THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
The complete recent NVD stream, including unscored entries. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,875 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUp to date · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-108440 — Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
High · CVSS 3.1 8.8 · Assessor: [email protected]
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-108440Read original ↗ (opens in a new tab) - NVD
CVE-2026-108439 — Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
High · CVSS 3.1 8.8 · Assessor: [email protected]
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-108439Read original ↗ (opens in a new tab) - NVD
CVE-2026-108438 — Use after free in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
Medium · CVSS 3.1 6.5 · Assessor: [email protected]
Use after free in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
CVE-2026-108438Read original ↗ (opens in a new tab) - NVD
CVE-2026-108437 — Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
High · CVSS 3.1 8.8 · Assessor: [email protected]
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-108437Read original ↗ (opens in a new tab) - NVD
CVE-2026-108436 — Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
Medium · CVSS 3.1 6.5 · Assessor: [email protected]
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
CVE-2026-108436Read original ↗ (opens in a new tab) - NVD
CVE-2026-108435 — Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information over a networ…
Medium · CVSS 3.1 6.5 · Assessor: [email protected]
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
CVE-2026-108435Read original ↗ (opens in a new tab) - NVD
CVE-2026-108434 — Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
Medium · CVSS 3.1 6.5 · Assessor: [email protected]
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
CVE-2026-108434Read original ↗ (opens in a new tab) - NVD
CVE-2026-108433 — Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a sec…
High · CVSS 3.1 7.8 · Assessor: [email protected]
Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-108433Read original ↗ (opens in a new tab) - NVD
CVE-2026-108432 — Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
High · CVSS 3.1 8.8 · Assessor: [email protected]
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-108432Read original ↗ (opens in a new tab) - NVD
CVE-2026-108431 — Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
High · CVSS 3.1 8.8 · Assessor: [email protected]
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-108431Read original ↗ (opens in a new tab) - NVD
CVE-2026-108430 — Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
High · CVSS 3.1 8.8 · Assessor: [email protected]
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-108430Read original ↗ (opens in a new tab) - NVD
CVE-2026-108429 — Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
High · CVSS 3.1 8.8 · Assessor: [email protected]
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-108429Read original ↗ (opens in a new tab) - NVD
CVE-2026-108428 — Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
High · CVSS 3.1 8.8 · Assessor: [email protected]
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-108428Read original ↗ (opens in a new tab) - NVD
CVE-2026-108427 — Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
High · CVSS 3.1 8.8 · Assessor: [email protected]
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-108427Read original ↗ (opens in a new tab) - NVD
CVE-2026-108426 — Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
High · CVSS 3.1 8.8 · Assessor: [email protected]
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-108426Read original ↗ (opens in a new tab) - NVD
CVE-2026-105040 — The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A…
High · CVSS 3.1 8.8 · Assessor: [email protected]
The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set another account's identifier and take over that account.
CVE-2026-105040Read original ↗ (opens in a new tab) - NVD
CVE-2026-105039 — EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. An…
Critical · CVSS 3.1 9.6 · Assessor: [email protected]
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents.
CVE-2026-105039Read original ↗ (opens in a new tab) - NVD
CVE-2026-105038 — The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions withou…
Critical · CVSS 3.1 9.8 · Assessor: [email protected]
The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated remote attacker can change AI model configuration and switch the model in use at runtime.
CVE-2026-105038Read original ↗ (opens in a new tab) - NVD
CVE-2026-105037 — EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to rea…
Critical · CVSS 3.1 9.9 · Assessor: [email protected]
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and server secrets.
CVE-2026-105037Read original ↗ (opens in a new tab) - NVD
CVE-2026-105036 — EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows deskto…
High · CVSS 3.1 7.5 · Assessor: [email protected]
EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP and do not verify their integrity or authenticity. An attacker able to intercept or modify the traffic can substitute a malicious update.
CVE-2026-105036Read original ↗ (opens in a new tab) - NVD
CVE-2026-105035 — The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all…
High · CVSS 3.1 7.8 · Assessor: [email protected]
The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that trusts it.
CVE-2026-105035Read original ↗ (opens in a new tab) - NVD
CVE-2026-105034 — The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An…
High · CVSS 3.1 8.2 · Assessor: [email protected]
The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services.
CVE-2026-105034Read original ↗ (opens in a new tab) - NVD
CVE-2026-105033 — The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled. An attacker with net…
High · CVSS 3.1 8.8 · Assessor: [email protected]
The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled. An attacker with network access to the device can log in as root and take full control of it.
CVE-2026-105033Read original ↗ (opens in a new tab) - NVD
CVE-2026-105032 — The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does n…
Critical · CVSS 3.1 9.1 · Assessor: [email protected]
The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain uploaded file paths. An unauthenticated remote attacker can use path traversal to write arbitrary files, and thereby tamper with AI skill files used by Eilik and EilikO robots.
CVE-2026-105032Read original ↗ (opens in a new tab) - NVD
CVE-2026-102764 — The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequate…
Critical · CVSS 4.0 9.3 · Assessor: 13061848-ea10-403d-bd75-c83a022c2891
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.
CVE-2026-102764Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.