PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

Every cached source, newest first. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

16,997 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  2. NVD

    CVE-2026-16754 — A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively i…

    Medium · CVSS 4.0 5.9 · Assessor: [email protected]

    A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications.

    CVE-2026-16754
    Read original (opens in a new tab)
  3. NVD

    CVE-2026-111210 — A vulnerability was determined in bitcoinj up to 0.17. Affected is the function url.openConnection of the file PaymentSessio…

    Medium · CVSS 4.0 5.5 · Assessor: [email protected]

    A vulnerability was determined in bitcoinj up to 0.17. Affected is the function url.openConnection of the file PaymentSession.java of the component Payment Request Handler. Executing a manipulation of the argument pki_type can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

    CVE-2026-111210
    Read original (opens in a new tab)
  6. NVD

    CVE-2026-96806 — The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, bu…

    Medium · CVSS 3.1 5.8 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but `KeycloakJWTMiddleware` then issued a new, unrevoked token on the same response, so the user stayed logged in. Deployments using the Keycloak auth manager are affected: after a user logs out, anyone with later access to the same browser (for example on a shared workstation) can continue to act as that user. Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airf…

    CVE-2026-96806
    Read original (opens in a new tab)
  7. NVD

    CVE-2026-94135 — The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, `SFTPClientPool`) disable SSH host…

    Medium · CVSS 3.1 4.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, `SFTPClientPool`) disable SSH host-key verification by default unless the connection explicitly sets `no_host_key_check` to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. An attacker in a machine-in-the-middle position between the triggerer and the SFTP server can impersonate the server and capture the credentials or data exchanged. Users of apache-airflow-providers-sftp are recommended…

    CVE-2026-94135
    Read original (opens in a new tab)
  8. NVD

    CVE-2026-94134 — The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_h…

    Critical · CVSS 3.1 9.1 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position between the worker and the SSH or SFTP server can impersonate the server and capture the credentials or data a task sends. Users of apache-airflow-providers-ssh and apache-airflow-providers-sftp are recommended to…

    CVE-2026-94134
    Read original (opens in a new tab)
  9. NVD

    CVE-2026-92228 — The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global r…

    Medium · CVSS 3.1 6.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team could read other teams' audit events through the UI or the event-log API. Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later.

    CVE-2026-92228
    Read original (opens in a new tab)
  10. NVD

    CVE-2026-111369 — ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes t…

    High · CVSS 4.0 7.1 · Assessor: [email protected]

    ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any course member, including students, to modify lessons. Authenticated students can supply arbitrary lesson ids to change titles and stored HTML content or delete lessons in their course and in other courses and organizations.

    CVE-2026-111369
    Read original (opens in a new tab)
  11. NVD

    CVE-2026-111368 — ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission route…

    Medium · CVSS 4.0 6.1 · Assessor: [email protected]

    ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission routes that allows course tutors or admins to modify submissions in other courses. Attackers can supply their own course id with another course's submission UUID to PUT or DELETE handlers to overwrite answers, grades, feedback, and grading status or delete submissions.

    CVE-2026-111368
    Read original (opens in a new tab)
  12. NVD

    CVE-2026-111367 — BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to forge…

    Medium · CVSS 4.0 6.9 · Assessor: [email protected]

    BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to forge unsubscribe and subscribe-confirm JWTs by computing the key from shipped configuration constants. Attackers can submit forged tokens to /api/unsubscribe, /api/unsubscribe_new, or /api/subscribe/confirm to deactivate any contact or force confirmed subscriptions.

    CVE-2026-111367
    Read original (opens in a new tab)
  13. NVD

    CVE-2026-111366 — cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to mana…

    High · CVSS 4.0 8.6 · Assessor: [email protected]

    cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to manage users outside their departments by supplying arbitrary user ids. Attackers holding sys:user:* permissions can call /admin/sys/user/info, update, or delete to read records, reset passwords and roles, or delete accounts.

    CVE-2026-111366
    Read original (opens in a new tab)
  14. NVD

    CVE-2026-111365 — cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows non-superadmin admins to read, mo…

    High · CVSS 4.0 7.0 · Assessor: [email protected]

    cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows non-superadmin admins to read, modify, or delete other admins' roles by supplying arbitrary role ids. Attackers holding ordinary sys:role permissions can call /admin/sys/role/info, update, or delete with another admin's role id to rewrite menu and department grants, changing other users' effective access.

    CVE-2026-111365
    Read original (opens in a new tab)
  15. NVD

    CVE-2026-111364 — MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allo…

    High · CVSS 4.0 7.1 · Assessor: [email protected]

    MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allows authenticated users to read documents from unauthorized books. Attackers holding a non-observer role on any book can name that book and iterate sequential document ids to read markdown and HTML from private books.

    CVE-2026-111364
    Read original (opens in a new tab)
  16. NVD

    CVE-2026-111363 — BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privile…

    High · CVSS 4.0 7.1 · Assessor: [email protected]

    BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to read other users' parsed documents by supplying arbitrary file_id values. Attackers can enumerate sequential file ids against GET /api/v1/knowledge/file_bbox to retrieve extracted page text from other users' and tenants' knowledge bases.

    CVE-2026-111363
    Read original (opens in a new tab)
  17. NVD

    CVE-2026-111359 — CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront us…

    High · CVSS 4.0 7.1 · Assessor: [email protected]

    CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the gift-order API. Attackers can enumerate sequential order IDs in gift_detail to harvest buyer identities and the gift_key, then call receive_gift to redirect paid goods to their address.

    CVE-2026-111359
    Read original (opens in a new tab)
  18. NVD

    CVE-2026-111358 — SendPortal sendportal-core through 4.0.1 contains an authorization bypass vulnerability that allows authenticated workspace…

    Medium · CVSS 4.0 5.3 · Assessor: [email protected]

    SendPortal sendportal-core through 4.0.1 contains an authorization bypass vulnerability that allows authenticated workspace members to attach subscribers to other workspaces' tags by supplying unvalidated tag IDs. Attackers can submit sequential tag IDs via the web subscriber form or CSV import to receive victim campaign content and skew victim reports.

    CVE-2026-111358
    Read original (opens in a new tab)
  19. NVD

    CVE-2026-111356 — MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated…

    Critical · CVSS 4.0 9.1 · Assessor: [email protected]

    MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim's email or phone can request a code and brute-force findpass_reset to overwrite the member's password.

    CVE-2026-111356
    Read original (opens in a new tab)
  20. NVD

    CVE-2026-111355 — zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to ignore d…

    Medium · CVSS 4.0 5.3 · Assessor: [email protected]

    zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to ignore department DataScope restrictions by supplying out-of-scope record ids. Attackers holding user or organization module permissions with Dept or Self scope can call UserService and OrgService by-id methods to read, modify, disable, and delete users in other departments.

    CVE-2026-111355
    Read original (opens in a new tab)
  21. NVD

    CVE-2026-111354 — crmeb_java through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other member…

    Low · CVSS 4.0 2.3 · Assessor: [email protected]

    crmeb_java through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members' orders by supplying their order numbers. Attackers can request /api/front/order/express/{orderId} or /api/front/order/apply/refund/{orderId} to view victims' tracking numbers, logistics traces, payment amounts and product lines.

    CVE-2026-111354
    Read original (opens in a new tab)
  22. NVD

    CVE-2026-111353 — Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time en…

    Medium · CVSS 4.0 5.3 · Assessor: [email protected]

    Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other users by supplying a user id in the request body. Attackers can send POST requests to /api/v1/time/new or /api/v1/storage/ticket/:id/upload/single to attach files and time records to any ticket under another user's identity.

    CVE-2026-111353
    Read original (opens in a new tab)
  23. NVD

    CVE-2026-111352 — ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted b…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check() fails open when no admin_api rule exists. Attackers with a valid admin-type API token can list member emails and mobile numbers, disable members, and call PUT admin/roles/{id}/authorize to grant themselves full administrator rights.

    CVE-2026-111352
    Read original (opens in a new tab)
  24. NVD

    CVE-2026-111351 — metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows auth…

    Low · CVSS 4.0 2.3 · Assessor: [email protected]

    metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows authenticated low-privilege users to bypass role and organization access checks. Attackers can call the getBoard, getCard, addCard, removeCard and patchCard handlers to read records outside their scope and modify board card assignments.

    CVE-2026-111351
    Read original (opens in a new tab)
  25. NVD

    CVE-2026-111350 — Papermark through 0.22.0 contains a missing authorization vulnerability in the data room viewer group API that allows authen…

    Low · CVSS 4.0 2.3 · Assessor: [email protected]

    Papermark through 0.22.0 contains a missing authorization vulnerability in the data room viewer group API that allows authenticated users to delete other teams' viewer groups and share links. Attackers who know a victim team's data room and group identifiers can send DELETE requests, read group links, or rewrite group document permissions across teams.

    CVE-2026-111350
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.