PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

Every cached source, newest first. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

16,994 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  4. NVD

    CVE-2026-108498 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bannersky BSK PDF Mana…

    High · CVSS 3.1 7.1 · Assessor: [email protected]

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bannersky BSK PDF Manager bsk-pdf-manager allows Stored XSS.This issue affects BSK PDF Manager: from n/a through 3.8.1.

    CVE-2026-108498
    Read original (opens in a new tab)
  6. NVD

    CVE-2026-108491 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms Everest…

    High · CVSS 3.1 7.1 · Assessor: [email protected]

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms Everest Forms everest-forms allows Stored XSS.This issue affects Everest Forms: from n/a through 3.6.1.

    CVE-2026-108491
    Read original (opens in a new tab)
  13. NVD

    CVE-2026-53882 — An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization S…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Virtualization Station 4.1.1.130 and later

    CVE-2026-53882
    Read original (opens in a new tab)
  14. NVD

    CVE-2026-50619 — A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attack…

    Critical · CVSS 4.0 9.3 · Assessor: [email protected]

    A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsirch 7.0.3.0 and later

    CVE-2026-50619
    Read original (opens in a new tab)
  15. NVD

    CVE-2026-50612 — An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie. If a remote attacker gains a us…

    Critical · CVSS 4.0 9.4 · Assessor: [email protected]

    An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: QuMagie 2.9.2 and later

    CVE-2026-50612
    Read original (opens in a new tab)
  16. NVD

    CVE-2026-47790 — A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains a user acco…

    Medium · CVSS 4.0 6.3 · Assessor: [email protected]

    A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: QuFTP Service 1.4.6 and later QuFTP Service 1.5.5 and later QuFTP Service 1.6.5 and later

    CVE-2026-47790
    Read original (opens in a new tab)
  17. NVD

    CVE-2026-47786 — An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could…

    Critical · CVSS 4.0 9.3 · Assessor: [email protected]

    An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.23 and later HybridDesk Station 4.3.4 and later

    CVE-2026-47786
    Read original (opens in a new tab)
  18. NVD

    CVE-2026-44084 — An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, t…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later

    CVE-2026-44084
    Read original (opens in a new tab)
  19. NVD

    CVE-2026-41545 — A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator acc…

    High · CVSS 4.0 8.6 · Assessor: [email protected]

    A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: QuMagie 2.9.1 and later

    CVE-2026-41545
    Read original (opens in a new tab)
  20. NVD

    CVE-2026-41541 — An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central. If a remote attacker gain…

    Medium · CVSS 4.0 5.3 · Assessor: [email protected]

    An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.7 and later Qsync Central 5.1.0.3 and later Qsync Central 5.2.0.5 and later Qsync Central 5.3.0.2 and later

    CVE-2026-41541
    Read original (opens in a new tab)
  21. NVD

    CVE-2026-39997 — A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, t…

    High · CVSS 4.0 8.9 · Assessor: [email protected]

    A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.22 and later

    CVE-2026-39997
    Read original (opens in a new tab)
  22. NVD

    CVE-2026-39991 — A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user ac…

    Medium · CVSS 4.0 4.8 · Assessor: [email protected]

    A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.12 and later

    CVE-2026-39991
    Read original (opens in a new tab)
  23. NVD

    CVE-2026-39989 — A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains…

    Medium · CVSS 4.0 5.3 · Assessor: [email protected]

    A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read application data. We have already fixed the vulnerability in the following version: Download Station 5.10.1.312 and later Download Station 5.11.2.321 and later

    CVE-2026-39989
    Read original (opens in a new tab)
  24. NVD

    CVE-2026-34015 — A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they ca…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later

    CVE-2026-34015
    Read original (opens in a new tab)
  25. NVD

    CVE-2026-34014 — An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a lo…

    High · CVSS 4.0 8.4 · Assessor: [email protected]

    An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Download Station 5.10.1.312 and later Download Station 5.11.2.321 and later

    CVE-2026-34014
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.