PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

The complete recent NVD stream, including unscored entries. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

16,847 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  1. NVD

    CVE-2026-111321 — TaskingAI through 0.3.0 contains a server-side request forgery vulnerability that allows authenticated attackers to make the…

    Medium · CVSS 4.0 5.3 · Assessor: [email protected]

    TaskingAI through 0.3.0 contains a server-side request forgery vulnerability that allows authenticated attackers to make the backend send arbitrary HTTP requests by supplying an unvalidated OpenAPI servers[0].url in a user-defined action. Attackers holding a project API key or console admin login can create an action pointing to loopback, internal or cloud metadata addresses and run it via POST /actions/{action_id}/run to read back up to 64 KiB of responses.

    CVE-2026-111321
    Read original (opens in a new tab)
  2. NVD

    CVE-2026-111320 — ValueCell through 0.1.20 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers…

    Medium · CVSS 4.0 6.9 · Assessor: [email protected]

    ValueCell through 0.1.20 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to direct backend requests by setting an unvalidated provider base_url. Attackers can set base_url via the provider config endpoint and trigger POST /api/v1/models/check to reach internal or metadata addresses, read error responses, and capture stored provider API keys.

    CVE-2026-111320
    Read original (opens in a new tab)
  3. NVD

    CVE-2026-111313 — JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that a…

    High · CVSS 4.0 7.1 · Assessor: [email protected]

    JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticated clients in demo mode, to make the server fetch internal destinations. Attackers can supply loopback, private, or cloud metadata addresses in the url field to read returned page content, disclosing instance metadata and internal service data.

    CVE-2026-111313
    Read original (opens in a new tab)
  4. NVD

    CVE-2026-111312 — OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET,…

    Critical · CVSS 4.0 9.2 · Assessor: [email protected]

    OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who know a HealthData record id can read another user's medical record data and file metadata, overwrite it with arbitrary JSON, or delete it.

    CVE-2026-111312
    Read original (opens in a new tab)
  5. NVD

    CVE-2026-111284 — Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated…

    Medium · CVSS 4.0 5.1 · Assessor: [email protected]

    Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holiday names rendered as HtmlString. Attackers permitted to create Public Holidays or Mandatory Days can store JavaScript payloads that execute when HR managers or administrators open the Holiday modal, hijacking their sessions.

    CVE-2026-111284
    Read original (opens in a new tab)
  6. NVD

    CVE-2026-111283 — BMC Helix Network Management on-prem 26.3.00 before 26.3.01 contains an authentication bypass vulnerability that allows unau…

    Critical · CVSS 4.0 9.5 · Assessor: [email protected]

    BMC Helix Network Management on-prem 26.3.00 before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator with any password when SAML single sign-on is configured. Attackers can submit the administrator username with an arbitrary password on the web login page to obtain a SuperAdmin session, modify device credentials, run device commands, and alter audit records.

    CVE-2026-111283
    Read original (opens in a new tab)
  7. NVD

    CVE-2026-111282 — Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle_0x38_RequestFileTransfer that lets unauthenticat…

    High · CVSS 4.0 8.8 · Assessor: [email protected]

    Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle_0x38_RequestFileTransfer that lets unauthenticated attackers bypass the file path length check. Attackers can send a short RequestFileTransfer (SID 0x38) request with filePathAndNameLength 0xFFFC-0xFFFF, causing callbacks to read past the receive buffer, crashing targets or disclosing memory.

    CVE-2026-111282
    Read original (opens in a new tab)
  8. NVD

    CVE-2026-111281 — Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allow…

    Critical · CVSS 4.0 9.3 · Assessor: [email protected]

    Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode to /goform/SingleHandlebyCommand with an attacker-chosen authserverip and authcode, making the jooandiag daemon execute their commands through /bin/sh, giving full device control.

    CVE-2026-111281
    Read original (opens in a new tab)
  9. NVD

    CVE-2026-111280 — snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() that allows malicious S…

    High · CVSS 4.0 8.3 · Assessor: [email protected]

    snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() that allows malicious S7 peers to overflow client buffers via an unchecked DataLength field. Rogue or impersonated PLCs can return crafted ReadVar responses causing memcpy of up to 65535 bytes into caller buffers, crashing SCADA, HMI, or gateway processes and corrupting memory.

    CVE-2026-111280
    Read original (opens in a new tab)
  10. NVD

    CVE-2026-111279 — Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER or SRANDMEMBER. Attackers can send a single command against a one-element key with a huge negative COUNT to trigger the OOM killer, terminating the instance for all clients.

    CVE-2026-111279
    Read original (opens in a new tab)
  11. NVD

    CVE-2026-111278 — NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protecti…

    Medium · CVSS 4.0 6.9 · Assessor: [email protected]

    NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protection because the expected code is printed as plain text in the HTML. Attackers can fetch protected forms, extract the captcha_image value with a pattern match, and submit it to automate spam, registrations, reviews, and account deletion requests.

    CVE-2026-111278
    Read original (opens in a new tab)
  12. NVD

    CVE-2026-111277 — NivoCart through 2.5.1 contains a missing authorization vulnerability in the download() action of account/order that allows…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    NivoCart through 2.5.1 contains a missing authorization vulnerability in the download() action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an order_id. Attackers can iterate the order_id parameter, which matches guest orders stored with customer_id 0, to disclose guest names, addresses, telephone numbers, emails, purchased items, and totals.

    CVE-2026-111277
    Read original (opens in a new tab)
  13. NVD

    CVE-2026-111275 — nifti_clib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifti_convert_n2hdr2nim() beca…

    Medium · CVSS 4.0 6.9 · Assessor: [email protected]

    nifti_clib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifti_convert_n2hdr2nim() because the NIfTI-2 dim[0] value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read via nifti_image_read() to crash applications or corrupt stack memory.

    CVE-2026-111275
    Read original (opens in a new tab)
  14. NVD

    CVE-2026-111274 — unarr through 1.1.1 contains a heap-based out-of-bounds read in zip_parse_extra_fields() in zip/parse-zip.c due to an incorr…

    Medium · CVSS 4.0 6.8 · Assessor: [email protected]

    unarr through 1.1.1 contains a heap-based out-of-bounds read in zip_parse_extra_fields() in zip/parse-zip.c due to an incorrect ZIP64 extra field length check. Attackers can supply a crafted ZIP archive with 0xFFFFFFFF sentinel values and a truncated ZIP64 record to read past the heap buffer and crash the process.

    CVE-2026-111274
    Read original (opens in a new tab)
  15. NVD

    CVE-2026-111273 — unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in tar_get_name() in tar/parse-tar.c, reachable throug…

    Medium · CVSS 4.0 6.9 · Assessor: [email protected]

    unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in tar_get_name() in tar/parse-tar.c, reachable through the ar_entry_get_name() API. Attackers can supply a crafted TAR archive with a full ustar prefix and name to write a NUL byte past the allocation, corrupting heap memory and crashing the process.

    CVE-2026-111273
    Read original (opens in a new tab)
  16. NVD

    CVE-2026-111272 — LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote() that allows attackers to rea…

    Medium · CVSS 4.0 6.8 · Assessor: [email protected]

    LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote() that allows attackers to read past a short ShotInfo buffer. Attackers can supply a crafted Nikon NEF/TIFF with a 5-byte ShotInfo tag declaring version 243 to crash applications decoding the image.

    CVE-2026-111272
    Read original (opens in a new tab)
  17. NVD

    CVE-2026-111271 — libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2() in src/load_ams.…

    Medium · CVSS 4.0 6.8 · Assessor: [email protected]

    libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2() in src/load_ams.cpp that allows attackers to read adjacent heap memory via crafted AMS files. Attackers can supply an AMS module whose pattern effect bytes keep bit 7 set, driving the decoder past the input buffer and crashing any libmodplug consumer.

    CVE-2026-111271
    Read original (opens in a new tab)
  18. NVD

    CVE-2026-111270 — libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM() in src/load_dsm.cpp because nP…

    Medium · CVSS 4.0 6.9 · Assessor: [email protected]

    libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM() in src/load_dsm.cpp because nPat is never checked against MAX_PATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping patt_len value to corrupt heap memory and crash the consuming process.

    CVE-2026-111270
    Read original (opens in a new tab)
  19. NVD

    CVE-2026-111269 — libical through 4.0.6 contains a heap-based out-of-bounds read in icalvalue_decode_ical_string() in src/libical/icalvalue.c…

    Medium · CVSS 4.0 6.9 · Assessor: [email protected]

    libical through 4.0.6 contains a heap-based out-of-bounds read in icalvalue_decode_ical_string() in src/libical/icalvalue.c when decoding input ending in a backslash. Attackers can supply escaped iCalendar text with a trailing backslash, causing the loop to read past the terminator and crash the application or leak adjacent heap memory.

    CVE-2026-111269
    Read original (opens in a new tab)
  20. NVD

    CVE-2026-110922 — Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code insi…

    High · CVSS 3.1 8.8 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

    CVE-2026-110922
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.