PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

Every cached source, newest first. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

16,966 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates · Some delayed

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  1. NVD

    CVE-2026-111793 — Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to…

    Medium · CVSS 3.1 4.3 · Assessor: [email protected]

    Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. This may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.

    CVE-2026-111793
    Read original (opens in a new tab)
  2. NVD

    CVE-2026-107674 — IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to a denial of service to Digital Certificate Manager (DCM) for System TLS using…

    Medium · CVSS 3.1 4.4 · Assessor: [email protected]

    IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to a denial of service to Digital Certificate Manager (DCM) for System TLS using applications attempting to create secure network connections. A bad actor could use this to prevent a service from starting or cause it to fallback to non-secure connections.

    CVE-2026-107674
    Read original (opens in a new tab)
  5. NVD

    CVE-2025-55653 — GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_parse_lfrac function (utils/error.c). Proces…

    Medium · CVSS 3.1 5.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_parse_lfrac function (utils/error.c). Processing a crafted MP4 file containing a zero-denominator fraction string causes gf_parse_lfrac() to divide by zero, terminating the process with SIGFPE.

    CVE-2025-55653
    Read original (opens in a new tab)
  7. NVD

    CVE-2026-89098 — A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on…

    Medium · CVSS 3.1 5.5 · Assessor: [email protected]

    A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to verify command arguments. A local user can exploit this vulnerability by sending a malformed request lacking the required arguments to trigger an assertion failure. This causes the daemon to crash, resulting in a Denial of Service (DoS) for filesystem identifier lookup services until restarted.

    CVE-2026-89098
    Read original (opens in a new tab)
  8. NVD

    CVE-2026-81452 — Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain a Least Privilege Violation vulnerability. A low…

    High · CVSS 3.1 7.0 · Assessor: [email protected]

    Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain a Least Privilege Violation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privilege and Denial of Service.

    CVE-2026-81452
    Read original (opens in a new tab)
  10. NVD

    CVE-2026-111723 — LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manag…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1/admins API protected only by AuthAdminJWT. Attackers can self-register, read every account's bcrypt hash, reset the bootstrap administrator's password via PUT, raise their authority_id, and delete accounts.

    CVE-2026-111723
    Read original (opens in a new tab)
  11. NVD

    CVE-2026-111722 — LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users…

    High · CVSS 4.0 8.6 · Assessor: [email protected]

    LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other users' projects because projects.Get lacks an owner check. Self-registered attackers can iterate numeric IDs via GET, PUT and DELETE /admin/v1/projects/:id to read, overwrite, reassign or delete any user's short-drama projects.

    CVE-2026-111722
    Read original (opens in a new tab)
  12. NVD

    CVE-2026-111721 — Open WES through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users to modify other wareho…

    Medium · CVSS 4.0 5.3 · Assessor: [email protected]

    Open WES through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users to modify other warehouses' stock records because GlobalGatewayFilter never enforces auth_warehouse scoping. Attackers holding the menu permission can enumerate sequential IDs on freezeContainerStock and unfreezeContainerStock endpoints to freeze or unfreeze container stock in other warehouses.

    CVE-2026-111721
    Read original (opens in a new tab)
  13. NVD

    CVE-2026-111720 — fish-island-backend through commit 7c61b78 contains an unauthenticated server-side request forgery vulnerability that allows…

    Medium · CVSS 4.0 6.9 · Assessor: [email protected]

    fish-island-backend through commit 7c61b78 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch attacker-supplied URLs via the url parameter of GET /api/web/parse. Attackers can target internal hosts, loopback services or cloud metadata endpoints through redirect-following OkHttp requests and read back page titles, meta descriptions and favicons.

    CVE-2026-111720
    Read original (opens in a new tab)
  14. NVD

    CVE-2026-111719 — Roncoo-pay through commit 9428382 contains a missing authorization vulnerability in F2FPayController.orderQuery that allows…

    High · CVSS 4.0 8.2 · Assessor: [email protected]

    Roncoo-pay through commit 9428382 contains a missing authorization vulnerability in F2FPayController.orderQuery that allows unauthenticated attackers to retrieve payment records by supplying a trxNo parameter. Attackers can guess transaction numbers, a '7' prefix plus a snowflake ID, to obtain the full serialized payment record of any merchant.

    CVE-2026-111719
    Read original (opens in a new tab)
  15. NVD

    CVE-2026-111718 — AipexBase through commit 690adb9 contains a sql injection vulnerability that allows attackers to inject SQL through the orde…

    High · CVSS 4.0 7.1 · Assessor: [email protected]

    AipexBase through commit 690adb9 contains a sql injection vulnerability that allows attackers to inject SQL through the order_by and group_by fields of the /api/data/invoke endpoint. Attackers can supply subqueries or EXTRACTVALUE and UPDATEXML functions that bypass the SqlGuard denylist and row-level security, reading other users' rows and tables.

    CVE-2026-111718
    Read original (opens in a new tab)
  16. NVD

    CVE-2026-111717 — Arkon through 0.9.2 contains a missing authorization vulnerability in list_skill_versions that allows authenticated employee…

    Medium · CVSS 4.0 5.3 · Assessor: [email protected]

    Arkon through 0.9.2 contains a missing authorization vulnerability in list_skill_versions that allows authenticated employees to read other departments' skill version metadata by bypassing the can_access_skill check. Attackers holding the default skill:read permission can request GET /api/skills/{slug}/versions for another department's skill to obtain version numbers, hashes, storage paths and changelogs.

    CVE-2026-111717
    Read original (opens in a new tab)
  17. NVD

    CVE-2026-111716 — Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify ot…

    Medium · CVSS 4.0 5.3 · Assessor: [email protected]

    Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments' sources because by-id routes in app/routers/sources.py skip can_access_document. Attackers can call the plan, progress, PATCH, retry and approve-extraction routes with foreign source IDs to disclose derived wiki titles and summaries and alter ingestion state.

    CVE-2026-111716
    Read original (opens in a new tab)
  18. NVD

    CVE-2026-111715 — Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/wiki/graph that lets authenticated employees…

    Medium · CVSS 4.0 5.3 · Assessor: [email protected]

    Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/wiki/graph that lets authenticated employees read other departments' wiki metadata by supplying a foreign slug. Attackers with only wiki:read:own_dept permission can query get_neighborhood() without scope checks to obtain page slugs, titles, types and link edges up to depth 3.

    CVE-2026-111715
    Read original (opens in a new tab)
  19. NVD

    CVE-2026-111714 — tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block…

    Low · CVSS 4.0 2.3 · Assessor: [email protected]

    tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with a catastrophic-backtracking data-cookie pattern that freezes the page when the purge button is clicked.

    CVE-2026-111714
    Read original (opens in a new tab)
  20. NVD

    CVE-2026-111713 — tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed a…

    Medium · CVSS 4.0 5.1 · Assessor: [email protected]

    tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside a benign url to execute script in the site's origin via iframe src.

    CVE-2026-111713
    Read original (opens in a new tab)
  21. NVD

    CVE-2026-111712 — Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated attackers to…

    Medium · CVSS 4.0 6.9 · Assessor: [email protected]

    Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated attackers to reach protected management CGI handlers by prefixing the URI with a public route. Attackers can request paths prefixed with l7_web_auth.cgi or an .ico route to invoke protected management handlers without credentials.

    CVE-2026-111712
    Read original (opens in a new tab)
  22. NVD

    CVE-2026-111711 — Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_o…

    Critical · CVSS 4.0 9.3 · Assessor: [email protected]

    Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_ok() function, which copies Basic-auth usernames with unbounded strcpy() calls into 64-byte stack buffers. Unauthenticated attackers can send a username longer than 63 bytes to any protected /router/*.cgi route to crash the main Boa process or potentially execute code.

    CVE-2026-111711
    Read original (opens in a new tab)
  23. NVD

    CVE-2026-111710 — Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user_auth() fun…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user_auth() function that allows unauthenticated attackers to crash the server via a malformed Authorization header. Attackers can send a Basic Authorization value lacking a colon, such as one decoding to a single character, to protected routes like /router/get_user_type.cgi to kill the main Boa process and deny management interface access.

    CVE-2026-111710
    Read original (opens in a new tab)
  24. NVD

    CVE-2026-111709 — WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authentica…

    Medium · CVSS 4.0 5.3 · Assessor: [email protected]

    WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to access other agents' tickets because ShowTicketService performs no ownership or queue checks. Attackers can supply another agent's ticket id to GET /tickets/:ticketId and /messages/:ticketId to read full message history and POST WhatsApp replies.

    CVE-2026-111709
    Read original (opens in a new tab)
  25. NVD

    CVE-2026-111708 — WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attac…

    Critical · CVSS 4.0 9.3 · Assessor: [email protected]

    WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all tickets, contacts, messages, and WhatsApp connections.

    CVE-2026-111708
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.