THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
Every cached source, newest first. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,989 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUp to date · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-111686 — IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL thro…
High · CVSS 4.0 8.7 · Assessor: [email protected]
IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path parameter of /WebArticle/findarticlesbynum. Attackers can append crafted SQL after the LIMIT clause concatenated into a MyBatis-Plus QueryWrapper to extract database contents via union-based or blind techniques.
CVE-2026-111686Read original ↗ (opens in a new tab) - NVD
CVE-2026-111685 — IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL by s…
High · CVSS 4.0 8.7 · Assessor: [email protected]
IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL by supplying a crafted num path parameter to /WebResource/findresourcebynum. Attackers can append SQL after the LIMIT clause concatenated via QueryWrapper.last() to extract database contents using union-based or blind techniques.
CVE-2026-111685Read original ↗ (opens in a new tab) - NVD
CVE-2026-111684 — Magistrala through 1.0.0 contains an authorization bypass vulnerability that allows authenticated workspace members to view,…
High · CVSS 4.0 7.2 · Assessor: [email protected]
Magistrala through 1.0.0 contains an authorization bypass vulnerability that allows authenticated workspace members to view, issue, and revoke other tenants' device certificates by supplying foreign serials or entity ids. Attackers can call RevokeBySerial, RevokeAll, ViewCert, ListCerts, or IssueCert under their own workspace path to disconnect other tenants' devices, disclose certificates, and mint CA-signed certificates for their device ids.
CVE-2026-111684Read original ↗ (opens in a new tab) - NVD
CVE-2026-111683 — Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to byp…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to bypass rack model permissions because RalphPermission skips checks for views without a queryset. Attackers can call DCAssetsView and SRRacksAPIView at /api/rack/ and /api/server_room/ to read asset hostnames, serials and management IPs, and to modify, move or create racks.
CVE-2026-111683Read original ↗ (opens in a new tab) - NVD
CVE-2026-111682 — EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to rea…
High · CVSS 4.0 7.1 · Assessor: [email protected]
EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config REST API. Attackers with any ROLE_USER account can query /api/model-config/page or /api/model-config/{id} to retrieve unmasked keys, enabling provider account access and incurred costs.
CVE-2026-111682Read original ↗ (opens in a new tab) - NVD
CVE-2026-111681 — EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage ac…
High · CVSS 4.0 8.7 · Assessor: [email protected]
EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks. Attackers can send POST, PUT, or DELETE requests to UserController to grant themselves ROLE_ADMIN, create administrators, or delete users, gaining control of managed Kafka clusters.
CVE-2026-111681Read original ↗ (opens in a new tab) - NVD
CVE-2026-111680 — APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to access…
High · CVSS 4.0 7.2 · Assessor: [email protected]
APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to access other teams' services and applications by supplying their own team id in the team query parameter. Attackers can target service or app ids exposed by /api/v1/simple/services and /api/v1/simple/apps to read, modify, or delete other teams' services and applications via /api/v1/service/info and /api/v1/app endpoints.
CVE-2026-111680Read original ↗ (opens in a new tab) - NVD
CVE-2026-111679 — Ekko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authenticated non-super_admin user…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Ekko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authenticated non-super_admin user to list and clear server-wide login lockouts via /api/auth/locked-ips. Attackers can send DELETE requests without an ip parameter to invoke unlockAll(), disabling the login rate limiter during password guessing against super_admin accounts.
CVE-2026-111679Read original ↗ (opens in a new tab) - NVD
CVE-2026-111678 — Antiword through 0.37 contains a stack out-of-bounds read vulnerability in vGet8PapInfo and vGet8ChrInfo in prop8.c because…
Medium · CVSS 4.0 4.8 · Assessor: [email protected]
Antiword through 0.37 contains a stack out-of-bounds read vulnerability in vGet8PapInfo and vGet8ChrInfo in prop8.c because FKP run counts and grpprl offsets are not bounded. Attackers can supply a crafted .doc file with malicious FKP pages to read past the 512-byte stack buffer, crashing antiword or corrupting style parsing.
CVE-2026-111678Read original ↗ (opens in a new tab) - NVD
CVE-2026-111677 — Antiword through 0.37 contains a heap out-of-bounds read vulnerability in vGet8LstInfo in prop8.c caused by an inverted boun…
Medium · CVSS 4.0 6.8 · Assessor: [email protected]
Antiword through 0.37 contains a heap out-of-bounds read vulnerability in vGet8LstInfo in prop8.c caused by an inverted bounds check on the PlcfLst record count. Attackers can supply a crafted Word 8 .doc file claiming up to 0xffff LSTF records in a tiny buffer, causing reads past the heap allocation that crash the process.
CVE-2026-111677Read original ↗ (opens in a new tab) - NVD
CVE-2026-111676 — Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket/tooltip to read ticket conversations, including customer personal data and internal agent notes.
CVE-2026-111676Read original ↗ (opens in a new tab) - NVD
CVE-2026-111675 — Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows una…
Critical · CVSS 4.0 9.1 · Assessor: [email protected]
Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's phone or email can trigger a code and rotate source IPs against the password reset and verify login endpoints to take over accounts.
CVE-2026-111675Read original ↗ (opens in a new tab) - NVD
CVE-2026-111674 — Tbed through 20240319 contains a missing authorization vulnerability that allows any authenticated user to rename other user…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Tbed through 20240319 contains a missing authorization vulnerability that allows any authenticated user to rename other users' images through the /admin/setImgFileName endpoint. Attackers can supply a victim's imgname, exposed in public image URLs and album listings, to overwrite display names with attacker-chosen text attributed to the victim.
CVE-2026-111674Read original ↗ (opens in a new tab) - NVD
CVE-2026-111673 — IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/** is excluded from the Shiro jwt filter. Attackers can send PUT requests to /User/updateUser to set a new password and role on any userId, including administrators, enabling full account takeover.
CVE-2026-111673Read original ↗ (opens in a new tab) - NVD
CVE-2026-111672 — Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/view_pipeline.py that allows au…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/view_pipeline.py that allows authenticated users to view or copy other project groups' pipelines by id. Attackers can enumerate sequential pipeline ids via the web, log, monitoring, pod, and copy_pipeline endpoints to expose DAGs, cluster names, namespaces, Argo workflow ids, and pod names, or clone pipelines.
CVE-2026-111672Read original ↗ (opens in a new tab) - NVD
CVE-2026-111671 — Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to…
High · CVSS 4.0 7.1 · Assessor: [email protected]
Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy other users' notebooks and services by id. Attackers can pass sequential ids to lifecycle endpoints in view_notebook.py, view_inferenceserving.py and view_serving.py to delete pods and take production inference endpoints offline.
CVE-2026-111671Read original ↗ (opens in a new tab) - NVD
CVE-2026-111670 — ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authent…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to access ClickHouse instances they were not granted. Attackers can iterate the instance-id parameter in ReportSourceDatabases, ReportSourceTables, ReportTableColumns and WhereCheckRun to enumerate schemas and infer row counts of restricted tables.
CVE-2026-111670Read original ↗ (opens in a new tab) - NVD
CVE-2026-111669 — ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORD…
High · CVSS 4.0 7.1 · Assessor: [email protected]
ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by supplying a crafted PagerInfo.Sort query parameter to the shared ToPage paging helper. Attackers holding the system:user:list permission can inject subquery or CASE expressions via GET /system/user/list to extract database contents such as stored credentials through blind techniques.
CVE-2026-111669Read original ↗ (opens in a new tab) - NVD
CVE-2026-111668 — AIHelms through 0.1.25 contains a missing authorization vulnerability in apps/api/v1/efficiency.py that allows authenticated…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
AIHelms through 0.1.25 contains a missing authorization vulnerability in apps/api/v1/efficiency.py that allows authenticated low-privileged users to bypass efficiency:read and efficiency:write permission checks. Attackers can query routes like /cost/detail, /top-users and /budget to read organization-wide AI spend, and can modify suggestion statuses or generate reports.
CVE-2026-111668Read original ↗ (opens in a new tab) - NVD
CVE-2026-111667 — REBUILD through 4.5.0 contains a missing authorization vulnerability in TaskCommentController.commentList that allows authen…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
REBUILD through 4.5.0 contains a missing authorization vulnerability in TaskCommentController.commentList that allows authenticated low-privileged users to read task comments without project membership checks. Attackers can supply the id of a task in a private project to the /project/comments/list endpoint to retrieve its comment content and attachment references.
CVE-2026-111667Read original ↗ (opens in a new tab) - NVD
CVE-2026-111666 — Steedos Platform through 3.0.15-beta.51 contains an authorization bypass vulnerability that allows authenticated users to re…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Steedos Platform through 3.0.15-beta.51 contains an authorization bypass vulnerability that allows authenticated users to read other tenants' report definitions by querying the reports object. Because objectql's callAdapter skips space filtering for enable_space_global objects on find/findOne, attackers can call GET /api/v1/reports to disclose report names, descriptions, and object and field API names.
CVE-2026-111666Read original ↗ (opens in a new tab) - NVD
CVE-2026-111665 — Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController that al…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController that allows any authenticated manager user to list, create, edit and delete site languages without the granular Language, LanguageAdd, LanguageEdit or LanguageDelete permissions. Attackers can call the manager/api/language Get, Save and Delete actions directly to remove languages and reassign sites to the default, affecting localized content instance-wide.
CVE-2026-111665Read original ↗ (opens in a new tab) - NVD
CVE-2026-111664 — Safing Portmaster before 2.2.5 contains a missing authorization vulnerability that allows unprivileged local processes to fo…
Medium · CVSS 4.0 4.8 · Assessor: [email protected]
Safing Portmaster before 2.2.5 contains a missing authorization vulnerability that allows unprivileged local processes to force updates by calling the POST /api/v1/updates/from-url endpoint registered with api.PermitAnyone. Attackers can supply an attacker-controlled index URL that bypasses version checks and auto-apply settings, installing older Safing-signed releases carrying previously fixed vulnerabilities.
CVE-2026-111664Read original ↗ (opens in a new tab) - NVD
CVE-2026-111663 — Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch ar…
Critical · CVSS 4.0 9.2 · Assessor: [email protected]
Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via the createUrlUpload GraphQL mutation. Attackers can submit internal URLs, including cloud instance metadata endpoints, through POST /graphql and retrieve the full response via the returned ActiveStorage blob URL.
CVE-2026-111663Read original ↗ (opens in a new tab) - NVD
CVE-2026-111662 — Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the url parameter of the /oembed endpoint. Attackers can target loopback, private, or cloud-metadata addresses through FetchLinkCardService, which follows redirects and skips TLS verification, to read internal page titles and descriptions.
CVE-2026-111662Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.