THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
Every cached source, newest first. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,917 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates · Some delayed
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUpdates delayed · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-111710 — Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user_auth() fun…
High · CVSS 4.0 8.7 · Assessor: [email protected]
Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user_auth() function that allows unauthenticated attackers to crash the server via a malformed Authorization header. Attackers can send a Basic Authorization value lacking a colon, such as one decoding to a single character, to protected routes like /router/get_user_type.cgi to kill the main Boa process and deny management interface access.
CVE-2026-111710Read original ↗ (opens in a new tab) - NVD
CVE-2026-111709 — WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authentica…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to access other agents' tickets because ShowTicketService performs no ownership or queue checks. Attackers can supply another agent's ticket id to GET /tickets/:ticketId and /messages/:ticketId to read full message history and POST WhatsApp replies.
CVE-2026-111709Read original ↗ (opens in a new tab) - NVD
CVE-2026-111708 — WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attac…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all tickets, contacts, messages, and WhatsApp connections.
CVE-2026-111708Read original ↗ (opens in a new tab) - NVD
CVE-2026-111707 — 99AI through 4.3.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
99AI through 4.3.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read other users' chat messages because querySingleChat lacks an owner check. Attackers can send a fingerprint header to obtain a visitor JWT and iterate sequential chatId values to retrieve other users' message content and task data.
CVE-2026-111707Read original ↗ (opens in a new tab) - NVD
CVE-2026-111706 — 99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows un…
High · CVSS 4.0 8.7 · Assessor: [email protected]
99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs. Attackers can send requests with controlled page, size, and optional email fields to download xlsx files containing usernames, emails, prompts, and AI answers.
CVE-2026-111706Read original ↗ (opens in a new tab) - NVD
CVE-2026-111705 — Fuint through commit 57ec018 contains an insecure direct object reference vulnerability that allows authenticated members to…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Fuint through commit 57ec018 contains an insecure direct object reference vulnerability that allows authenticated members to read other members' booking records by supplying arbitrary bookId values to /clientApi/book/myBookDetail. Attackers can iterate the auto-increment bookId to retrieve contact names, mobile numbers, in-store verification codes, service dates, stores and remarks.
CVE-2026-111705Read original ↗ (opens in a new tab) - NVD
CVE-2026-111704 — LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM provider API keys, create super-admin accounts, and modify or delete data.
CVE-2026-111704Read original ↗ (opens in a new tab) - NVD
CVE-2026-111703 — yshop-crm through 2.1.3 contains an insecure direct object reference vulnerability that allows authenticated sales users to…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
yshop-crm through 2.1.3 contains an insecure direct object reference vulnerability that allows authenticated sales users to access other users' customer records by supplying arbitrary ids. Attackers can enumerate ids against the get, update, delete and do-open endpoints to read contact details, overwrite or delete customers, or release them into the public pool.
CVE-2026-111703Read original ↗ (opens in a new tab) - NVD
CVE-2026-111702 — ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to…
High · CVSS 4.0 8.7 · Assessor: [email protected]
ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other users' private knowledge bases by supplying sequential ids. Attackers can enumerate ids via GET /api/knowledgebases/{id} or the knowledgebaseId parameter of POST /api/models/chat to read metadata and retrieved document content.
CVE-2026-111702Read original ↗ (opens in a new tab) - NVD
CVE-2026-111701 — OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to acce…
High · CVSS 4.0 8.3 · Assessor: [email protected]
OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucket objects because /storage/v1/object/{bucketId}/{path} is treated as public for every HTTP method. Attackers knowing a tenant subdomain, bucket id and object path can download objects from private buckets and delete stored objects without an apikey or JWT.
CVE-2026-111701Read original ↗ (opens in a new tab) - NVD
CVE-2026-111700 — WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL through…
High · CVSS 4.0 7.1 · Assessor: [email protected]
WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL through WHERE-clause text literals in the EQL query API. Attackers can send crafted single-quoted literals to POST /api/v3/en_US/eql, escaping the unsanitized EqlBuilder SQL interpolation to read unauthorized entities, including user and role tables.
CVE-2026-111700Read original ↗ (opens in a new tab) - NVD
CVE-2026-111699 — Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to imperson…
Medium · CVSS 4.0 6.3 · Assessor: [email protected]
Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to impersonate WeChat fans by supplying a raw openid cookie to fan-facing controllers. Attackers knowing a victim's openid can call /wxUser/getUserInfo and /wxUserTags endpoints to read nickname, phone, unionid and tags, and add or remove fan tags.
CVE-2026-111699Read original ↗ (opens in a new tab) - NVD
CVE-2026-111698 — HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge e…
High · CVSS 4.0 7.1 · Assessor: [email protected]
HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or reduce balances and consume charging services for free.
CVE-2026-111698Read original ↗ (opens in a new tab) - NVD
CVE-2026-111697 — HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController an…
High · CVSS 4.0 7.1 · Assessor: [email protected]
HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids against endpoints like /me/getMemberBalanceByUserId and /order/orderDetail to read any member's wallet, credit, profile and charging orders.
CVE-2026-111697Read original ↗ (opens in a new tab) - NVD
CVE-2026-111696 — data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImp…
High · CVSS 4.0 7.1 · Assessor: [email protected]
data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via cross-workspace IDOR, and decrypt them offline to recover plaintext database credentials.
CVE-2026-111696Read original ↗ (opens in a new tab) - NVD
CVE-2026-111695 — Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows auth…
High · CVSS 4.0 7.1 · Assessor: [email protected]
Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable, /tableDetail, /update or /delete to obtain JDBC credentials, enumerate database schemas, and modify or delete datasources.
CVE-2026-111695Read original ↗ (opens in a new tab) - NVD
CVE-2026-111694 — qKnow through 2.4.3 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access /…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
qKnow through 2.4.3 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access /flyflow workflow integration endpoints permitted in SecurityConfig. Attackers can POST sequential userId values to /flyflow/userById or call roleAll and deptListByParentDeptId to enumerate user phone numbers, roles, and department structure.
CVE-2026-111694Read original ↗ (opens in a new tab) - NVD
CVE-2026-111693 — DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attac…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain an administrator token and access all protected /webapi routes.
CVE-2026-111693Read original ↗ (opens in a new tab) - NVD
CVE-2026-111692 — DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to gain full administrative access to protected /webapi routes, including the Doris SQL query API.
CVE-2026-111692Read original ↗ (opens in a new tab) - NVD
CVE-2026-111691 — WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenan…
Critical · CVSS 4.0 9.1 · Assessor: [email protected]
WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or admin usertype values to read and modify other tenants' orders, finance data, and Amazon seller authorizations.
CVE-2026-111691Read original ↗ (opens in a new tab) - NVD
CVE-2026-111690 — Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to for…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain full administrative control over users, roles, menus, API authorities, configuration and tokens.
CVE-2026-111690Read original ↗ (opens in a new tab) - NVD
CVE-2026-111689 — Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to read user recor…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to read user records of any department by ignoring role data scope. Attackers can request GET /xboot/user/getByDepartmentId/{departmentId} with arbitrary department ids to retrieve usernames, real names, mobile numbers, emails and status.
CVE-2026-111689Read original ↗ (opens in a new tab) - NVD
CVE-2026-111688 — Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role data…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role data-scope restrictions by sending openDataFilter=false. Attackers can append this parameter to the department getByParentId or search endpoints to retrieve the entire organization's department tree and names outside their assigned scope.
CVE-2026-111688Read original ↗ (opens in a new tab) - NVD
CVE-2026-111687 — WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/{feed_id} endpoint. Attackers can supply a non-built-in ext value and a {{=expression}} template whose object-subclass traversal bypasses the eval denylist to run OS commands as the service account.
CVE-2026-111687Read original ↗ (opens in a new tab) - NVD
CVE-2026-111686 — IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL thro…
High · CVSS 4.0 8.7 · Assessor: [email protected]
IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path parameter of /WebArticle/findarticlesbynum. Attackers can append crafted SQL after the LIMIT clause concatenated into a MyBatis-Plus QueryWrapper to extract database contents via union-based or blind techniques.
CVE-2026-111686Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.