THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
Every cached source, newest first. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,988 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUp to date · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-111611 — roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows authenticated…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows authenticated users to cancel or continue payment on other users' orders. Attackers can supply another user's order number to the pay cancel or continue endpoints to close pending orders or read course ids and prices.
CVE-2026-111611Read original ↗ (opens in a new tab) - NVD
CVE-2026-111610 — B3log Solo through 4.4.0 contains a missing authorization vulnerability in ArticleConsole that allows authenticated authors…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
B3log Solo through 4.4.0 contains a missing authorization vulnerability in ArticleConsole that allows authenticated authors to access other authors' articles by omitting per-author ownership checks. Attackers can query the console articles status endpoint to list other authors' drafts, probe draft content via the k parameter, and use push2rhy to push others' articles to the Rhythm community.
CVE-2026-111610Read original ↗ (opens in a new tab) - NVD
CVE-2026-111609 — PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or s…
Medium · CVSS 4.0 5.1 · Assessor: [email protected]
PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription ids. Attackers can enumerate sequential ids through editSubscription to view subscriber details and use updateSubscription to reassign subscriptions to their own journal, revoking victims' access.
CVE-2026-111609Read original ↗ (opens in a new tab) - NVD
CVE-2026-111608 — Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to…
Low · CVSS 4.0 2.3 · Assessor: [email protected]
Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to delete other merchants' division receivers by exploiting an ownership check on the wrong column. Attackers holding ENT_DIVISION_RECEIVER_DELETE who own a receiver group whose id matches a victim's receiver id can delete the victim's profit-sharing receiver.
CVE-2026-111608Read original ↗ (opens in a new tab) - NVD
CVE-2026-111607 — Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to…
High · CVSS 4.0 7.1 · Assessor: [email protected]
Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying a victim infoId to MchPayInterfaceConfigController.saveOrUpdate. Attackers holding the default ENT_MCH_PAY_CONFIG_ADD permission can replace signing keys, certificates, and fee rates to break or redirect the victim merchant's payment processing.
CVE-2026-111607Read original ↗ (opens in a new tab) - NVD
CVE-2026-111606 — Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arb…
High · CVSS 4.0 8.6 · Assessor: [email protected]
Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person, then use login or password recovery to take over the victim account.
CVE-2026-111606Read original ↗ (opens in a new tab) - NVD
CVE-2026-111605 — Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace…
High · CVSS 4.0 8.6 · Assessor: [email protected]
Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other workspaces by supplying foreign SSH asset ids. Attackers with SSH file permissions in any workspace can call download, upload, read_file_data.json, update_file_data.json, delete.json, rename.json and new_file_folder.json endpoints to read, modify and delete files on other workspaces' SSH hosts.
CVE-2026-111605Read original ↗ (opens in a new tab) - NVD
CVE-2026-111604 — eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or…
Medium · CVSS 4.0 5.1 · Assessor: [email protected]
eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to /api/users with target user ids to disable, reassign, alter, or delete accounts in other departments.
CVE-2026-111604Read original ↗ (opens in a new tab) - NVD
CVE-2026-111603 — PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated student…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated students to access department-restricted courses by omitting the department visibility check. Attackers can enumerate sequential course and attachment IDs via the course details and attachment download endpoints to obtain course structure and attachment files from other departments.
CVE-2026-111603Read original ↗ (opens in a new tab) - NVD
CVE-2026-111392 — SGLang through 0.5.21 trusts caller-supplied mm_hashes values as the multimodal prefix-cache key, allowing remote attackers…
Medium · CVSS 4.0 6.3 · Assessor: [email protected]
SGLang through 0.5.21 trusts caller-supplied mm_hashes values as the multimodal prefix-cache key, allowing remote attackers to poison cached KV entries across requests. Attackers can send a different image under a known or predicted hash via /generate to disclose another request's image content or corrupt victims' responses.
CVE-2026-111392Read original ↗ (opens in a new tab) - NVD
CVE-2026-109839 — IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to bypass security restrictions due to a missing initiali…
Low · CVSS 3.1 3.1 · Assessor: [email protected]
IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to bypass security restrictions due to a missing initialization vector in the cryptographic algorithm.
CVE-2026-109839Read original ↗ (opens in a new tab) - NVD
CVE-2026-109838 — IBM Db2 Genius Hub 1.0 could allow a local attacker to obtain sensitive information due to improper verification of cryptogr…
Medium · CVSS 3.1 5.1 · Assessor: [email protected]
IBM Db2 Genius Hub 1.0 could allow a local attacker to obtain sensitive information due to improper verification of cryptographic signature.
CVE-2026-109838Read original ↗ (opens in a new tab) - NVD
CVE-2026-109588 — Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the…
Critical · CVSS 4.0 9.3 · Assessor: ff89ba41-3aa1-4d27-914a-91399e9639e5
Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 (Armv8-R AArch64) MPU port might allow, under certain conditions, an unprivileged task on MPU-enabled builds to read or write privileged kernel memory beyond the validated buffer window, via a stream buffer system call. To remediate this issue, users should upgrade to version V11.3.2 or later.
CVE-2026-109588Read original ↗ (opens in a new tab) - NVD
CVE-2026-109587 — Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1 might allow…
Critical · CVSS 4.0 9.3 · Assessor: ff89ba41-3aa1-4d27-914a-91399e9639e5
Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1 might allow an unprivileged task on MPU-enabled builds to read and write privileged kernel memory outside the regions assigned to it, via a buffer argument passed to an MPU system call. To remediate this issue, users should upgrade to version V11.3.2 or later.
CVE-2026-109587Read original ↗ (opens in a new tab) - NVD
CVE-2026-109461 — Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose i…
Medium · CVSS 3.1 5.9 · Assessor: [email protected]
Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.
CVE-2026-109461Read original ↗ (opens in a new tab) - NVD
CVE-2026-102552 — Improper verification of the source of a communication channel in the DNS resolver in Amazon FreeRTOS-Plus-TCP before V4.4.2…
High · CVSS 4.0 8.2 · Assessor: ff89ba41-3aa1-4d27-914a-91399e9639e5
Improper verification of the source of a communication channel in the DNS resolver in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow remote third-party to insert a chosen address into the device's DNS cache via a forged DNS reply. To remediate this issue, users should upgrade to version V4.4.2 and enable ipconfigDNS_CHECK_REPLY_SOURCE_IP.
CVE-2026-102552Read original ↗ (opens in a new tab) - NVD
CVE-2026-102551 — Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-P…
Critical · CVSS 4.0 9.2 · Assessor: ff89ba41-3aa1-4d27-914a-91399e9639e5
Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow a remote third-party to influence an endpoint's IPv6 default gateway, on-link prefix, and address configuration via a crafted Router Advertisement. To remediate this issue, users should upgrade to version V4.4.2.
CVE-2026-102551Read original ↗ (opens in a new tab) - NVD
CVE-2026-97380 — MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3,…
High · CVSS 3.1 8.8 · Assessor: [email protected]
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor privileges. A low-privileged attacker who can name another account can exploit this authorization error to set that account's password. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
CVE-2026-97380Read original ↗ (opens in a new tab) - NVD
CVE-2026-92262 — MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3,…
Critical · CVSS 3.1 9.9 · Assessor: [email protected]
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under their legacy unencoded name and cause crashes, data corruption, data exfiltration, or remote code execution. This issue i…
CVE-2026-92262Read original ↗ (opens in a new tab) - NVD
CVE-2026-86047 — MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3,…
High · CVSS 3.1 7.7 · Assessor: [email protected]
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL co…
CVE-2026-86047Read original ↗ (opens in a new tab) - NVD
CVE-2026-86009 — Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain mana…
High · CVSS 4.0 8.2 · Assessor: [email protected]
Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator enables spoofing for another hosted domain and can send emails that are authenticated with DKIM/SPF for domains they should not be able to. This vulnerability is addressed by f05aeb8322e2f61096af6b089d61ba6f40587d96.
CVE-2026-86009Read original ↗ (opens in a new tab) - NVD
CVE-2026-86008 — Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain ma…
High · CVSS 3.1 7.2 · Assessor: [email protected]
Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain manager targeting an administrative account or another domain manager with greater privileges can reset passwords or obtain tokens for that account. This authorization failure allows a domain manager to take over a higher-privileged account and exercise that account's permissions. This vulnerability is addressed by commit 8577c929b4ade04d3cd4210cf036601abd793556.
CVE-2026-86008Read original ↗ (opens in a new tab) - NVD
CVE-2026-85985 — MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3,…
Medium · CVSS 3.1 5.4 · Assessor: [email protected]
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file() are affected because each does not enforce FILE privilege or the secure_file_priv setting. A low-privileged attacker can trigger the issue by calling a CONNECT file-access UDF with a filesystem path, then invoke a CONNECT file-access UDF to access a filesystem path and…
CVE-2026-85985Read original ↗ (opens in a new tab) - NVD
CVE-2026-85748 — MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is…
Critical · CVSS 3.1 9.9 · Assessor: [email protected]
MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYS_REFCURSORs and then fetch one to trigger a use-after-free that can enable remote code execution when combined with another vulnerability. This issue is fixed in versions 12.3.3 and 13.0.2.
CVE-2026-85748Read original ↗ (opens in a new tab) - NVD
CVE-2026-85746 — MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3,…
Critical · CVSS 3.1 9.9 · Assessor: [email protected]
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This…
CVE-2026-85746Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.