PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

Every cached source, newest first. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

16,988 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  1. NVD

    CVE-2026-54657 — Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.0.0 until 1.27.2, 1.28.2, and 1.…

    Medium · CVSS 3.1 6.5 · Assessor: [email protected]

    Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.0.0 until 1.27.2, 1.28.2, and 1.29.0, the POST search endpoints /zaken/api/v1/zaken/_zoek and /documenten/api/v1/enkelvoudiginformatieobjecten/_zoek do not filter result querysets according to the authorizations associated with the request token. A caller with a valid zaken.lezen or documenten.lezen token can therefore retrieve case or document metadata outside the token's authorized types or confidentiality levels. Documen…

    CVE-2026-54657
    Read original (opens in a new tab)
  2. NVD

    CVE-2026-48741 — libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values,…

    High · CVSS 3.1 7.5 · Assessor: [email protected]

    libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, alternateArrayAccess in src/mms/iso_mms/server/mms_read_service.c does not validate an alternate-access sub-array range when numberOfElements is greater than zero. An out-of-range MmsValue_getElement call returns NULL, and the sub-array branch passes that value to MmsValue_isDeletable, causing a NULL pointer dereference. A remote MMS Read request can therefore c…

    CVE-2026-48741
    Read original (opens in a new tab)
  3. NVD

    CVE-2026-48503 — libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values,…

    High · CVSS 3.1 7.5 · Assessor: [email protected]

    libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, the MMS file service in src/mms/iso_mms/server/mms_file_service.c accepts an out-of-range initialPosition in fileOpen and stores it in the file-read state. The fileRead path then subtracts the larger read position from the file size using unsigned arithmetic and fails to limit the response to the actual FileSystem_readFile return value. The oversized response ca…

    CVE-2026-48503
    Read original (opens in a new tab)
  4. NVD

    CVE-2026-46472 — An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_…

    High · CVSS 3.1 7.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_chnl function may read past the end of a global array, potentially leading to information disclosure.

    CVE-2026-46472
    Read original (opens in a new tab)
  5. NVD

    CVE-2026-46471 — An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_…

    Medium · CVSS 3.1 5.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_uuid function may read past the end of a heap-allocated buffer, allowing an attacker to disclose heap memory contents.

    CVE-2026-46471
    Read original (opens in a new tab)
  6. NVD

    CVE-2026-44977 — countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/sta…

    Critical · CVSS 3.1 9.0 · Assessor: [email protected]

    countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use uploadFeedbackFile to store attacker-controlled active content while trusting the supplied MIME type. plugins/star-rating/frontend/app.js publicly serves the stored content from feedback/preview/ with the attacker-influenced Content-Type, so a global administrator who opens the preview executes the payload in the Countly…

    CVE-2026-44977
    Read original (opens in a new tab)
  7. NVD

    CVE-2026-42270 — countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating…

    High · CVSS 3.1 7.5 · Assessor: [email protected]

    countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs storage backend that call getStream and pipe filesystem streams to HTTP responses without an error listener. An unauthenticated request containing a URL-encoded dot can make createReadStream open a directory, emit an asynchronous EISDIR error, and terminate the Node.js process as an unh…

    CVE-2026-42270
    Read original (opens in a new tab)
  8. NVD

    CVE-2026-42269 — countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, the authent…

    High · CVSS 3.1 8.1 · Assessor: [email protected]

    countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, the authenticated data-migration deletion route in plugins/data_migration/api/api.js passes the user-controlled exportid to clean_up_data without path validation. plugins/data_migration/api/data_migration_helper.js concatenates that identifier into a path resolved outside the intended import directory and calls remove recursively, allowing an application administrator or user with migration permission t…

    CVE-2026-42269
    Read original (opens in a new tab)
  9. NVD

    CVE-2026-41582 — countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public imag…

    High · CVSS 3.1 7.5 · Assessor: [email protected]

    countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/dashboards/frontend/app.js concatenate attacker-controlled wildcard paths without containment validation. On deployments using the local filesystem backend, an unauthenticated request can traverse outside the intended asset directories and reach getStats or getStream in api/utils/c…

    CVE-2026-41582
    Read original (opens in a new tab)
  11. NVD

    CVE-2026-111581 — A flaw was found in libblockdev. The bd_fs_ntfs_set_label() and bd_fs_vfat_set_label() functions pass caller-supplied label…

    Low · CVSS 3.1 3.3 · Assessor: [email protected]

    A flaw was found in libblockdev. The bd_fs_ntfs_set_label() and bd_fs_vfat_set_label() functions pass caller-supplied label values as bare positional arguments to the ntfslabel and fatlabel utilities without end-of-options separators or input validation for values beginning with a dash. This allows a label starting with '-' to be interpreted as a command-line flag by the spawned tool, potentially bypassing safety checks or causing unintended operations. This is reachable by unprivileged local users through the udi…

    CVE-2026-111581
    Read original (opens in a new tab)
  12. NVD

    CVE-2026-102941 — The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to 0.0.0-2…

    High · CVSS 3.1 7.5 · Assessor: [email protected]

    The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to 0.0.0-20260724235538-61af6e1e6971, parser.IsSafeURL in parser/parser.go slices url[:nPath] before the len(url) >= nPath guard. A short destination causes a slice-bounds panic when the loop reaches a relative-path prefix for which len(url) < nPath and cap(url) < nPath. The one-byte destination / is an explicit non-panic counterexample because it matches the first valid path and returns before a longe…

    CVE-2026-102941
    Read original (opens in a new tab)
  13. NVD

    CVE-2026-102923 — SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, SparkyFitnessServer/serv…

    Medium · CVSS 3.1 5.4 · Assessor: [email protected]

    SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, SparkyFitnessServer/services/chatService.ts and SparkyFitnessServer/services/labelScanService.ts do not validate destinations supplied in custom AI service settings. An authenticated user saves a custom AI service URL and invokes an affected AI flow. The user can save a custom AI service URL and trigger an outbound request. Successful exploitation can send server-side POST requests with a controlled bearer value, pr…

    CVE-2026-102923
    Read original (opens in a new tab)
  14. NVD

    CVE-2026-97851 — The storage status-change REST service allows location records still associated with DICOM instances to be changed to deleti…

    High · CVSS 4.0 8.8 · Assessor: [email protected]

    The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a location to TO_DELETE causes PurgeStorageScheduler to delete the referenced object from storage even though the corresponding instance record remains in the database.

    CVE-2026-97851
    Read original (opens in a new tab)
  17. NVD

    CVE-2026-88755 — Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository'…

    High · CVSS 3.1 7.8 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary code via opening a crafted repository.

    CVE-2026-88755
    Read original (opens in a new tab)
  18. NVD

    CVE-2026-111728 — Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper authorization, allowing un…

    Medium · CVSS 4.0 5.3 · Assessor: [email protected]

    Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper authorization, allowing unauthenticated LAN or Tailnet clients to bypass the privileged mediastream settings guard by setting transcodeHwAccel to custom and supplying attacker-controlled decodeFlags and encodeFlags via the transcodeHwAccelCustomSettings field, which are appended verbatim to the ffmpeg argument vector. Attackers can trigger execution via the mediastream request and HLS playlist endpoints to achieve arb…

    CVE-2026-111728
    Read original (opens in a new tab)
  21. NVD

    CVE-2026-106705 — ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint…

    High · CVSS 3.1 8.8 · Assessor: [email protected]

    ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu (RoleController.updateRoleMenu) authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither validates the granted menu set nor prevents a caller from modifying its own role. A logged-in non-admin user whose role holds the delegated `roles:edit` permission can submit its own role id together with an arbitrary li…

    CVE-2026-106705
    Read original (opens in a new tab)
  22. NVD

    CVE-2026-105667 — In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending app…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this.

    CVE-2026-105667
    Read original (opens in a new tab)
  23. NVD

    CVE-2026-105279 — In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use…

    Critical · CVSS 4.0 9.3 · Assessor: [email protected]

    In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and retrieve patient information and medical images. It can also use C-STORE to file fabricated study content under an existing patient identity.

    CVE-2026-105279
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.