PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

The complete recent NVD stream, including unscored entries. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

16,871 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  1. NVD

    CVE-2026-111237 — A weakness has been identified in Ultralytics FastSAM up to b4ed20c2fed75eadc5aa7d8b09fedd137b873b52. This affects the funct…

    Medium · CVSS 4.0 4.8 · Assessor: [email protected]

    A weakness has been identified in Ultralytics FastSAM up to b4ed20c2fed75eadc5aa7d8b09fedd137b873b52. This affects the function session.get_modelmeta.custom_metadata_map of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. This manipulation of the argument imgsz/names/kpt_shape causes improper neutralization of directives in dynamically evaluated code. The attack requires local access. This product uses a rolling release model to deliver continuous updates. As a result, specific ve…

    CVE-2026-111237
    Read original (opens in a new tab)
  2. NVD

    CVE-2026-111212 — A security flaw has been discovered in ImprintLab Medical-SAM-Adapter 0.1.0-alpha/0.1.0. Affected by this issue is the funct…

    Low · CVSS 4.0 0.9 · Assessor: [email protected]

    A security flaw has been discovered in ImprintLab Medical-SAM-Adapter 0.1.0-alpha/0.1.0. Affected by this issue is the function session.get_modelmeta.custom_metadata_map of the file models/MobileSAMv2/ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. The manipulation of the argument imgsz/names/kpt_shape results in improper neutralization of directives in dynamically evaluated code. The attack requires a local approach. The exploit has been released to the public and may be used for attacks…

    CVE-2026-111212
    Read original (opens in a new tab)
  3. NVD

    CVE-2026-109813 — A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products…

    High · CVSS 4.0 8.6 · Assessor: [email protected]

    A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidentiality and integrity of communications.

    CVE-2026-109813
    Read original (opens in a new tab)
  4. NVD

    CVE-2026-109812 — A missing authorization vulnerability exists in the internal API `/api/v1/secrets/` of some of Moxa's industrial computing p…

    Medium · CVSS 4.0 6.9 · Assessor: [email protected]

    A missing authorization vulnerability exists in the internal API `/api/v1/secrets/` of some of Moxa's industrial computing products. A low-privileged authenticated attacker with adjacent network access could exploit this vulnerability to access sensitive information, potentially resulting in the disclosure of confidential data, including cryptographic key material.

    CVE-2026-109812
    Read original (opens in a new tab)
  7. NVD

    CVE-2026-100159 — The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to…

    Medium · CVSS 3.1 4.8 · Assessor: [email protected]

    The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ays_popup_get_user_ip() function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only with sanitize_text_field() (which does not strip the bracket, quote, space, or '=' characters used by shortcode syntax), substituting the value into a popup body wherever the %%user_ip_address%% token appears (a raw str…

    CVE-2026-100159
    Read original (opens in a new tab)
  9. NVD

    CVE-2026-92629 — A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Ch…

    High · CVSS 4.0 7.0 · Assessor: [email protected]

    A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrary code with elevated privileges.

    CVE-2026-92629
    Read original (opens in a new tab)
  12. NVD

    CVE-2026-84823 — A flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based Access Control (RBAC) r…

    High · CVSS 3.1 7.1 · Assessor: [email protected]

    A flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based Access Control (RBAC) role, can exploit a path traversal vulnerability in the `take-snapshot` operation. By manipulating the `name` parameter, this user can write a copy of the server configuration to an arbitrary location. This allows the `Monitor` role to read back the server configuration, including sensitive credentials, which would otherwise be restricted by RBAC, leading to information disclosure.

    CVE-2026-84823
    Read original (opens in a new tab)
  15. NVD

    CVE-2026-16754 — A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively i…

    Medium · CVSS 4.0 5.9 · Assessor: [email protected]

    A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications.

    CVE-2026-16754
    Read original (opens in a new tab)
  16. NVD

    CVE-2026-111210 — A vulnerability was determined in bitcoinj up to 0.17. Affected is the function url.openConnection of the file PaymentSessio…

    Medium · CVSS 4.0 5.5 · Assessor: [email protected]

    A vulnerability was determined in bitcoinj up to 0.17. Affected is the function url.openConnection of the file PaymentSession.java of the component Payment Request Handler. Executing a manipulation of the argument pki_type can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

    CVE-2026-111210
    Read original (opens in a new tab)
  17. NVD

    CVE-2026-96806 — The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, bu…

    Medium · CVSS 3.1 5.8 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but `KeycloakJWTMiddleware` then issued a new, unrevoked token on the same response, so the user stayed logged in. Deployments using the Keycloak auth manager are affected: after a user logs out, anyone with later access to the same browser (for example on a shared workstation) can continue to act as that user. Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airf…

    CVE-2026-96806
    Read original (opens in a new tab)
  18. NVD

    CVE-2026-94135 — The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, `SFTPClientPool`) disable SSH host…

    Medium · CVSS 3.1 4.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, `SFTPClientPool`) disable SSH host-key verification by default unless the connection explicitly sets `no_host_key_check` to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. An attacker in a machine-in-the-middle position between the triggerer and the SFTP server can impersonate the server and capture the credentials or data exchanged. Users of apache-airflow-providers-sftp are recommended…

    CVE-2026-94135
    Read original (opens in a new tab)
  19. NVD

    CVE-2026-94134 — The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_h…

    Critical · CVSS 3.1 9.1 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position between the worker and the SSH or SFTP server can impersonate the server and capture the credentials or data a task sends. Users of apache-airflow-providers-ssh and apache-airflow-providers-sftp are recommended to…

    CVE-2026-94134
    Read original (opens in a new tab)
  20. NVD

    CVE-2026-92228 — The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global r…

    Medium · CVSS 3.1 6.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team could read other teams' audit events through the UI or the event-log API. Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later.

    CVE-2026-92228
    Read original (opens in a new tab)
  21. NVD

    CVE-2026-111369 — ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes t…

    High · CVSS 4.0 7.1 · Assessor: [email protected]

    ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any course member, including students, to modify lessons. Authenticated students can supply arbitrary lesson ids to change titles and stored HTML content or delete lessons in their course and in other courses and organizations.

    CVE-2026-111369
    Read original (opens in a new tab)
  22. NVD

    CVE-2026-111368 — ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission route…

    Medium · CVSS 4.0 6.1 · Assessor: [email protected]

    ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission routes that allows course tutors or admins to modify submissions in other courses. Attackers can supply their own course id with another course's submission UUID to PUT or DELETE handlers to overwrite answers, grades, feedback, and grading status or delete submissions.

    CVE-2026-111368
    Read original (opens in a new tab)
  23. NVD

    CVE-2026-111367 — BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to forge…

    Medium · CVSS 4.0 6.9 · Assessor: [email protected]

    BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to forge unsubscribe and subscribe-confirm JWTs by computing the key from shipped configuration constants. Attackers can submit forged tokens to /api/unsubscribe, /api/unsubscribe_new, or /api/subscribe/confirm to deactivate any contact or force confirmed subscriptions.

    CVE-2026-111367
    Read original (opens in a new tab)
  24. NVD

    CVE-2026-111366 — cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to mana…

    High · CVSS 4.0 8.6 · Assessor: [email protected]

    cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to manage users outside their departments by supplying arbitrary user ids. Attackers holding sys:user:* permissions can call /admin/sys/user/info, update, or delete to read records, reset passwords and roles, or delete accounts.

    CVE-2026-111366
    Read original (opens in a new tab)
  25. NVD

    CVE-2026-111365 — cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows non-superadmin admins to read, mo…

    High · CVSS 4.0 7.0 · Assessor: [email protected]

    cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows non-superadmin admins to read, modify, or delete other admins' roles by supplying arbitrary role ids. Attackers holding ordinary sys:role permissions can call /admin/sys/role/info, update, or delete with another admin's role id to rewrite menu and department grants, changing other users' effective access.

    CVE-2026-111365
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.