THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
The complete recent NVD stream, including unscored entries. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,847 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUp to date · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-111364 — MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allo…
High · CVSS 4.0 7.1 · Assessor: [email protected]
MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allows authenticated users to read documents from unauthorized books. Attackers holding a non-observer role on any book can name that book and iterate sequential document ids to read markdown and HTML from private books.
CVE-2026-111364Read original ↗ (opens in a new tab) - NVD
CVE-2026-111363 — BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privile…
High · CVSS 4.0 7.1 · Assessor: [email protected]
BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to read other users' parsed documents by supplying arbitrary file_id values. Attackers can enumerate sequential file ids against GET /api/v1/knowledge/file_bbox to retrieve extracted page text from other users' and tenants' knowledge bases.
CVE-2026-111363Read original ↗ (opens in a new tab) - NVD
CVE-2026-111359 — CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront us…
High · CVSS 4.0 7.1 · Assessor: [email protected]
CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the gift-order API. Attackers can enumerate sequential order IDs in gift_detail to harvest buyer identities and the gift_key, then call receive_gift to redirect paid goods to their address.
CVE-2026-111359Read original ↗ (opens in a new tab) - NVD
CVE-2026-111358 — SendPortal sendportal-core through 4.0.1 contains an authorization bypass vulnerability that allows authenticated workspace…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
SendPortal sendportal-core through 4.0.1 contains an authorization bypass vulnerability that allows authenticated workspace members to attach subscribers to other workspaces' tags by supplying unvalidated tag IDs. Attackers can submit sequential tag IDs via the web subscriber form or CSV import to receive victim campaign content and skew victim reports.
CVE-2026-111358Read original ↗ (opens in a new tab) - NVD
CVE-2026-111356 — MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated…
Critical · CVSS 4.0 9.1 · Assessor: [email protected]
MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim's email or phone can request a code and brute-force findpass_reset to overwrite the member's password.
CVE-2026-111356Read original ↗ (opens in a new tab) - NVD
CVE-2026-111355 — zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to ignore d…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to ignore department DataScope restrictions by supplying out-of-scope record ids. Attackers holding user or organization module permissions with Dept or Self scope can call UserService and OrgService by-id methods to read, modify, disable, and delete users in other departments.
CVE-2026-111355Read original ↗ (opens in a new tab) - NVD
CVE-2026-111354 — crmeb_java through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other member…
Low · CVSS 4.0 2.3 · Assessor: [email protected]
crmeb_java through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members' orders by supplying their order numbers. Attackers can request /api/front/order/express/{orderId} or /api/front/order/apply/refund/{orderId} to view victims' tracking numbers, logistics traces, payment amounts and product lines.
CVE-2026-111354Read original ↗ (opens in a new tab) - NVD
CVE-2026-111353 — Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time en…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other users by supplying a user id in the request body. Attackers can send POST requests to /api/v1/time/new or /api/v1/storage/ticket/:id/upload/single to attach files and time records to any ticket under another user's identity.
CVE-2026-111353Read original ↗ (opens in a new tab) - NVD
CVE-2026-111352 — ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted b…
High · CVSS 4.0 8.7 · Assessor: [email protected]
ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check() fails open when no admin_api rule exists. Attackers with a valid admin-type API token can list member emails and mobile numbers, disable members, and call PUT admin/roles/{id}/authorize to grant themselves full administrator rights.
CVE-2026-111352Read original ↗ (opens in a new tab) - NVD
CVE-2026-111351 — metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows auth…
Low · CVSS 4.0 2.3 · Assessor: [email protected]
metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows authenticated low-privilege users to bypass role and organization access checks. Attackers can call the getBoard, getCard, addCard, removeCard and patchCard handlers to read records outside their scope and modify board card assignments.
CVE-2026-111351Read original ↗ (opens in a new tab) - NVD
CVE-2026-111350 — Papermark through 0.22.0 contains a missing authorization vulnerability in the data room viewer group API that allows authen…
Low · CVSS 4.0 2.3 · Assessor: [email protected]
Papermark through 0.22.0 contains a missing authorization vulnerability in the data room viewer group API that allows authenticated users to delete other teams' viewer groups and share links. Attackers who know a victim team's data room and group identifiers can send DELETE requests, read group links, or rewrite group document permissions across teams.
CVE-2026-111350Read original ↗ (opens in a new tab) - NVD
CVE-2026-111349 — Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthentica…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records via JSON:API and GraphQL. Attackers can send anonymous requests to POST /api/json/customers or the create_customer mutation to insert attacker-chosen names, contact details and addresses into the operator's CRM.
CVE-2026-111349Read original ↗ (opens in a new tab) - NVD
CVE-2026-111348 — Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php th…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts can call the detail, goodsInfo, cancel, express, and again actions to read refund and order data, cancel refunds, overwrite return shipment details, or re-open refused refunds.
CVE-2026-111348Read original ↗ (opens in a new tab) - NVD
CVE-2026-111347 — go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted…
High · CVSS 4.0 8.2 · Assessor: [email protected]
go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted login passwords. Unauthenticated attackers who capture encrypted passwords can decrypt them offline or via the /base/decryptpwd endpoint, recovering cleartext LDAP credentials for reuse.
CVE-2026-111347Read original ↗ (opens in a new tab) - NVD
CVE-2026-111346 — ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated user…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users' comments by supplying an arbitrary actionID. Attackers can iterate sequential action ids to modify comments on bugs, stories, tasks, and documents in products and projects they cannot access, and view targeted comment content and attachments.
CVE-2026-111346Read original ↗ (opens in a new tab) - NVD
CVE-2026-111345 — Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to read private con…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to read private conversations by supplying another conversation's id. Attackers can request GET /api/v1/messages/conversation/:id, which lacks participant checks, to obtain full message history plus participants' usernames, full names and email addresses.
CVE-2026-111345Read original ↗ (opens in a new tab) - NVD
CVE-2026-111344 — APITable through 1.14.0-beta contains an authorization bypass vulnerability that allows authenticated users to read node des…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
APITable through 1.14.0-beta contains an authorization bypass vulnerability that allows authenticated users to read node descriptions from other spaces by supplying a user-controlled nodeId. Attackers can request GET /node/{nodeId}/description, which skips space membership and node permission checks, to disclose cross-tenant datasheet, folder, and form descriptions.
CVE-2026-111344Read original ↗ (opens in a new tab) - NVD
CVE-2026-111343 — pig through 4.1.1 contains a missing authorization vulnerability in SysUserController.user that allows any authenticated use…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
pig through 4.1.1 contains a missing authorization vulnerability in SysUserController.user that allows any authenticated user to read other users' profiles via GET /admin/user/details/{id}. Low-privilege attackers can enumerate sequential user ids to obtain usernames, real names, phone numbers, emails, linked third-party accounts, and role assignments.
CVE-2026-111343Read original ↗ (opens in a new tab) - NVD
CVE-2026-111332 — OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share…
Medium · CVSS 4.0 6.3 · Assessor: [email protected]
OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share access after password protection is added. Attackers holding an existing oxi_shares share-ring cookie can request content via GET /api/files/{id} to read shared files or folder contents despite the new password.
CVE-2026-111332Read original ↗ (opens in a new tab) - NVD
CVE-2026-111331 — Dokploy through 0.30.8 contains a cross-organization authorization bypass in the port tRPC router that allows authenticated…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Dokploy through 0.30.8 contains a cross-organization authorization bypass in the port tRPC router that allows authenticated owners or admins of any organization to manage other tenants' ports because the target application's organization is never verified. Attackers supplying a known portId or applicationId to port.create, port.one, port.update, or port.delete can read, modify, delete, or add port mappings, disrupting how victim services are published.
CVE-2026-111331Read original ↗ (opens in a new tab) - NVD
CVE-2026-111330 — JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsa…
High · CVSS 4.0 8.2 · Assessor: [email protected]
JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 digests via tools.SHA1 in services/accountservice.go. Attackers who obtain the accounts table through database access or backups can crack console passwords using precomputed tables or GPU brute force.
CVE-2026-111330Read original ↗ (opens in a new tab) - NVD
CVE-2026-111329 — JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote att…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant applications and app secrets.
CVE-2026-111329Read original ↗ (opens in a new tab) - NVD
CVE-2026-111324 — rustdesk-api through 2.7 contains an authorization bypass vulnerability that allows unauthenticated attackers to overwrite e…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
rustdesk-api through 2.7 contains an authorization bypass vulnerability that allows unauthenticated attackers to overwrite existing peer records by supplying only a target device ID to POST /api/sysinfo. Attackers can overwrite hostname, username, OS and uuid without uuid verification, then log in presenting that uuid to rebind the peer to their account.
CVE-2026-111324Read original ↗ (opens in a new tab) - NVD
CVE-2026-111323 — RedAmon through 7.0.1 contains an unauthenticated server-side request forgery vulnerability in the agent POST /tradecraft/ve…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
RedAmon through 7.0.1 contains an unauthenticated server-side request forgery vulnerability in the agent POST /tradecraft/verify endpoint because validate_url checks only the initial hostname. Attackers can submit a public URL that redirects or DNS-rebinds to internal addresses like cloud metadata services, receiving fetched content through the model-generated summary.
CVE-2026-111323Read original ↗ (opens in a new tab) - NVD
CVE-2026-111322 — Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agent, which runs with bypassPermissions, to execute commands on the host as the Archon user.
CVE-2026-111322Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.