PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

Every cached source, newest first. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

16,997 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  3. NVD

    CVE-2026-105039 — EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. An…

    Critical · CVSS 3.1 9.6 · Assessor: [email protected]

    EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents.

    CVE-2026-105039
    Read original (opens in a new tab)
  4. NVD

    CVE-2026-105038 — The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions withou…

    Critical · CVSS 3.1 9.8 · Assessor: [email protected]

    The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated remote attacker can change AI model configuration and switch the model in use at runtime.

    CVE-2026-105038
    Read original (opens in a new tab)
  5. NVD

    CVE-2026-105037 — EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to rea…

    Critical · CVSS 3.1 9.9 · Assessor: [email protected]

    EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and server secrets.

    CVE-2026-105037
    Read original (opens in a new tab)
  6. NVD

    CVE-2026-105036 — EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows deskto…

    High · CVSS 3.1 7.5 · Assessor: [email protected]

    EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP and do not verify their integrity or authenticity. An attacker able to intercept or modify the traffic can substitute a malicious update.

    CVE-2026-105036
    Read original (opens in a new tab)
  7. NVD

    CVE-2026-105035 — The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all…

    High · CVSS 3.1 7.8 · Assessor: [email protected]

    The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that trusts it.

    CVE-2026-105035
    Read original (opens in a new tab)
  8. NVD

    CVE-2026-105034 — The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An…

    High · CVSS 3.1 8.2 · Assessor: [email protected]

    The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services.

    CVE-2026-105034
    Read original (opens in a new tab)
  10. NVD

    CVE-2026-105032 — The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does n…

    Critical · CVSS 3.1 9.1 · Assessor: [email protected]

    The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain uploaded file paths. An unauthenticated remote attacker can use path traversal to write arbitrary files, and thereby tamper with AI skill files used by Eilik and EilikO robots.

    CVE-2026-105032
    Read original (opens in a new tab)
  11. NVD

    CVE-2026-102764 — The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequate…

    Critical · CVSS 4.0 9.3 · Assessor: 13061848-ea10-403d-bd75-c83a022c2891

    The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.

    CVE-2026-102764
    Read original (opens in a new tab)
  12. NVD

    CVE-2026-106708 — XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability in the user management control…

    High · CVSS 3.1 8.8 · Assessor: [email protected]

    XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability in the user management controller (JobUserController). The endpoints /user/insert, /user/update, and /user/delete lack CSRF protection and do not restrict HTTP method.

    CVE-2026-106708
    Read original (opens in a new tab)
  13. NVD

    CVE-2026-106700 — ELADMIN v2.7 and earlier contains an improper access control vulnerability in the user-management endpoint PUT /api/users/re…

    High · CVSS 3.1 8.8 · Assessor: [email protected]

    ELADMIN v2.7 and earlier contains an improper access control vulnerability in the user-management endpoint PUT /api/users/resetPwd of me.zhengjie.modules.system.rest.UserController. The method lacks the method-level authorization check applied to all other user-management endpoints and performs no role-level or ownership validation in UserServiceImpl.resetPwd. Any authenticated user of any role can reset the password of arbitrary users, including the built-in administrator.

    CVE-2026-106700
    Read original (opens in a new tab)
  14. NVD

    CVE-2026-104198 — ZoneMinder is a free, open source closed-circuit television software application. In versions 1.34.0 through 1.36.38, the we…

    Medium · CVSS 3.1 5.3 · Assessor: [email protected]

    ZoneMinder is a free, open source closed-circuit television software application. In versions 1.34.0 through 1.36.38, the web interface mishandles failed token authentication in web/includes/auth.php. validateToken() returns false when a token is malformed or has an invalid signature, but the caller assigns that value to the global $user variable; because web/index.php tests isset($user), boolean false is treated as a present user and the normal login redirect is skipped. This can dispatch views that rely on the o…

    CVE-2026-104198
    Read original (opens in a new tab)
  15. NVD

    CVE-2026-97370 — Junrar is an open source Java RAR archive library. Prior to 7.6.1, RarVM.ExecuteCode in src/main/java/com/github/junrar/unpa…

    High · CVSS 3.1 7.5 · Assessor: [email protected]

    Junrar is an open source Java RAR archive library. Prior to 7.6.1, RarVM.ExecuteCode in src/main/java/com/github/junrar/unpack/vm/RarVM.java can repeatedly execute a VM_JMP instruction whose target is greater than or equal to the prepared program's codeSize. The setIP() function returns success without changing the instruction pointer or decrementing maxOpCount, and the jump handler continues before loop-end accounting, leaving both values unchanged. A crafted RAR4 archive can therefore keep an extraction thread i…

    CVE-2026-97370
    Read original (opens in a new tab)
  17. NVD

    CVE-2026-94621 — AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.30.3, the AliasVault server API favi…

    Medium · CVSS 3.1 6.3 · Assessor: [email protected]

    AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.30.3, the AliasVault server API favicon extractor validates a user-supplied hostname with a first DNS lookup but allows the HTTP client to perform a second DNS lookup when connecting. An authenticated low-privileged user operating an attacker-controlled authoritative DNS server can return a public address during validation and a private address during connection, causing a publicly reachable self-hosted server to issue HTTP or…

    CVE-2026-94621
    Read original (opens in a new tab)
  18. NVD

    CVE-2026-92707 — MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled Message…

    Medium · CVSS 3.1 5.3 · Assessor: [email protected]

    MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object[] from each declared array length before the configured object-graph depth limit rejects the input, while nested array headers can reuse the same trailing unread bytes to satisfy per-header length validation. A comparatively small payload can therefore keep many…

    CVE-2026-92707
    Read original (opens in a new tab)
  19. NVD

    CVE-2026-87029 — undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress int…

    High · CVSS 3.1 7.5 · Assessor: [email protected]

    undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards decompressed response data to the downstream handler from zlib stream event callbacks without catching exceptions those callbacks may throw, and while undici's engine converts a synchronous throw from a downstream handler into a per-request failure, that protection is absent when the throw happens asynchronously from a zlib callback. As a result, a downstream handler that th…

    CVE-2026-87029
    Read original (opens in a new tab)
  20. NVD

    CVE-2026-87018 — undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12…

    High · CVSS 3.1 7.5 · Assessor: ce714d77-add3-4f53-aff5-83d477b104bb

    undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host. Node.js re-runs hostname verification on the renegotiated handshake and destroys the socket with a certificate-altname error, but undici's established-socket error handler asserted that this err…

    CVE-2026-87018
    Read original (opens in a new tab)
  21. NVD

    CVE-2026-63430 — ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.2, 4.0.2, and 4.1.3, applications that exp…

    Medium · CVSS 4.0 6.3 · Assessor: [email protected]

    ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.2, 4.0.2, and 4.1.3, applications that explicitly allow the math tag, annotation-xml, and at least one raw-text HTML element while disallowing the encoding attribute can permit mutation cross-site scripting. ammonia does not correctly implement annotation-xml's encoding-dependent MathML integration-point behavior after attribute filtering removes encoding, so the sanitizer validates a descendant under one namespace interpretation whi…

    CVE-2026-63430
    Read original (opens in a new tab)
  22. NVD

    CVE-2026-62322 — Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authoriz…

    Medium · CVSS 3.1 6.5 · Assessor: [email protected]

    Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resulting callback URL, causing the application to log the victim into the attacker's account. When account linking is enabled, the same missing validation can link the attacker's LINE identity to the victim's existing account and…

    CVE-2026-62322
    Read original (opens in a new tab)
  23. NVD

    CVE-2026-57496 — NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing l…

    Critical · CVSS 3.1 9.6 · Assessor: [email protected]

    NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing. Prior to 0.1.8, netlicensing_get_product passes the caller-controlled product_number to src/netlicensing_mcp/tools/products.py, which interpolates it into a REST path consumed by nl_get() in src/netlicensing_mcp/client.py without path-segment validation. A traversal segment can be normalized from the intended product path to the /token endpoint, after which th…

    CVE-2026-57496
    Read original (opens in a new tab)
  24. NVD

    CVE-2026-57183 — Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, checkApiAuth() in src/main/java/com/erudika/sco…

    Medium · CVSS 3.1 6.1 · Assessor: [email protected]

    Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, checkApiAuth() in src/main/java/com/erudika/scoold/utils/ScooldUtils.java accepts a JWT signed with app_secret_key or para_secret_key for /api/config and /api/stats without requiring a registered API-key jti, and maps the request to the hardcoded administrative API_USER. The special endpoint checks run even when scoold.api_enabled is false. An attacker who obtains either signing secret can forge a token that reads sensitive configuration…

    CVE-2026-57183
    Read original (opens in a new tab)
  25. NVD

    CVE-2026-55872 — GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM…

    High · CVSS 3.1 8.7 · Assessor: [email protected]

    GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php renders the stored firstname, lastname, and email profile fields into the administrator user list without HTML output encoding. An attacker who can store values in those fields can cause content to execute in an administrator's browser when the administrator visits /admin/users/. The persistent script can access administrator-session data or perform actions with t…

    CVE-2026-55872
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.