PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

The complete recent NVD stream, including unscored entries. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

16,920 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  1. NVD

    CVE-2026-111608 — Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to…

    Low · CVSS 4.0 2.3 · Assessor: [email protected]

    Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to delete other merchants' division receivers by exploiting an ownership check on the wrong column. Attackers holding ENT_DIVISION_RECEIVER_DELETE who own a receiver group whose id matches a victim's receiver id can delete the victim's profit-sharing receiver.

    CVE-2026-111608
    Read original (opens in a new tab)
  2. NVD

    CVE-2026-111607 — Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to…

    High · CVSS 4.0 7.1 · Assessor: [email protected]

    Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying a victim infoId to MchPayInterfaceConfigController.saveOrUpdate. Attackers holding the default ENT_MCH_PAY_CONFIG_ADD permission can replace signing keys, certificates, and fee rates to break or redirect the victim merchant's payment processing.

    CVE-2026-111607
    Read original (opens in a new tab)
  3. NVD

    CVE-2026-111606 — Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arb…

    High · CVSS 4.0 8.6 · Assessor: [email protected]

    Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person, then use login or password recovery to take over the victim account.

    CVE-2026-111606
    Read original (opens in a new tab)
  4. NVD

    CVE-2026-111605 — Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace…

    High · CVSS 4.0 8.6 · Assessor: [email protected]

    Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other workspaces by supplying foreign SSH asset ids. Attackers with SSH file permissions in any workspace can call download, upload, read_file_data.json, update_file_data.json, delete.json, rename.json and new_file_folder.json endpoints to read, modify and delete files on other workspaces' SSH hosts.

    CVE-2026-111605
    Read original (opens in a new tab)
  5. NVD

    CVE-2026-111604 — eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or…

    Medium · CVSS 4.0 5.1 · Assessor: [email protected]

    eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to /api/users with target user ids to disable, reassign, alter, or delete accounts in other departments.

    CVE-2026-111604
    Read original (opens in a new tab)
  6. NVD

    CVE-2026-111603 — PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated student…

    Medium · CVSS 4.0 5.3 · Assessor: [email protected]

    PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated students to access department-restricted courses by omitting the department visibility check. Attackers can enumerate sequential course and attachment IDs via the course details and attachment download endpoints to obtain course structure and attachment files from other departments.

    CVE-2026-111603
    Read original (opens in a new tab)
  7. NVD

    CVE-2026-111392 — SGLang through 0.5.21 trusts caller-supplied mm_hashes values as the multimodal prefix-cache key, allowing remote attackers…

    Medium · CVSS 4.0 6.3 · Assessor: [email protected]

    SGLang through 0.5.21 trusts caller-supplied mm_hashes values as the multimodal prefix-cache key, allowing remote attackers to poison cached KV entries across requests. Attackers can send a different image under a known or predicted hash via /generate to disclose another request's image content or corrupt victims' responses.

    CVE-2026-111392
    Read original (opens in a new tab)
  10. NVD

    CVE-2026-109588 — Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the…

    Critical · CVSS 4.0 9.3 · Assessor: ff89ba41-3aa1-4d27-914a-91399e9639e5

    Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 (Armv8-R AArch64) MPU port might allow, under certain conditions, an unprivileged task on MPU-enabled builds to read or write privileged kernel memory beyond the validated buffer window, via a stream buffer system call. To remediate this issue, users should upgrade to version V11.3.2 or later.

    CVE-2026-109588
    Read original (opens in a new tab)
  11. NVD

    CVE-2026-109587 — Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1 might allow…

    Critical · CVSS 4.0 9.3 · Assessor: ff89ba41-3aa1-4d27-914a-91399e9639e5

    Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1 might allow an unprivileged task on MPU-enabled builds to read and write privileged kernel memory outside the regions assigned to it, via a buffer argument passed to an MPU system call. To remediate this issue, users should upgrade to version V11.3.2 or later.

    CVE-2026-109587
    Read original (opens in a new tab)
  13. NVD

    CVE-2026-102552 — Improper verification of the source of a communication channel in the DNS resolver in Amazon FreeRTOS-Plus-TCP before V4.4.2…

    High · CVSS 4.0 8.2 · Assessor: ff89ba41-3aa1-4d27-914a-91399e9639e5

    Improper verification of the source of a communication channel in the DNS resolver in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow remote third-party to insert a chosen address into the device's DNS cache via a forged DNS reply. To remediate this issue, users should upgrade to version V4.4.2 and enable ipconfigDNS_CHECK_REPLY_SOURCE_IP.

    CVE-2026-102552
    Read original (opens in a new tab)
  14. NVD

    CVE-2026-102551 — Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-P…

    Critical · CVSS 4.0 9.2 · Assessor: ff89ba41-3aa1-4d27-914a-91399e9639e5

    Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow a remote third-party to influence an endpoint's IPv6 default gateway, on-link prefix, and address configuration via a crafted Router Advertisement. To remediate this issue, users should upgrade to version V4.4.2.

    CVE-2026-102551
    Read original (opens in a new tab)
  15. NVD

    CVE-2026-97380 — MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3,…

    High · CVSS 3.1 8.8 · Assessor: [email protected]

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor privileges. A low-privileged attacker who can name another account can exploit this authorization error to set that account's password. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

    CVE-2026-97380
    Read original (opens in a new tab)
  16. NVD

    CVE-2026-92262 — MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3,…

    Critical · CVSS 3.1 9.9 · Assessor: [email protected]

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under their legacy unencoded name and cause crashes, data corruption, data exfiltration, or remote code execution. This issue i…

    CVE-2026-92262
    Read original (opens in a new tab)
  17. NVD

    CVE-2026-86047 — MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3,…

    High · CVSS 3.1 7.7 · Assessor: [email protected]

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL co…

    CVE-2026-86047
    Read original (opens in a new tab)
  18. NVD

    CVE-2026-86009 — Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain mana…

    High · CVSS 4.0 8.2 · Assessor: [email protected]

    Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator enables spoofing for another hosted domain and can send emails that are authenticated with DKIM/SPF for domains they should not be able to. This vulnerability is addressed by f05aeb8322e2f61096af6b089d61ba6f40587d96.

    CVE-2026-86009
    Read original (opens in a new tab)
  19. NVD

    CVE-2026-86008 — Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain ma…

    High · CVSS 3.1 7.2 · Assessor: [email protected]

    Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain manager targeting an administrative account or another domain manager with greater privileges can reset passwords or obtain tokens for that account. This authorization failure allows a domain manager to take over a higher-privileged account and exercise that account's permissions. This vulnerability is addressed by commit 8577c929b4ade04d3cd4210cf036601abd793556.

    CVE-2026-86008
    Read original (opens in a new tab)
  20. NVD

    CVE-2026-85985 — MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3,…

    Medium · CVSS 3.1 5.4 · Assessor: [email protected]

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file() are affected because each does not enforce FILE privilege or the secure_file_priv setting. A low-privileged attacker can trigger the issue by calling a CONNECT file-access UDF with a filesystem path, then invoke a CONNECT file-access UDF to access a filesystem path and…

    CVE-2026-85985
    Read original (opens in a new tab)
  21. NVD

    CVE-2026-85748 — MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is…

    Critical · CVSS 3.1 9.9 · Assessor: [email protected]

    MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYS_REFCURSORs and then fetch one to trigger a use-after-free that can enable remote code execution when combined with another vulnerability. This issue is fixed in versions 12.3.3 and 13.0.2.

    CVE-2026-85748
    Read original (opens in a new tab)
  22. NVD

    CVE-2026-85746 — MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3,…

    Critical · CVSS 3.1 9.9 · Assessor: [email protected]

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This…

    CVE-2026-85746
    Read original (opens in a new tab)
  23. NVD

    CVE-2026-85745 — MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3,…

    Medium · CVSS 3.1 4.3 · Assessor: [email protected]

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_Area reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the multi-polygon parser advances past a nested geometry header without first verifying enough input remains. A low-privileged remote attacker can supply malformed spatial data to disclose memory useful for bypassing ASLR as part of a multi-vulnerability chain. This issue is fixed in v…

    CVE-2026-85745
    Read original (opens in a new tab)
  24. NVD

    CVE-2026-77474 — destructive_command_guard (dcg) is a command-line safety tool that blocks destructive shell commands before AI coding agents…

    High · CVSS 3.1 7.1 · Assessor: [email protected]

    destructive_command_guard (dcg) is a command-line safety tool that blocks destructive shell commands before AI coding agents run them. Prior to 0.6.6, nested or unclosed substitutions are recursively rescanned after an inner scan returns unterminated, producing exponential-time work. The affected scanners are reached through split_command_segments in src/packs/mod.rs. a destructive command followed by nested or unclosed $( or $(( sequences. nested or unclosed $( and $(( sequences cause repeated rescanning of the r…

    CVE-2026-77474
    Read original (opens in a new tab)
  25. NVD

    CVE-2026-62362 — PeerBanHelper automatically blocks unwanted, leeching, and abnormal BitTorrent peers using customizable and cloud rules. Fro…

    Medium · CVSS 3.1 4.9 · Assessor: [email protected]

    PeerBanHelper automatically blocks unwanted, leeching, and abnormal BitTorrent peers using customizable and cloud rules. From 5.0.0 until 9.3.15, the /api/statistic/analysis/field endpoint accepts a crafted field query parameter from an authenticated user and passes it to countField or sumField. The mapField() method forwards unrecognized field names without sanitization, so unrecognized field names are interpolated into SQL through ${field} across the SQLite, MySQL, and PostgreSQL mappers. Successful exploitation…

    CVE-2026-62362
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.