ↗ (opens in a new tab) - NVD
CVE-2026-110757 — Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combi…
Critical · CVSS 3.1 9.8 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine. combine and print do not check whether a field needs quotes when its value has Perl's integer or numeric flag set. Perl sets these flags on a string used in a numeric operation when it parses as a number, which allows leading and trailing whitespace. With binary set, as csv does by default, "12\n" passes a check such as $qty > 0 and is then written unquoted with its newline. A value valid…
CVE-2026-110757Read original ↗ (opens in a new tab) - NVD
CVE-2026-110756 — Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes…
Critical · CVSS 3.1 9.8 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print. When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character split across two flushes can be completed. Nothing writes the held-back bytes after the record's final flush. A record whose last field ends in such a byte loses it, any closing quote and the line ending, while print sti…
CVE-2026-110756Read original ↗ (opens in a new tab) - NVD
CVE-2026-110755 — Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only i…
High · CVSS 3.1 7.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline. With eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the parser copies the whole unparsed remainder into a new buffer, which the next call parses and copies again, so the work grows with the square of the input size. A reader with default options that is sent CSV with classic…
CVE-2026-110755Read original ↗ (opens in a new tab) - NVD
CVE-2026-110754 — Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline. getline collec…
Medium · CVSS 3.1 6.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline. getline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds. When the record has a syntax error, getline returns undef and never frees the array or the fields parsed before the error. A long-running process parsing untrusted CSV retains every malformed record it is sent, so repeated malformed input exhausts its memory.
CVE-2026-110754Read original ↗ (opens in a new tab) - NVD
CVE-2026-110753 — Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows sk…
Critical · CVSS 3.1 9.8 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline. With bind_columns, the parser writes each field into the caller's own scalar without taking a reference to it. When skip_empty_rows skips an empty last line, the parser frees the current field scalar without checking whether it is bound, dropping one reference from the application's variable. The "eof" mode does the same on any empty line. The variable is then fr…
CVE-2026-110753Read original ↗ (opens in a new tab) - NVD
CVE-2026-110752 — Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector…
High · CVSS 3.1 7.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment. fragment expands a row= or col= selector into an array with one element per selected index before it reads any data, and it does not clamp an explicit end column in a cell= selector to the row. Only the syntax and order of the ranges are checked, so row=1-400000000 on a two-line file allocates 400 million elements. An application that passes a request-supplied fragment to fragme…
CVE-2026-110752Read original ↗ (opens in a new tab) - NVD
CVE-2026-96628 — Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.manage…
Medium · CVSS 3.1 4.3 · Assessor: [email protected]
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid X-Arcane-Agent-Token can request /api/debug/pprof/* through a route protected by WithAdminRequired because EnvironmentPermissionSet is installed and the request continues without checking IsGlobalAdmin. This exposes administrator-res…
CVE-2026-96628Read original ↗ (opens in a new tab) - NVD
CVE-2026-96627 — Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/…
High · CVSS 3.1 8.8 · Assessor: [email protected]
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global administrator, replace the administrator password, and authenticate as that account, resulting in complete global administrator account takeover. This issue is fixed in version 2.6.0.
CVE-2026-96627Read original ↗ (opens in a new tab) - NVD
CVE-2026-96626 — Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.5.0, UpdateRegistry and Tes…
High · CVSS 3.1 8.5 · Assessor: [email protected]
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.5.0, UpdateRegistry and TestRegistry in backend/api/services/container_registry_service.go allow the registry URL to change while preserving the stored encrypted token. When a holder of registries:update and registries:test repoints a generic registry URL without supplying a replacement token, TestRegistry decrypts the preserved token and RegistryLogin sends it to the attacker-controlled host because normalizeRegistryS…
CVE-2026-96626Read original ↗ (opens in a new tab) - NVD
CVE-2026-68498 — StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object pr…
High · CVSS 3.1 7.5 · Assessor: 36c7be3b-2937-45df-85ea-ca7133ea542c
StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength (default 100,000,000 characters) that bounds ordinary string values. For parsers built over character input — Reader, String or char[] sources, all served by ReaderBasedJsonParser — that bound is not applied while the name is being accumulated. The code path instead re-uses the string-value length che…
CVE-2026-68498Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.