THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
The complete recent NVD stream, including unscored entries. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,875 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUp to date · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-111234 — SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers to read server files by…
High · CVSS 4.0 8.2 · Assessor: [email protected]
SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers to read server files by supplying file:// URLs in redirects or autodiscovery links. Attackers can return a Location header or feed link pointing to a file:// path, causing file_get_contents() to read files accessible to the web server process.
CVE-2026-111234Read original ↗ (opens in a new tab) - NVD
CVE-2026-111233 — Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewall_rules.php that al…
Low · CVSS 4.0 2.3 · Assessor: [email protected]
Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewall_rules.php that allows remote attackers to inject script via the unencoded if parameter. When the non-default Require Firewall Interface option is enabled, attackers can lure users with firewall rules privileges into opening a crafted GET link to execute script in the WebGUI with their privileges.
CVE-2026-111233Read original ↗ (opens in a new tab) - NVD
CVE-2026-111232 — Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authenticated users…
Medium · CVSS 4.0 4.8 · Assessor: [email protected]
Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Firewall: Rules or NAT: Port Forward privileges to inject scripts via the separator color field. Attackers can submit a crafted separator[] color value that display_separator() renders unencoded into class attributes, executing in administrators' browsers to perform WebGUI actions with their privileges.
CVE-2026-111232Read original ↗ (opens in a new tab) - NVD
CVE-2026-111230 — Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client priv…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in services_dyndns_edit.php. Attackers can set a non-matching Result Match string so _checkStatus() logs file contents such as /conf/config.xml or /etc/master.passwd to the system log.
CVE-2026-111230Read original ↗ (opens in a new tab) - NVD
CVE-2026-111228 — Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection vulnerability in services_unbound_advanced.php that al…
Medium · CVSS 4.0 5.1 · Assessor: [email protected]
Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection vulnerability in services_unbound_advanced.php that allows authenticated users with DNS Resolver: Advanced privilege to inject Unbound directives. Attackers can embed CR/LF characters in the unvalidated sock_queue_timeout parameter, which is written raw into unbound.conf, to override local records and forwarding for all clients.
CVE-2026-111228Read original ↗ (opens in a new tab) - NVD
CVE-2026-111227 — Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in services_unbound_acls.php that allows authentica…
Medium · CVSS 4.0 5.1 · Assessor: [email protected]
Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in services_unbound_acls.php that allows authenticated users with the DNS Resolver: Access Lists privilege to inject Unbound configuration directives. Attackers can embed CR/LF characters in the aclname or aclaction fields written to access_lists.conf to add local-data, local-zone, or forward-zone directives and control DNS answers served to LAN clients.
CVE-2026-111227Read original ↗ (opens in a new tab) - NVD
CVE-2026-111226 — pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Ad…
High · CVSS 4.0 8.6 · Assessor: [email protected]
pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshguard threshold, block time, or detection time values containing newlines or $(...) that are written unvalidated to sshguard.conf and sourced as root on restart.
CVE-2026-111226Read original ↗ (opens in a new tab) - NVD
CVE-2026-111225 — Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allow…
Low · CVSS 4.0 2.3 · Assessor: [email protected]
Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolated unquoted into su -c strings, when DNS Resolver client registration is enabled.
CVE-2026-111225Read original ↗ (opens in a new tab) - NVD
CVE-2026-111224 — pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that…
High · CVSS 4.0 7.7 · Assessor: [email protected]
pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to execute commands as root via crafted usernames. Attackers authenticated through RADIUS or LDAP can use usernames containing single quotes and shell metacharacters to break out of the eval'd pfctl anchor name on connect or disconnect.
CVE-2026-111224Read original ↗ (opens in a new tab) - NVD
CVE-2026-111223 — Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with…
High · CVSS 4.0 8.6 · Assessor: [email protected]
Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root via the login_banner field. Attackers can submit a single-line banner containing '}' to escape the unquoted strongswan.conf attr value and define charon.start-scripts entries that charon executes as root on restart.
CVE-2026-111223Read original ↗ (opens in a new tab) - NVD
CVE-2026-111222 — Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Set…
High · CVSS 4.0 7.5 · Assessor: [email protected]
Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an unvalidated timezone value. Attackers can embed a quote and newline to add auto_prepend_file pointing at /var/db/zoneinfo, executing PHP as root after php.ini is regenerated at boot or php-fpm restart.
CVE-2026-111222Read original ↗ (opens in a new tab) - NVD
CVE-2026-111220 — pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated us…
High · CVSS 4.0 8.6 · Assessor: [email protected]
pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege can submit crafted POST values that configure_cron() writes unescaped into /etc/crontab, running arbitrary root commands on schedule.
CVE-2026-111220Read original ↗ (opens in a new tab) - NVD
CVE-2026-111219 — Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privilege…
High · CVSS 4.0 7.5 · Assessor: [email protected]
Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields. Attackers with the PPPoE Server Edit privilege can add a line whose secret begins with '!', making mpd5 run commands as root when a PPPoE client authenticates.
CVE-2026-111219Read original ↗ (opens in a new tab) - NVD
CVE-2026-111218 — Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with T…
High · CVSS 4.0 8.6 · Assessor: [email protected]
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a limiter, then delete it so delete_queue() passes the unquoted value to dnctl via /bin/sh as root.
CVE-2026-111218Read original ↗ (opens in a new tab) - NVD
CVE-2026-111217 — Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual…
High · CVSS 4.0 8.6 · Assessor: [email protected]
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID. Attackers can supply a VHID containing shell metacharacters that executes via interface_ipalias_configure() ifconfig calls or get_carp_interface_status() when CARP status is rendered.
CVE-2026-111217Read original ↗ (opens in a new tab) - NVD
CVE-2026-111216 — Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway…
High · CVSS 4.0 8.6 · Assessor: [email protected]
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute commands as root by injecting shell metacharacters into an IPv6 link-local zone index. Attackers can set a gateway Monitor IP whose unvalidated zone carries a payload, which start_dpinger() passes unescaped to the dpinger shell command when monitoring is applied.
CVE-2026-111216Read original ↗ (opens in a new tab) - NVD
CVE-2026-111215 — Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute c…
High · CVSS 4.0 8.6 · Assessor: [email protected]
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent interface name. Attackers with limited Wireless Edit or Interface Assignments privileges can submit values like ath0; via interfaces_wireless_edit.php or interfaces_assign.php, which interface_wireless_clone() interpolates unescaped into an ifconfig shell command.
CVE-2026-111215Read original ↗ (opens in a new tab) - NVD
CVE-2026-111214 — Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Q…
High · CVSS 4.0 8.6 · Assessor: [email protected]
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers can save a crafted 'if' value, then edit the QinQ entry so it is interpolated into ifconfig shell commands, executing commands as root.
CVE-2026-111214Read original ↗ (opens in a new tab) - NVD
CVE-2026-111172 — @casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields() that allows attackers to mo…
Medium · CVSS 4.0 6.0 · Assessor: [email protected]
@casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields() that allows attackers to modify inherited builtins via dotted condition keys. Attackers controlling rule conditions can supply keys like 'toString.call' to alter shared builtin functions process-wide, causing denial of service for the Node.js process.
CVE-2026-111172Read original ↗ (opens in a new tab) - NVD
CVE-2026-111171 — Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 contains a server-side request forgery vulnerability because _check_…
Medium · CVSS 4.0 6.3 · Assessor: [email protected]
Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 contains a server-side request forgery vulnerability because _check_ip_blocked() does not unwrap IPv4-mapped IPv6 addresses in CCIP Read URL validation. Malicious contracts can return OffchainLookup URLs with IPv4-mapped IPv6 hosts or AAAA records, making clients with CCIP Read enabled send requests to loopback, private, or link-local services.
CVE-2026-111171Read original ↗ (opens in a new tab) - NVD
CVE-2026-111170 — kedro-datasets from 9.3.0 through 9.6.0 contains a path traversal vulnerability in MatplotlibDataset.save() that allows atta…
High · CVSS 4.0 7.1 · Assessor: [email protected]
kedro-datasets from 9.3.0 through 9.6.0 contains a path traversal vulnerability in MatplotlibDataset.save() that allows attackers to write files outside the dataset directory by supplying absolute plot names. Because validate_sub_path() strips leading slashes while pathlib's join discards the base path, attackers can create or overwrite files anywhere the process can write.
CVE-2026-111170Read original ↗ (opens in a new tab) - NVD
CVE-2026-111169 — La Suite Docs through 6.0.1 contains an authorization bypass vulnerability that allows authenticated users to write comments…
Low · CVSS 4.0 2.3 · Assessor: [email protected]
La Suite Docs through 6.0.1 contains an authorization bypass vulnerability that allows authenticated users to write comments into threads of documents they cannot access. Attackers who know a thread UUID can route a POST comment request through their own document's resource_id, inserting comments into another document's thread without access.
CVE-2026-111169Read original ↗ (opens in a new tab) - NVD
CVE-2026-111168 — LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute…
Medium · CVSS 4.0 5.1 · Assessor: [email protected]
LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters. Attackers can upload an SVG typed 'image/svg+xml; x' via /api/v1/media so GET /uploads/{uuid} serves it inline without sandbox, running script in any viewing agent's or administrator's session.
CVE-2026-111168Read original ↗ (opens in a new tab) - NVD
CVE-2026-111167 — GNU LibreDWG through 0.14.8612 contains a global out-of-bounds read vulnerability in the AcDs decoder acds_private() that al…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
GNU LibreDWG through 0.14.8612 contains a global out-of-bounds read vulnerability in the AcDs decoder acds_private() that allows attackers to read beyond a static table via an unchecked schema property type index. Attackers can supply a crafted R2004 or R2010+ DWG file with a large 'schdat' property type value to crash dwgread, dwg2dxf, or any application using LibreDWG.
CVE-2026-111167Read original ↗ (opens in a new tab) - NVD
CVE-2026-111166 — libmikmod through 3.3.15 contains a heap out-of-bounds read vulnerability in the IMF_Load() loader that allows attackers to…
Medium · CVSS 4.0 6.8 · Assessor: [email protected]
libmikmod through 3.3.15 contains a heap out-of-bounds read vulnerability in the IMF_Load() loader that allows attackers to read beyond allocated memory by supplying a crafted IMF module. Attackers can enable the linear-period header flag and map notes to out-of-range samples, causing noteindex indexing far past the heap allocation and crashing applications that load the file.
CVE-2026-111166Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.