THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
The complete recent NVD stream, including unscored entries. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,920 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUp to date · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-111633 — ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API…
High · CVSS 4.0 8.8 · Assessor: [email protected]
ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers can sign a token with the Name claim set to 'admin' to call ApiAuthorize endpoints, modifying articles and products and reading form submissions.
CVE-2026-111633Read original ↗ (opens in a new tab) - NVD
CVE-2026-111632 — Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated API users to create or mov…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated API users to create or move records into disallowed companies by supplying a foreign company_id. Attackers can submit create or update requests to plugin REST API endpoints such as partners, sales, or inventories to break multi-company data segregation.
CVE-2026-111632Read original ↗ (opens in a new tab) - NVD
CVE-2026-111631 — Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke extern…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manage_options users. Attackers can call dt_verify_external_connection with a chosen endpointId and url to send stored connection credentials to attacker-controlled servers, or abuse dt_begin_authorization to create connections.
CVE-2026-111631Read original ↗ (opens in a new tab) - NVD
CVE-2026-111630 — abp-next-admin 10.2.0 through 10.6.0 contains an insecure direct object reference vulnerability in the LINGYUN.Abp.AIManagem…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
abp-next-admin 10.2.0 through 10.6.0 contains an insecure direct object reference vulnerability in the LINGYUN.Abp.AIManagement module that allows authenticated users to access other users' AI chat conversations by supplying their ConversationId. Attackers holding the Chat permission can call ChatAppService.GetListAsync or SendMessageAsync with a victim's ConversationId GUID to read chat messages and inject messages into that conversation.
CVE-2026-111630Read original ↗ (opens in a new tab) - NVD
CVE-2026-111629 — IoTSharp through 3.6.1 contains an insecure direct object reference vulnerability that allows any authenticated user to read…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
IoTSharp through 3.6.1 contains an insecure direct object reference vulnerability that allows any authenticated user to read other tenants' data because Customers and Devices API handlers do not scope queries to the caller's tenant. Attackers can self-register through the anonymous AccountController.Create endpoint and supply other tenants' GUIDs to read customer contact details, device inventories and device attribute telemetry.
CVE-2026-111629Read original ↗ (opens in a new tab) - NVD
CVE-2026-111628 — 10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantia…
Low · CVSS 4.0 2.3 · Assessor: [email protected]
10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers can store a serialized PHP string as meta, which set_meta() in includes/utils.php unserializes on the destination site, storing attacker-defined objects whose impact depends on loaded gadget classes.
CVE-2026-111628Read original ↗ (opens in a new tab) - NVD
CVE-2026-111627 — HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform wr…
High · CVSS 4.0 8.6 · Assessor: [email protected]
HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform write actions while impersonating the protected ROOT_USER account. Attackers can log in via the loginas parameter and POST to /add/cron/, because the read-only flag is never checked, causing crond to run their commands as the protected administrator's system account.
CVE-2026-111627Read original ↗ (opens in a new tab) - NVD
CVE-2026-111626 — Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to a…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin roles to create administrator accounts, or POST /api/users to reset any user's password, gaining full control.
CVE-2026-111626Read original ↗ (opens in a new tab) - NVD
CVE-2026-111625 — 10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajax_push() that allows Contributor-level mu…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajax_push() that allows Contributor-level multisite users to publish posts on other network sites. Attackers can use the dt-push nonce with a chosen connection id and postStatus to create draft or published posts on sites they cannot access.
CVE-2026-111625Read original ↗ (opens in a new tab) - NVD
CVE-2026-111624 — Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unauthenticated clients to c…
Medium · CVSS 4.0 6.3 · Assessor: [email protected]
Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unauthenticated clients to connect to the backoffice PreviewHub and BackofficeHub SignalR hubs. Attackers can complete the SignalR negotiate step and receive refreshed notifications that disclose content keys, including unpublished content, and reveal editorial activity timing.
CVE-2026-111624Read original ↗ (opens in a new tab) - NVD
CVE-2026-111623 — Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows unauthenticated attacker…
Medium · CVSS 4.0 6.3 · Assessor: [email protected]
Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid device WebSocket tokens by requesting /api/device/ota with any MAC address. Attackers can open a victim device's WebSocket channel to read private role system prompts, write conversation history, consume LLM/STT/TTS credentials, and overwrite device metadata.
CVE-2026-111623Read original ↗ (opens in a new tab) - NVD
CVE-2026-111622 — smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers…
High · CVSS 4.0 7.6 · Assessor: [email protected]
smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an unvalidated redirectUri parameter. Attackers can send crafted /login links to users with active SSO sessions, then redeem stolen codes at /oauth2/access_token with any valid client credentials to obtain victims' access tokens.
CVE-2026-111622Read original ↗ (opens in a new tab) - NVD
CVE-2026-111621 — TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read othe…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/setting/{key}. Attackers can supply the 8-character form key from a public fill link to obtain the form write password, owner notification e-mail, and WeChat openIds.
CVE-2026-111621Read original ↗ (opens in a new tab) - NVD
CVE-2026-111620 — O2OA through 10.0.2-ce contains an authorization bypass vulnerability in x_processplatform_assemble_surface that allows auth…
Medium · CVSS 4.0 6.0 · Assessor: [email protected]
O2OA through 10.0.2-ce contains an authorization bypass vulnerability in x_processplatform_assemble_surface that allows authenticated users to download attachments from other works. ActionDownloadWithWork and ActionDownloadWithWorkStream never verify that the requested attachment id belongs to the referenced work or draft, so any visitable work or owned draft can be supplied. Attackers who know an attachment UUID can request it through jaxrs/attachment/download/{id}/work/{workId} to read documents attached to othe…
CVE-2026-111620Read original ↗ (opens in a new tab) - NVD
CVE-2026-111619 — FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privilege users to inject SQL…
High · CVSS 4.0 7.1 · Assessor: [email protected]
FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privilege users to inject SQL into ORDER BY clauses via the unvalidated asc parameter. Attackers can use blind boolean or time-based subqueries in dzz/pichome/library/filelist.php and dzz/collection/filelist.php to extract database rows including administrator credential hashes.
CVE-2026-111619Read original ↗ (opens in a new tab) - NVD
CVE-2026-111618 — CoAI (Chat Nio) through 4.0.0 contains an unauthenticated path traversal vulnerability in the generation and article archive…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
CoAI (Chat Nio) through 4.0.0 contains an unauthenticated path traversal vulnerability in the generation and article archive download endpoints via the hash query parameter. Attackers can supply ../ sequences in hash to download any readable .tar.gz or .zip file, including other users' generated archives.
CVE-2026-111618Read original ↗ (opens in a new tab) - NVD
CVE-2026-111617 — WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to connect to…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to connect to the /ws/ui/web/ and /ws/ui/actuator/ WebSocket endpoints because UiAutomationConsumer accepts every connection. Attackers can register an actuator with a client-supplied id to intercept other users' test-case payloads, receive broadcast step results, and spoof results and screen frames into victim sessions.
CVE-2026-111617Read original ↗ (opens in a new tab) - NVD
CVE-2026-111616 — Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site admin…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings. Attackers with the Administrators role on one site can request another site's entityId through their own alias to retrieve stored SMTPPassword and SMTPClientSecret values.
CVE-2026-111616Read original ↗ (opens in a new tab) - NVD
CVE-2026-111615 — Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants to rea…
High · CVSS 4.0 7.1 · Assessor: [email protected]
Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants to read other shops' buyer shipping addresses via the multishop OrderController getOrderAddr handler. Attackers can enumerate auto-increment orderAddrId values in GET /m/order/order_addr/{orderAddrId} requests to obtain consignee names, mobile numbers, addresses and post codes platform-wide.
CVE-2026-111615Read original ↗ (opens in a new tab) - NVD
CVE-2026-111614 — DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that al…
High · CVSS 4.0 7.1 · Assessor: [email protected]
DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read other users' datasources, snippets and dashboards by numeric id. Low-privileged attackers can enumerate auto-increment ids on the source, snippet and dashboard endpoints to retrieve serialized datasource host, port, username and cleartext passwords.
CVE-2026-111614Read original ↗ (opens in a new tab) - NVD
CVE-2026-111613 — AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrar…
High · CVSS 4.0 8.7 · Assessor: [email protected]
AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying jdbcUrl and jdbcDriverClass values to the data-dts /jobJdbcDatasource/test endpoint. Attackers can supply a MySQL JDBC URL with allowLoadLocalInfile=true pointing to an attacker-controlled server to read arbitrary files from the data-dts host.
CVE-2026-111613Read original ↗ (opens in a new tab) - NVD
CVE-2026-111612 — netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers t…
High · CVSS 4.0 8.7 · Assessor: [email protected]
netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint in ParserApi. Attackers can repeatedly call the endpoint and decrypt the encryptedAuth blob using the hard-coded AES key nfd_auth_key2026 to recover other users' cloud-drive cookies, tokens, or passwords.
CVE-2026-111612Read original ↗ (opens in a new tab) - NVD
CVE-2026-111611 — roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows authenticated…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows authenticated users to cancel or continue payment on other users' orders. Attackers can supply another user's order number to the pay cancel or continue endpoints to close pending orders or read course ids and prices.
CVE-2026-111611Read original ↗ (opens in a new tab) - NVD
CVE-2026-111610 — B3log Solo through 4.4.0 contains a missing authorization vulnerability in ArticleConsole that allows authenticated authors…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
B3log Solo through 4.4.0 contains a missing authorization vulnerability in ArticleConsole that allows authenticated authors to access other authors' articles by omitting per-author ownership checks. Attackers can query the console articles status endpoint to list other authors' drafts, probe draft content via the k parameter, and use push2rhy to push others' articles to the Rhythm community.
CVE-2026-111610Read original ↗ (opens in a new tab) - NVD
CVE-2026-111609 — PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or s…
Medium · CVSS 4.0 5.1 · Assessor: [email protected]
PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription ids. Attackers can enumerate sequential ids through editSubscription to view subscriber details and use updateSubscription to reassign subscriptions to their own journal, revoking victims' access.
CVE-2026-111609Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.