THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
The complete recent NVD stream, including unscored entries. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,927 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUp to date · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-111672 — Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/view_pipeline.py that allows au…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/view_pipeline.py that allows authenticated users to view or copy other project groups' pipelines by id. Attackers can enumerate sequential pipeline ids via the web, log, monitoring, pod, and copy_pipeline endpoints to expose DAGs, cluster names, namespaces, Argo workflow ids, and pod names, or clone pipelines.
CVE-2026-111672Read original ↗ (opens in a new tab) - NVD
CVE-2026-111671 — Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to…
High · CVSS 4.0 7.1 · Assessor: [email protected]
Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy other users' notebooks and services by id. Attackers can pass sequential ids to lifecycle endpoints in view_notebook.py, view_inferenceserving.py and view_serving.py to delete pods and take production inference endpoints offline.
CVE-2026-111671Read original ↗ (opens in a new tab) - NVD
CVE-2026-111670 — ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authent…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to access ClickHouse instances they were not granted. Attackers can iterate the instance-id parameter in ReportSourceDatabases, ReportSourceTables, ReportTableColumns and WhereCheckRun to enumerate schemas and infer row counts of restricted tables.
CVE-2026-111670Read original ↗ (opens in a new tab) - NVD
CVE-2026-111669 — ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORD…
High · CVSS 4.0 7.1 · Assessor: [email protected]
ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by supplying a crafted PagerInfo.Sort query parameter to the shared ToPage paging helper. Attackers holding the system:user:list permission can inject subquery or CASE expressions via GET /system/user/list to extract database contents such as stored credentials through blind techniques.
CVE-2026-111669Read original ↗ (opens in a new tab) - NVD
CVE-2026-111668 — AIHelms through 0.1.25 contains a missing authorization vulnerability in apps/api/v1/efficiency.py that allows authenticated…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
AIHelms through 0.1.25 contains a missing authorization vulnerability in apps/api/v1/efficiency.py that allows authenticated low-privileged users to bypass efficiency:read and efficiency:write permission checks. Attackers can query routes like /cost/detail, /top-users and /budget to read organization-wide AI spend, and can modify suggestion statuses or generate reports.
CVE-2026-111668Read original ↗ (opens in a new tab) - NVD
CVE-2026-111667 — REBUILD through 4.5.0 contains a missing authorization vulnerability in TaskCommentController.commentList that allows authen…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
REBUILD through 4.5.0 contains a missing authorization vulnerability in TaskCommentController.commentList that allows authenticated low-privileged users to read task comments without project membership checks. Attackers can supply the id of a task in a private project to the /project/comments/list endpoint to retrieve its comment content and attachment references.
CVE-2026-111667Read original ↗ (opens in a new tab) - NVD
CVE-2026-111666 — Steedos Platform through 3.0.15-beta.51 contains an authorization bypass vulnerability that allows authenticated users to re…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Steedos Platform through 3.0.15-beta.51 contains an authorization bypass vulnerability that allows authenticated users to read other tenants' report definitions by querying the reports object. Because objectql's callAdapter skips space filtering for enable_space_global objects on find/findOne, attackers can call GET /api/v1/reports to disclose report names, descriptions, and object and field API names.
CVE-2026-111666Read original ↗ (opens in a new tab) - NVD
CVE-2026-111665 — Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController that al…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController that allows any authenticated manager user to list, create, edit and delete site languages without the granular Language, LanguageAdd, LanguageEdit or LanguageDelete permissions. Attackers can call the manager/api/language Get, Save and Delete actions directly to remove languages and reassign sites to the default, affecting localized content instance-wide.
CVE-2026-111665Read original ↗ (opens in a new tab) - NVD
CVE-2026-111664 — Safing Portmaster before 2.2.5 contains a missing authorization vulnerability that allows unprivileged local processes to fo…
Medium · CVSS 4.0 4.8 · Assessor: [email protected]
Safing Portmaster before 2.2.5 contains a missing authorization vulnerability that allows unprivileged local processes to force updates by calling the POST /api/v1/updates/from-url endpoint registered with api.PermitAnyone. Attackers can supply an attacker-controlled index URL that bypasses version checks and auto-apply settings, installing older Safing-signed releases carrying previously fixed vulnerabilities.
CVE-2026-111664Read original ↗ (opens in a new tab) - NVD
CVE-2026-111663 — Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch ar…
Critical · CVSS 4.0 9.2 · Assessor: [email protected]
Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via the createUrlUpload GraphQL mutation. Attackers can submit internal URLs, including cloud instance metadata endpoints, through POST /graphql and retrieve the full response via the returned ActiveStorage blob URL.
CVE-2026-111663Read original ↗ (opens in a new tab) - NVD
CVE-2026-111662 — Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the url parameter of the /oembed endpoint. Attackers can target loopback, private, or cloud-metadata addresses through FetchLinkCardService, which follows redirects and skips TLS verification, to read internal page titles and descriptions.
CVE-2026-111662Read original ↗ (opens in a new tab) - NVD
CVE-2026-111661 — waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to send ar…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to send arbitrary email by calling the anonymously mapped /callback/email endpoint. Attackers can POST caller-supplied subject, content, and recipient to EmailController.sendEmail, sending messages from the operator's SMTP account for phishing, spam, and mail quota exhaustion.
CVE-2026-111661Read original ↗ (opens in a new tab) - NVD
CVE-2026-111660 — waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to auto-cancel unpaid orders and manipulate product stock levels.
CVE-2026-111660Read original ↗ (opens in a new tab) - NVD
CVE-2026-111659 — Waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge o…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
Waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge orders by calling the internal /callback/order/submit message-queue callback. Attackers can supply arbitrary userId, addressId and cart ids in the order JSON to create orders for any member, expose stored shipping details, clear carts, and decrement stock.
CVE-2026-111659Read original ↗ (opens in a new tab) - NVD
CVE-2026-111658 — SiteServer SSCMS through 7.4.0 contains an authorization bypass vulnerability in ChannelsController that allows site-scoped…
Medium · CVSS 4.0 5.1 · Assessor: [email protected]
SiteServer SSCMS through 7.4.0 contains an authorization bypass vulnerability in ChannelsController that allows site-scoped administrators to access other sites' channels by supplying foreign channel IDs. Attackers with Channels permission on one site can read and overwrite another site's channel names, file paths, templates, link URLs, and custom fields, breaking multi-site isolation.
CVE-2026-111658Read original ↗ (opens in a new tab) - NVD
CVE-2026-111657 — BeikeShop through 2.0.0.31 contains an insecure direct object reference vulnerability in the markAsShipped handler of RmaCon…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
BeikeShop through 2.0.0.31 contains an insecure direct object reference vulnerability in the markAsShipped handler of RmaController that allows authenticated customers to modify other customers' returns. Attackers can submit sequential RMA ids to the account/rmas/{id}/mark_as_shipped endpoint to overwrite courier names and tracking numbers and mark approved returns as shipped.
CVE-2026-111657Read original ↗ (opens in a new tab) - NVD
CVE-2026-111656 — ChatWiki through 2.9.6 contains an insecure direct object reference vulnerability that allows authenticated users to access…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
ChatWiki through 2.9.6 contains an insecure direct object reference vulnerability that allows authenticated users to access another tenant's form filters by supplying arbitrary form_id values. Attackers can send sequential form_id values to getFormFilterList, getFormFilterInfo and updateFormFilterSort to read filter rules and overwrite another tenant's filter sort order.
CVE-2026-111656Read original ↗ (opens in a new tab) - NVD
CVE-2026-111655 — ThinkAdmin think-plugs-admin through 1.0.81 contains an insecure direct object reference vulnerability that allows non-super…
Medium · CVSS 4.0 5.1 · Assessor: [email protected]
ThinkAdmin think-plugs-admin through 1.0.81 contains an insecure direct object reference vulnerability that allows non-super administrators to read and overwrite other administrators' file records via admin/file.edit. Attackers holding the admin/file.edit node can request or POST a target id with columns like xurl, hash, or uuid to view download URLs, tamper records, or reassign ownership.
CVE-2026-111655Read original ↗ (opens in a new tab) - NVD
CVE-2026-111654 — FastBee through 2.1.0 contains an insecure direct object reference vulnerability that allows authenticated low-privilege use…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
FastBee through 2.1.0 contains an insecure direct object reference vulnerability that allows authenticated low-privilege users to access other users' device groups because GroupController queries lack owner checks. Attackers, including self-registered users, can supply sequential group IDs to read, overwrite, reassign, rewrite device associations of, or delete other users' groups.
CVE-2026-111654Read original ↗ (opens in a new tab) - NVD
CVE-2026-111653 — 53AIHub through 0.5.3 contains a missing authentication vulnerability that allows unauthenticated attackers to overwrite any…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
53AIHub through 0.5.3 contains a missing authentication vulnerability that allows unauthenticated attackers to overwrite any enterprise's profile by sending PUT requests to /api/enterprises/:id. Because UpdateEnterprise only enforces checks when IS_SAAS is true, attackers can enumerate sequential enterprise IDs and overwrite logos, display names and branding for defacement and phishing.
CVE-2026-111653Read original ↗ (opens in a new tab) - NVD
CVE-2026-111652 — Engineercms through 2.0.5 contains a missing authorization vulnerability in AttachController.Attachment that allows unauthen…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
Engineercms through 2.0.5 contains a missing authorization vulnerability in AttachController.Attachment that allows unauthenticated attackers to download project image and video attachments. Attackers can request known or derived /attachment/* paths for .jpg, .png, .bmp, or .mp4 files, which are served before casbin, owner, or admin checks.
CVE-2026-111652Read original ↗ (opens in a new tab) - NVD
CVE-2026-111651 — Risesoft Digital-Infrastructure through 9.6.11 contains a missing authorization vulnerability in the log module DownloadCont…
High · CVSS 4.0 7.1 · Assessor: [email protected]
Risesoft Digital-Infrastructure through 9.6.11 contains a missing authorization vulnerability in the log module DownloadController that allows authenticated users to export any tenant's personnel directory. Attackers can supply another tenant's tenantId to exportLoginXLS or exportNotLoginXLS to obtain XLSX files with names, login names, organization paths, mobile numbers, and emails.
CVE-2026-111651Read original ↗ (opens in a new tab) - NVD
CVE-2026-111650 — ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows una…
High · CVSS 4.0 8.8 · Assessor: [email protected]
ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already configured instances. Attackers can POST to /api/wizard/storage to activate an attacker-controlled S3 or OpenList provider, redirecting uploads and storage reads, and overwrite site and map settings.
CVE-2026-111650Read original ↗ (opens in a new tab) - NVD
CVE-2026-111649 — Rocboss paopao-ce through 0.6.0-alpha.3 contains an insecure direct object reference vulnerability in DownloadAttachment tha…
High · CVSS 4.0 7.1 · Assessor: [email protected]
Rocboss paopao-ce through 0.6.0-alpha.3 contains an insecure direct object reference vulnerability in DownloadAttachment that allows authenticated users to access private media by supplying arbitrary content IDs. Attackers can enumerate sequential post_content ids via the /v1/attachment endpoint to obtain signed download URLs for other users' private, friend-only and following-only images, videos and attachments.
CVE-2026-111649Read original ↗ (opens in a new tab) - NVD
CVE-2026-111648 — BuildAdmin through 2.3.9 contains an insecure direct object reference vulnerability that allows authenticated backend admini…
Medium · CVSS 4.0 5.1 · Assessor: [email protected]
BuildAdmin through 2.3.9 contains an insecure direct object reference vulnerability that allows authenticated backend administrators to modify other administrators' profiles via the id parameter. Attackers holding the routine/adminInfo/edit permission can overwrite avatar, nickname, email, mobile and motto fields, including a super administrator's email and mobile.
CVE-2026-111648Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.