THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
The complete recent NVD stream, including unscored entries. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,909 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUp to date · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-111647 — PickMall lilishop through 5.0.0 contains an insecure direct object reference vulnerability that allows authenticated buyers…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
PickMall lilishop through 5.0.0 contains an insecure direct object reference vulnerability that allows authenticated buyers to read other buyers' invoice records because ReceiptServiceImpl.getDetail performs no ownership check. Attackers can supply another buyer's receipt id to GET /buyer/trade/receipt/{id} to obtain invoice titles, taxpayer identification numbers, order numbers, member ids and member names.
CVE-2026-111647Read original ↗ (opens in a new tab) - NVD
CVE-2026-111646 — SurveyKing before 1.13.0 contains a missing authorization vulnerability that allows unauthenticated attackers to download an…
High · CVSS 4.0 8.2 · Assessor: [email protected]
SurveyKing before 1.13.0 contains a missing authorization vulnerability that allows unauthenticated attackers to download any stored file by id through GET /api/public/preview/{attachmentId}. Attackers who know or derive time-ordered snowflake file ids can bypass shared, owner, and project checks in FileServiceImpl.loadFile to read private survey attachments and respondent uploads.
CVE-2026-111646Read original ↗ (opens in a new tab) - NVD
CVE-2026-111645 — MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authen…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers can send PUT requests with arbitrary sort_data document ids to publish private drafts and reparent documents, or POST with arbitrary top_doc ids to inject documents.
CVE-2026-111645Read original ↗ (opens in a new tab) - NVD
CVE-2026-111644 — Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers to a…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers to access audit, diagnostics, data-check, scan-index and health routes under /api/ui lacking the get_current_user dependency. Attackers can read audit logs with login IPs, server logs and environment paths, delete episode rows, clear media-server mappings, and wipe audit history.
CVE-2026-111644Read original ↗ (opens in a new tab) - NVD
CVE-2026-111643 — Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to w…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpoint. Attackers can set the ipWhitelist key to their own /32 address, or alter trustedProxies and webhookApiKey, to access every protected endpoint as the administrator.
CVE-2026-111643Read original ↗ (opens in a new tab) - NVD
CVE-2026-111642 — FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privilege…
High · CVSS 4.0 8.7 · Assessor: [email protected]
FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privileged users to forge tokens impersonating the superuser. Attackers can register via the unauthenticated /api/v1/system/user/register endpoint, log in, and forge an HS256 token keeping their session_id but naming the superuser in user_name to gain superuser privileges.
CVE-2026-111642Read original ↗ (opens in a new tab) - NVD
CVE-2026-111641 — FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain ses…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange it for a JWT session to gain full administrative control.
CVE-2026-111641Read original ↗ (opens in a new tab) - NVD
CVE-2026-111640 — DooTask through 1.9.66 contains a missing authorization vulnerability in WebSocketDialog::checkDialog() that skips the membe…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
DooTask through 1.9.66 contains a missing authorization vulnerability in WebSocketDialog::checkDialog() that skips the membership check for dialogs with group_type 'okr'. Authenticated users can supply the dialog_id of OKR comment dialogs to msg__list, msg__one, or msg__send* endpoints to read and inject messages.
CVE-2026-111640Read original ↗ (opens in a new tab) - NVD
CVE-2026-111639 — bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows r…
High · CVSS 4.0 8.6 · Assessor: [email protected]
bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Attackers operating their own Google OAuth client can capture a victim's Google-signed ID token and replay it, since the aud claim is never checked, to obtain an authenticated session as the victim's Google-linked account.
CVE-2026-111639Read original ↗ (opens in a new tab) - NVD
CVE-2026-111638 — sshportal through 1.19.5 contains a missing authorization vulnerability in the management shell 'key show' command that allo…
High · CVSS 4.0 8.3 · Assessor: [email protected]
sshportal through 1.19.5 contains a missing authorization vulnerability in the management shell 'key show' command that allows authenticated non-admin users to obtain decrypted backend private SSH keys. Attackers can request predictable key names like 'default' or 'host' to retrieve private keys and connect directly to backend hosts, bypassing ACLs and session recording.
CVE-2026-111638Read original ↗ (opens in a new tab) - NVD
CVE-2026-111637 — NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounti…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction records via GET /api/fields/{resource}/{identifier}. Attackers can request transaction field classes like ns.entity-transaction with sequential ids to retrieve names, values, account ids, and descriptions without nexopos.read.transactions permission.
CVE-2026-111637Read original ↗ (opens in a new tab) - NVD
CVE-2026-111636 — OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to for…
Critical · CVSS 4.0 9.2 · Assessor: [email protected]
OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default app_secret. Attackers can sign an HMAC-SHA256 token for the seeded 'admin' user in 'tenant_demo' to gain full tenant administration, including stored model and channel credentials.
CVE-2026-111636Read original ↗ (opens in a new tab) - NVD
CVE-2026-111635 — Helical Insight through 7.0.0 contains a path traversal vulnerability that allows authenticated viewers to read files outsid…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Helical Insight through 7.0.0 contains a path traversal vulnerability that allows authenticated viewers to read files outside the solution directory via the path parameter of /getExternalResource. Attackers can supply parent-directory segments to read any readable file with an allowed extension such as js, json, or html, bypassing per-resource access control.
CVE-2026-111635Read original ↗ (opens in a new tab) - NVD
CVE-2026-111634 — Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL throug…
High · CVSS 4.0 8.6 · Assessor: [email protected]
Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL through unescaped report parameter values sent to /executeDatasource. Attackers can supply crafted Numeric or String placeholder values that bypass the broken SqlDetect guard to read unexposed tables and modify data in the report's data source.
CVE-2026-111634Read original ↗ (opens in a new tab) - NVD
CVE-2026-111633 — ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API…
High · CVSS 4.0 8.8 · Assessor: [email protected]
ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers can sign a token with the Name claim set to 'admin' to call ApiAuthorize endpoints, modifying articles and products and reading form submissions.
CVE-2026-111633Read original ↗ (opens in a new tab) - NVD
CVE-2026-111632 — Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated API users to create or mov…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated API users to create or move records into disallowed companies by supplying a foreign company_id. Attackers can submit create or update requests to plugin REST API endpoints such as partners, sales, or inventories to break multi-company data segregation.
CVE-2026-111632Read original ↗ (opens in a new tab) - NVD
CVE-2026-111631 — Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke extern…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manage_options users. Attackers can call dt_verify_external_connection with a chosen endpointId and url to send stored connection credentials to attacker-controlled servers, or abuse dt_begin_authorization to create connections.
CVE-2026-111631Read original ↗ (opens in a new tab) - NVD
CVE-2026-111630 — abp-next-admin 10.2.0 through 10.6.0 contains an insecure direct object reference vulnerability in the LINGYUN.Abp.AIManagem…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
abp-next-admin 10.2.0 through 10.6.0 contains an insecure direct object reference vulnerability in the LINGYUN.Abp.AIManagement module that allows authenticated users to access other users' AI chat conversations by supplying their ConversationId. Attackers holding the Chat permission can call ChatAppService.GetListAsync or SendMessageAsync with a victim's ConversationId GUID to read chat messages and inject messages into that conversation.
CVE-2026-111630Read original ↗ (opens in a new tab) - NVD
CVE-2026-111629 — IoTSharp through 3.6.1 contains an insecure direct object reference vulnerability that allows any authenticated user to read…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
IoTSharp through 3.6.1 contains an insecure direct object reference vulnerability that allows any authenticated user to read other tenants' data because Customers and Devices API handlers do not scope queries to the caller's tenant. Attackers can self-register through the anonymous AccountController.Create endpoint and supply other tenants' GUIDs to read customer contact details, device inventories and device attribute telemetry.
CVE-2026-111629Read original ↗ (opens in a new tab) - NVD
CVE-2026-111628 — 10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantia…
Low · CVSS 4.0 2.3 · Assessor: [email protected]
10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers can store a serialized PHP string as meta, which set_meta() in includes/utils.php unserializes on the destination site, storing attacker-defined objects whose impact depends on loaded gadget classes.
CVE-2026-111628Read original ↗ (opens in a new tab) - NVD
CVE-2026-111627 — HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform wr…
High · CVSS 4.0 8.6 · Assessor: [email protected]
HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform write actions while impersonating the protected ROOT_USER account. Attackers can log in via the loginas parameter and POST to /add/cron/, because the read-only flag is never checked, causing crond to run their commands as the protected administrator's system account.
CVE-2026-111627Read original ↗ (opens in a new tab) - NVD
CVE-2026-111626 — Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to a…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin roles to create administrator accounts, or POST /api/users to reset any user's password, gaining full control.
CVE-2026-111626Read original ↗ (opens in a new tab) - NVD
CVE-2026-111625 — 10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajax_push() that allows Contributor-level mu…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajax_push() that allows Contributor-level multisite users to publish posts on other network sites. Attackers can use the dt-push nonce with a chosen connection id and postStatus to create draft or published posts on sites they cannot access.
CVE-2026-111625Read original ↗ (opens in a new tab) - NVD
CVE-2026-111624 — Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unauthenticated clients to c…
Medium · CVSS 4.0 6.3 · Assessor: [email protected]
Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unauthenticated clients to connect to the backoffice PreviewHub and BackofficeHub SignalR hubs. Attackers can complete the SignalR negotiate step and receive refreshed notifications that disclose content keys, including unpublished content, and reveal editorial activity timing.
CVE-2026-111624Read original ↗ (opens in a new tab) - NVD
CVE-2026-111623 — Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows unauthenticated attacker…
Medium · CVSS 4.0 6.3 · Assessor: [email protected]
Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid device WebSocket tokens by requesting /api/device/ota with any MAC address. Attackers can open a victim device's WebSocket channel to read private role system prompts, write conversation history, consume LLM/STT/TTS credentials, and overwrite device metadata.
CVE-2026-111623Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.