THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
Every cached source, newest first. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,839 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates · Some delayed
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUpdates delayed · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-111722 — LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users…
High · CVSS 4.0 8.6 · Assessor: [email protected]
LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other users' projects because projects.Get lacks an owner check. Self-registered attackers can iterate numeric IDs via GET, PUT and DELETE /admin/v1/projects/:id to read, overwrite, reassign or delete any user's short-drama projects.
CVE-2026-111722Read original ↗ (opens in a new tab) - NVD
CVE-2026-111721 — Open WES through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users to modify other wareho…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Open WES through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users to modify other warehouses' stock records because GlobalGatewayFilter never enforces auth_warehouse scoping. Attackers holding the menu permission can enumerate sequential IDs on freezeContainerStock and unfreezeContainerStock endpoints to freeze or unfreeze container stock in other warehouses.
CVE-2026-111721Read original ↗ (opens in a new tab) - NVD
CVE-2026-111720 — fish-island-backend through commit 7c61b78 contains an unauthenticated server-side request forgery vulnerability that allows…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
fish-island-backend through commit 7c61b78 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch attacker-supplied URLs via the url parameter of GET /api/web/parse. Attackers can target internal hosts, loopback services or cloud metadata endpoints through redirect-following OkHttp requests and read back page titles, meta descriptions and favicons.
CVE-2026-111720Read original ↗ (opens in a new tab) - NVD
CVE-2026-111719 — Roncoo-pay through commit 9428382 contains a missing authorization vulnerability in F2FPayController.orderQuery that allows…
High · CVSS 4.0 8.2 · Assessor: [email protected]
Roncoo-pay through commit 9428382 contains a missing authorization vulnerability in F2FPayController.orderQuery that allows unauthenticated attackers to retrieve payment records by supplying a trxNo parameter. Attackers can guess transaction numbers, a '7' prefix plus a snowflake ID, to obtain the full serialized payment record of any merchant.
CVE-2026-111719Read original ↗ (opens in a new tab) - NVD
CVE-2026-111718 — AipexBase through commit 690adb9 contains a sql injection vulnerability that allows attackers to inject SQL through the orde…
High · CVSS 4.0 7.1 · Assessor: [email protected]
AipexBase through commit 690adb9 contains a sql injection vulnerability that allows attackers to inject SQL through the order_by and group_by fields of the /api/data/invoke endpoint. Attackers can supply subqueries or EXTRACTVALUE and UPDATEXML functions that bypass the SqlGuard denylist and row-level security, reading other users' rows and tables.
CVE-2026-111718Read original ↗ (opens in a new tab) - NVD
CVE-2026-111717 — Arkon through 0.9.2 contains a missing authorization vulnerability in list_skill_versions that allows authenticated employee…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Arkon through 0.9.2 contains a missing authorization vulnerability in list_skill_versions that allows authenticated employees to read other departments' skill version metadata by bypassing the can_access_skill check. Attackers holding the default skill:read permission can request GET /api/skills/{slug}/versions for another department's skill to obtain version numbers, hashes, storage paths and changelogs.
CVE-2026-111717Read original ↗ (opens in a new tab) - NVD
CVE-2026-111716 — Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify ot…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments' sources because by-id routes in app/routers/sources.py skip can_access_document. Attackers can call the plan, progress, PATCH, retry and approve-extraction routes with foreign source IDs to disclose derived wiki titles and summaries and alter ingestion state.
CVE-2026-111716Read original ↗ (opens in a new tab) - NVD
CVE-2026-111715 — Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/wiki/graph that lets authenticated employees…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/wiki/graph that lets authenticated employees read other departments' wiki metadata by supplying a foreign slug. Attackers with only wiki:read:own_dept permission can query get_neighborhood() without scope checks to obtain page slugs, titles, types and link edges up to depth 3.
CVE-2026-111715Read original ↗ (opens in a new tab) - NVD
CVE-2026-111714 — tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block…
Low · CVSS 4.0 2.3 · Assessor: [email protected]
tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with a catastrophic-backtracking data-cookie pattern that freezes the page when the purge button is clicked.
CVE-2026-111714Read original ↗ (opens in a new tab) - NVD
CVE-2026-111713 — tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed a…
Medium · CVSS 4.0 5.1 · Assessor: [email protected]
tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside a benign url to execute script in the site's origin via iframe src.
CVE-2026-111713Read original ↗ (opens in a new tab) - NVD
CVE-2026-111712 — Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated attackers to…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated attackers to reach protected management CGI handlers by prefixing the URI with a public route. Attackers can request paths prefixed with l7_web_auth.cgi or an .ico route to invoke protected management handlers without credentials.
CVE-2026-111712Read original ↗ (opens in a new tab) - NVD
CVE-2026-111711 — Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_o…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_ok() function, which copies Basic-auth usernames with unbounded strcpy() calls into 64-byte stack buffers. Unauthenticated attackers can send a username longer than 63 bytes to any protected /router/*.cgi route to crash the main Boa process or potentially execute code.
CVE-2026-111711Read original ↗ (opens in a new tab) - NVD
CVE-2026-111710 — Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user_auth() fun…
High · CVSS 4.0 8.7 · Assessor: [email protected]
Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user_auth() function that allows unauthenticated attackers to crash the server via a malformed Authorization header. Attackers can send a Basic Authorization value lacking a colon, such as one decoding to a single character, to protected routes like /router/get_user_type.cgi to kill the main Boa process and deny management interface access.
CVE-2026-111710Read original ↗ (opens in a new tab) - NVD
CVE-2026-111709 — WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authentica…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to access other agents' tickets because ShowTicketService performs no ownership or queue checks. Attackers can supply another agent's ticket id to GET /tickets/:ticketId and /messages/:ticketId to read full message history and POST WhatsApp replies.
CVE-2026-111709Read original ↗ (opens in a new tab) - NVD
CVE-2026-111708 — WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attac…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all tickets, contacts, messages, and WhatsApp connections.
CVE-2026-111708Read original ↗ (opens in a new tab) - NVD
CVE-2026-111707 — 99AI through 4.3.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
99AI through 4.3.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read other users' chat messages because querySingleChat lacks an owner check. Attackers can send a fingerprint header to obtain a visitor JWT and iterate sequential chatId values to retrieve other users' message content and task data.
CVE-2026-111707Read original ↗ (opens in a new tab) - NVD
CVE-2026-111706 — 99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows un…
High · CVSS 4.0 8.7 · Assessor: [email protected]
99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs. Attackers can send requests with controlled page, size, and optional email fields to download xlsx files containing usernames, emails, prompts, and AI answers.
CVE-2026-111706Read original ↗ (opens in a new tab) - NVD
CVE-2026-111705 — Fuint through commit 57ec018 contains an insecure direct object reference vulnerability that allows authenticated members to…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Fuint through commit 57ec018 contains an insecure direct object reference vulnerability that allows authenticated members to read other members' booking records by supplying arbitrary bookId values to /clientApi/book/myBookDetail. Attackers can iterate the auto-increment bookId to retrieve contact names, mobile numbers, in-store verification codes, service dates, stores and remarks.
CVE-2026-111705Read original ↗ (opens in a new tab) - NVD
CVE-2026-111704 — LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM provider API keys, create super-admin accounts, and modify or delete data.
CVE-2026-111704Read original ↗ (opens in a new tab) - NVD
CVE-2026-111703 — yshop-crm through 2.1.3 contains an insecure direct object reference vulnerability that allows authenticated sales users to…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
yshop-crm through 2.1.3 contains an insecure direct object reference vulnerability that allows authenticated sales users to access other users' customer records by supplying arbitrary ids. Attackers can enumerate ids against the get, update, delete and do-open endpoints to read contact details, overwrite or delete customers, or release them into the public pool.
CVE-2026-111703Read original ↗ (opens in a new tab) - NVD
CVE-2026-111702 — ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to…
High · CVSS 4.0 8.7 · Assessor: [email protected]
ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other users' private knowledge bases by supplying sequential ids. Attackers can enumerate ids via GET /api/knowledgebases/{id} or the knowledgebaseId parameter of POST /api/models/chat to read metadata and retrieved document content.
CVE-2026-111702Read original ↗ (opens in a new tab) - NVD
CVE-2026-111701 — OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to acce…
High · CVSS 4.0 8.3 · Assessor: [email protected]
OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucket objects because /storage/v1/object/{bucketId}/{path} is treated as public for every HTTP method. Attackers knowing a tenant subdomain, bucket id and object path can download objects from private buckets and delete stored objects without an apikey or JWT.
CVE-2026-111701Read original ↗ (opens in a new tab) - NVD
CVE-2026-111700 — WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL through…
High · CVSS 4.0 7.1 · Assessor: [email protected]
WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL through WHERE-clause text literals in the EQL query API. Attackers can send crafted single-quoted literals to POST /api/v3/en_US/eql, escaping the unsanitized EqlBuilder SQL interpolation to read unauthorized entities, including user and role tables.
CVE-2026-111700Read original ↗ (opens in a new tab) - NVD
CVE-2026-111699 — Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to imperson…
Medium · CVSS 4.0 6.3 · Assessor: [email protected]
Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to impersonate WeChat fans by supplying a raw openid cookie to fan-facing controllers. Attackers knowing a victim's openid can call /wxUser/getUserInfo and /wxUserTags endpoints to read nickname, phone, unionid and tags, and add or remove fan tags.
CVE-2026-111699Read original ↗ (opens in a new tab) - NVD
CVE-2026-111698 — HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge e…
High · CVSS 4.0 7.1 · Assessor: [email protected]
HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or reduce balances and consume charging services for free.
CVE-2026-111698Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.