PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

The complete recent NVD stream, including unscored entries. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

16,920 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  1. NVD

    CVE-2026-46472 — An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_…

    High · CVSS 3.1 7.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_chnl function may read past the end of a global array, potentially leading to information disclosure.

    CVE-2026-46472
    Read original (opens in a new tab)
  2. NVD

    CVE-2026-46471 — An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_…

    Medium · CVSS 3.1 5.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_uuid function may read past the end of a heap-allocated buffer, allowing an attacker to disclose heap memory contents.

    CVE-2026-46471
    Read original (opens in a new tab)
  3. NVD

    CVE-2026-44977 — countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/sta…

    Critical · CVSS 3.1 9.0 · Assessor: [email protected]

    countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use uploadFeedbackFile to store attacker-controlled active content while trusting the supplied MIME type. plugins/star-rating/frontend/app.js publicly serves the stored content from feedback/preview/ with the attacker-influenced Content-Type, so a global administrator who opens the preview executes the payload in the Countly…

    CVE-2026-44977
    Read original (opens in a new tab)
  4. NVD

    CVE-2026-42270 — countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating…

    High · CVSS 3.1 7.5 · Assessor: [email protected]

    countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs storage backend that call getStream and pipe filesystem streams to HTTP responses without an error listener. An unauthenticated request containing a URL-encoded dot can make createReadStream open a directory, emit an asynchronous EISDIR error, and terminate the Node.js process as an unh…

    CVE-2026-42270
    Read original (opens in a new tab)
  5. NVD

    CVE-2026-42269 — countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, the authent…

    High · CVSS 3.1 8.1 · Assessor: [email protected]

    countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, the authenticated data-migration deletion route in plugins/data_migration/api/api.js passes the user-controlled exportid to clean_up_data without path validation. plugins/data_migration/api/data_migration_helper.js concatenates that identifier into a path resolved outside the intended import directory and calls remove recursively, allowing an application administrator or user with migration permission t…

    CVE-2026-42269
    Read original (opens in a new tab)
  6. NVD

    CVE-2026-41582 — countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public imag…

    High · CVSS 3.1 7.5 · Assessor: [email protected]

    countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/dashboards/frontend/app.js concatenate attacker-controlled wildcard paths without containment validation. On deployments using the local filesystem backend, an unauthenticated request can traverse outside the intended asset directories and reach getStats or getStream in api/utils/c…

    CVE-2026-41582
    Read original (opens in a new tab)
  8. NVD

    CVE-2026-111581 — A flaw was found in libblockdev. The bd_fs_ntfs_set_label() and bd_fs_vfat_set_label() functions pass caller-supplied label…

    Low · CVSS 3.1 3.3 · Assessor: [email protected]

    A flaw was found in libblockdev. The bd_fs_ntfs_set_label() and bd_fs_vfat_set_label() functions pass caller-supplied label values as bare positional arguments to the ntfslabel and fatlabel utilities without end-of-options separators or input validation for values beginning with a dash. This allows a label starting with '-' to be interpreted as a command-line flag by the spawned tool, potentially bypassing safety checks or causing unintended operations. This is reachable by unprivileged local users through the udi…

    CVE-2026-111581
    Read original (opens in a new tab)
  9. NVD

    CVE-2026-102941 — The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to 0.0.0-2…

    High · CVSS 3.1 7.5 · Assessor: [email protected]

    The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to 0.0.0-20260724235538-61af6e1e6971, parser.IsSafeURL in parser/parser.go slices url[:nPath] before the len(url) >= nPath guard. A short destination causes a slice-bounds panic when the loop reaches a relative-path prefix for which len(url) < nPath and cap(url) < nPath. The one-byte destination / is an explicit non-panic counterexample because it matches the first valid path and returns before a longe…

    CVE-2026-102941
    Read original (opens in a new tab)
  10. NVD

    CVE-2026-102923 — SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, SparkyFitnessServer/serv…

    Medium · CVSS 3.1 5.4 · Assessor: [email protected]

    SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, SparkyFitnessServer/services/chatService.ts and SparkyFitnessServer/services/labelScanService.ts do not validate destinations supplied in custom AI service settings. An authenticated user saves a custom AI service URL and invokes an affected AI flow. The user can save a custom AI service URL and trigger an outbound request. Successful exploitation can send server-side POST requests with a controlled bearer value, pr…

    CVE-2026-102923
    Read original (opens in a new tab)
  11. NVD

    CVE-2026-97851 — The storage status-change REST service allows location records still associated with DICOM instances to be changed to deleti…

    High · CVSS 4.0 8.8 · Assessor: [email protected]

    The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a location to TO_DELETE causes PurgeStorageScheduler to delete the referenced object from storage even though the corresponding instance record remains in the database.

    CVE-2026-97851
    Read original (opens in a new tab)
  14. NVD

    CVE-2026-88755 — Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository'…

    High · CVSS 3.1 7.8 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary code via opening a crafted repository.

    CVE-2026-88755
    Read original (opens in a new tab)
  15. NVD

    CVE-2026-111728 — Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper authorization, allowing un…

    Medium · CVSS 4.0 5.3 · Assessor: [email protected]

    Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper authorization, allowing unauthenticated LAN or Tailnet clients to bypass the privileged mediastream settings guard by setting transcodeHwAccel to custom and supplying attacker-controlled decodeFlags and encodeFlags via the transcodeHwAccelCustomSettings field, which are appended verbatim to the ffmpeg argument vector. Attackers can trigger execution via the mediastream request and HLS playlist endpoints to achieve arb…

    CVE-2026-111728
    Read original (opens in a new tab)
  18. NVD

    CVE-2026-106705 — ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint…

    High · CVSS 3.1 8.8 · Assessor: [email protected]

    ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu (RoleController.updateRoleMenu) authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither validates the granted menu set nor prevents a caller from modifying its own role. A logged-in non-admin user whose role holds the delegated `roles:edit` permission can submit its own role id together with an arbitrary li…

    CVE-2026-106705
    Read original (opens in a new tab)
  19. NVD

    CVE-2026-105667 — In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending app…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this.

    CVE-2026-105667
    Read original (opens in a new tab)
  20. NVD

    CVE-2026-105279 — In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use…

    Critical · CVSS 4.0 9.3 · Assessor: [email protected]

    In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and retrieve patient information and medical images. It can also use C-STORE to file fabricated study content under an existing patient identity.

    CVE-2026-105279
    Read original (opens in a new tab)
  23. NVD

    CVE-2025-52097 — Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary code…

    Medium · CVSS 3.1 5.4 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary code via reflecting un-sanitized input from query string parameters directly into the HTML response without proper output encoding

    CVE-2025-52097
    Read original (opens in a new tab)
  24. NVD

    CVE-2026-97858 — An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account,…

    Medium · CVSS 4.0 6.9 · Assessor: [email protected]

    An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID.

    CVE-2026-97858
    Read original (opens in a new tab)
  25. NVD

    CVE-2026-97470 — The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site…

    Medium · CVSS 3.1 6.4 · Assessor: [email protected]

    The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer Role in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires WooCommerc…

    CVE-2026-97470
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.