THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
Every cached source, newest first. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,997 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUp to date · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-111349 — Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthentica…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records via JSON:API and GraphQL. Attackers can send anonymous requests to POST /api/json/customers or the create_customer mutation to insert attacker-chosen names, contact details and addresses into the operator's CRM.
CVE-2026-111349Read original ↗ (opens in a new tab) - NVD
CVE-2026-111348 — Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php th…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts can call the detail, goodsInfo, cancel, express, and again actions to read refund and order data, cancel refunds, overwrite return shipment details, or re-open refused refunds.
CVE-2026-111348Read original ↗ (opens in a new tab) - NVD
CVE-2026-111347 — go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted…
High · CVSS 4.0 8.2 · Assessor: [email protected]
go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted login passwords. Unauthenticated attackers who capture encrypted passwords can decrypt them offline or via the /base/decryptpwd endpoint, recovering cleartext LDAP credentials for reuse.
CVE-2026-111347Read original ↗ (opens in a new tab) - NVD
CVE-2026-111346 — ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated user…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users' comments by supplying an arbitrary actionID. Attackers can iterate sequential action ids to modify comments on bugs, stories, tasks, and documents in products and projects they cannot access, and view targeted comment content and attachments.
CVE-2026-111346Read original ↗ (opens in a new tab) - NVD
CVE-2026-111345 — Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to read private con…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to read private conversations by supplying another conversation's id. Attackers can request GET /api/v1/messages/conversation/:id, which lacks participant checks, to obtain full message history plus participants' usernames, full names and email addresses.
CVE-2026-111345Read original ↗ (opens in a new tab) - NVD
CVE-2026-111344 — APITable through 1.14.0-beta contains an authorization bypass vulnerability that allows authenticated users to read node des…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
APITable through 1.14.0-beta contains an authorization bypass vulnerability that allows authenticated users to read node descriptions from other spaces by supplying a user-controlled nodeId. Attackers can request GET /node/{nodeId}/description, which skips space membership and node permission checks, to disclose cross-tenant datasheet, folder, and form descriptions.
CVE-2026-111344Read original ↗ (opens in a new tab) - NVD
CVE-2026-111343 — pig through 4.1.1 contains a missing authorization vulnerability in SysUserController.user that allows any authenticated use…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
pig through 4.1.1 contains a missing authorization vulnerability in SysUserController.user that allows any authenticated user to read other users' profiles via GET /admin/user/details/{id}. Low-privilege attackers can enumerate sequential user ids to obtain usernames, real names, phone numbers, emails, linked third-party accounts, and role assignments.
CVE-2026-111343Read original ↗ (opens in a new tab) - NVD
CVE-2026-111332 — OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share…
Medium · CVSS 4.0 6.3 · Assessor: [email protected]
OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share access after password protection is added. Attackers holding an existing oxi_shares share-ring cookie can request content via GET /api/files/{id} to read shared files or folder contents despite the new password.
CVE-2026-111332Read original ↗ (opens in a new tab) - NVD
CVE-2026-111331 — Dokploy through 0.30.8 contains a cross-organization authorization bypass in the port tRPC router that allows authenticated…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Dokploy through 0.30.8 contains a cross-organization authorization bypass in the port tRPC router that allows authenticated owners or admins of any organization to manage other tenants' ports because the target application's organization is never verified. Attackers supplying a known portId or applicationId to port.create, port.one, port.update, or port.delete can read, modify, delete, or add port mappings, disrupting how victim services are published.
CVE-2026-111331Read original ↗ (opens in a new tab) - NVD
CVE-2026-111330 — JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsa…
High · CVSS 4.0 8.2 · Assessor: [email protected]
JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 digests via tools.SHA1 in services/accountservice.go. Attackers who obtain the accounts table through database access or backups can crack console passwords using precomputed tables or GPU brute force.
CVE-2026-111330Read original ↗ (opens in a new tab) - NVD
CVE-2026-111329 — JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote att…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant applications and app secrets.
CVE-2026-111329Read original ↗ (opens in a new tab) - NVD
CVE-2026-111324 — rustdesk-api through 2.7 contains an authorization bypass vulnerability that allows unauthenticated attackers to overwrite e…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
rustdesk-api through 2.7 contains an authorization bypass vulnerability that allows unauthenticated attackers to overwrite existing peer records by supplying only a target device ID to POST /api/sysinfo. Attackers can overwrite hostname, username, OS and uuid without uuid verification, then log in presenting that uuid to rebind the peer to their account.
CVE-2026-111324Read original ↗ (opens in a new tab) - NVD
CVE-2026-111323 — RedAmon through 7.0.1 contains an unauthenticated server-side request forgery vulnerability in the agent POST /tradecraft/ve…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
RedAmon through 7.0.1 contains an unauthenticated server-side request forgery vulnerability in the agent POST /tradecraft/verify endpoint because validate_url checks only the initial hostname. Attackers can submit a public URL that redirects or DNS-rebinds to internal addresses like cloud metadata services, receiving fetched content through the model-generated summary.
CVE-2026-111323Read original ↗ (opens in a new tab) - NVD
CVE-2026-111322 — Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agent, which runs with bypassPermissions, to execute commands on the host as the Archon user.
CVE-2026-111322Read original ↗ (opens in a new tab) - NVD
CVE-2026-111321 — TaskingAI through 0.3.0 contains a server-side request forgery vulnerability that allows authenticated attackers to make the…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
TaskingAI through 0.3.0 contains a server-side request forgery vulnerability that allows authenticated attackers to make the backend send arbitrary HTTP requests by supplying an unvalidated OpenAPI servers[0].url in a user-defined action. Attackers holding a project API key or console admin login can create an action pointing to loopback, internal or cloud metadata addresses and run it via POST /actions/{action_id}/run to read back up to 64 KiB of responses.
CVE-2026-111321Read original ↗ (opens in a new tab) - NVD
CVE-2026-111320 — ValueCell through 0.1.20 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
ValueCell through 0.1.20 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to direct backend requests by setting an unvalidated provider base_url. Attackers can set base_url via the provider config endpoint and trigger POST /api/v1/models/check to reach internal or metadata addresses, read error responses, and capture stored provider API keys.
CVE-2026-111320Read original ↗ (opens in a new tab) - NVD
CVE-2026-111313 — JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that a…
High · CVSS 4.0 7.1 · Assessor: [email protected]
JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticated clients in demo mode, to make the server fetch internal destinations. Attackers can supply loopback, private, or cloud metadata addresses in the url field to read returned page content, disclosing instance metadata and internal service data.
CVE-2026-111313Read original ↗ (opens in a new tab) - NVD
CVE-2026-111312 — OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET,…
Critical · CVSS 4.0 9.2 · Assessor: [email protected]
OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who know a HealthData record id can read another user's medical record data and file metadata, overwrite it with arbitrary JSON, or delete it.
CVE-2026-111312Read original ↗ (opens in a new tab) - NVD
CVE-2026-111284 — Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated…
Medium · CVSS 4.0 5.1 · Assessor: [email protected]
Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holiday names rendered as HtmlString. Attackers permitted to create Public Holidays or Mandatory Days can store JavaScript payloads that execute when HR managers or administrators open the Holiday modal, hijacking their sessions.
CVE-2026-111284Read original ↗ (opens in a new tab) - NVD
CVE-2026-111283 — BMC Helix Network Management on-prem 26.3.00 before 26.3.01 contains an authentication bypass vulnerability that allows unau…
Critical · CVSS 4.0 9.5 · Assessor: [email protected]
BMC Helix Network Management on-prem 26.3.00 before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator with any password when SAML single sign-on is configured. Attackers can submit the administrator username with an arbitrary password on the web login page to obtain a SuperAdmin session, modify device credentials, run device commands, and alter audit records.
CVE-2026-111283Read original ↗ (opens in a new tab) - NVD
CVE-2026-111282 — Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle_0x38_RequestFileTransfer that lets unauthenticat…
High · CVSS 4.0 8.8 · Assessor: [email protected]
Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle_0x38_RequestFileTransfer that lets unauthenticated attackers bypass the file path length check. Attackers can send a short RequestFileTransfer (SID 0x38) request with filePathAndNameLength 0xFFFC-0xFFFF, causing callbacks to read past the receive buffer, crashing targets or disclosing memory.
CVE-2026-111282Read original ↗ (opens in a new tab) - NVD
CVE-2026-111281 — Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allow…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode to /goform/SingleHandlebyCommand with an attacker-chosen authserverip and authcode, making the jooandiag daemon execute their commands through /bin/sh, giving full device control.
CVE-2026-111281Read original ↗ (opens in a new tab) - NVD
CVE-2026-111280 — snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() that allows malicious S…
High · CVSS 4.0 8.3 · Assessor: [email protected]
snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() that allows malicious S7 peers to overflow client buffers via an unchecked DataLength field. Rogue or impersonated PLCs can return crafted ReadVar responses causing memcpy of up to 65535 bytes into caller buffers, crashing SCADA, HMI, or gateway processes and corrupting memory.
CVE-2026-111280Read original ↗ (opens in a new tab) - NVD
CVE-2026-111279 — Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust…
High · CVSS 4.0 8.7 · Assessor: [email protected]
Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER or SRANDMEMBER. Attackers can send a single command against a one-element key with a huge negative COUNT to trigger the OOM killer, terminating the instance for all clients.
CVE-2026-111279Read original ↗ (opens in a new tab) - NVD
CVE-2026-111278 — NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protecti…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protection because the expected code is printed as plain text in the HTML. Attackers can fetch protected forms, extract the captcha_image value with a pattern match, and submit it to automate spam, registrations, reviews, and account deletion requests.
CVE-2026-111278Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.