PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

Every cached source, newest first. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

16,976 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  1. NVD

    CVE-2026-101310 — The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream. A zero…

    High · CVSS 3.1 7.0 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields were also subject to modification by the guest after validation. A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.

    CVE-2026-101310
    Read original (opens in a new tab)
  2. NVD

    CVE-2026-101309 — The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest. The size was re-read from…

    High · CVSS 3.1 7.0 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block (TRB) fields were loaded without protection against concurrent modification by the guest. This race condition could be triggered by a guest running malicious, privileged code. A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Caps…

    CVE-2026-101309
    Read original (opens in a new tab)
  3. NVD

    CVE-2026-96537 — The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pa…

    High · CVSS 3.1 7.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missing ones, and change the options that reference them.

    CVE-2026-96537
    Read original (opens in a new tab)
  4. NVD

    CVE-2026-92429 — The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook be…

    Medium · CVSS 3.1 5.3 · Assessor: [email protected]

    The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including marking unpaid orders as paid and cancelling completed orders.

    CVE-2026-92429
    Read original (opens in a new tab)
  5. NVD

    CVE-2026-92428 — The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook be…

    Medium · CVSS 3.1 5.3 · Assessor: [email protected]

    The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including orders that were already paid or completed.

    CVE-2026-92428
    Read original (opens in a new tab)
  6. NVD

    CVE-2026-81534 — The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Execution in versions up to, an…

    High · CVSS 3.1 8.8 · Assessor: [email protected]

    The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. This is due to insufficient authorization and input sanitization in the send_test_mail() function, which allows user-controlled PHP code to be written to executable files in the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary PHP code on the server, leading to full site compromise.

    CVE-2026-81534
    Read original (opens in a new tab)
  10. NVD

    CVE-2026-74920 — The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it in…

    High · CVSS 3.1 7.1 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against any visitor, including a logged-in administrator.

    CVE-2026-74920
    Read original (opens in a new tab)
  11. NVD

    CVE-2026-58100 — kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bou…

    High · CVSS 3.1 7.0 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and register knotes with file descriptor numbers beyond the end of the child's table, causing an out-of-bounds read. An unprivileged local user may be able to exploit these races to escalate privileges.

    CVE-2026-58100
    Read original (opens in a new tab)
  12. NVD

    CVE-2026-58099 — When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally…

    High · CVSS 3.1 7.0 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock. If another thread freed a marker while the lock was dropped, the subsequent in-flux decrement operated on freed memory. An unprivileged local user may be able to exploit these races to escalate privileges.

    CVE-2026-58099
    Read original (opens in a new tab)
  13. NVD

    CVE-2026-58098 — When semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps. Upon waking, it checks the…

    High · CVSS 3.1 8.4 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    When semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps. Upon waking, it checks the sequence number embedded in the semaphore set's IPC identifier to detect whether the set was removed while the caller was asleep. This sequence number is only 15 bits wide. If enough semaphore sets are created and destroyed in the same table slot while a caller is blocked, the counter wraps around, and semop(2) may falsely conclude that the original set still exists. The subsequent access to…

    CVE-2026-58098
    Read original (opens in a new tab)
  14. NVD

    CVE-2026-41544 — A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can th…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: QcalAgent 1.1.10 and later

    CVE-2026-41544
    Read original (opens in a new tab)
  15. NVD

    CVE-2026-39993 — A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user acco…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Download Station 5.10.2.313 and later Download Station 5.11.3.322 and later

    CVE-2026-39993
    Read original (opens in a new tab)
  16. NVD

    CVE-2026-24723 — A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user accou…

    Medium · CVSS 4.0 5.3 · Assessor: [email protected]

    A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later

    CVE-2026-24723
    Read original (opens in a new tab)
  17. NVD

    CVE-2026-24722 — A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user accou…

    Medium · CVSS 4.0 5.3 · Assessor: [email protected]

    A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later

    CVE-2026-24722
    Read original (opens in a new tab)
  18. NVD

    CVE-2026-24721 — A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user accou…

    Medium · CVSS 4.0 5.3 · Assessor: [email protected]

    A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later

    CVE-2026-24721
    Read original (opens in a new tab)
  19. NVD

    CVE-2026-24718 — A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they ca…

    Medium · CVSS 4.0 5.3 · Assessor: [email protected]

    A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.7 and later Qsync Central 5.1.0.3 and later Qsync Central 5.2.0.5 and later Qsync Central 5.3.0.2 and later

    CVE-2026-24718
    Read original (opens in a new tab)
  20. NVD

    CVE-2026-24715 — An observable timing discrepancy vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could a…

    Medium · CVSS 4.0 5.3 · Assessor: [email protected]

    An observable timing discrepancy vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: QuRouter 2.7.2.113 and later

    CVE-2026-24715
    Read original (opens in a new tab)
  21. NVD

    CVE-2026-22896 — A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If a remote attacker gains…

    Medium · CVSS 4.0 6.2 · Assessor: [email protected]

    A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If a remote attacker gains an administrator account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: Network & Virtual Switch in QTS 5.1.8.2823 build 20240712 and later Network & Virtual Switch in QTS 5.2.1.2930 build 20241025 and later Network & Virtual Switch in QuTS cloud c5.2.4.3041 build 20250211 and later Network & Virtual Switch…

    CVE-2026-22896
    Read original (opens in a new tab)
  23. NVD

    CVE-2026-11905 — The Elementor Website Builder – more than just a page builder plugin for WordPress is vulnerable to Sensitive Information Ex…

    Medium · CVSS 3.1 4.3 · Assessor: [email protected]

    The Elementor Website Builder – more than just a page builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.3 via the 'keys_conversion_map' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the full post_content and plaintext post_password of private, draft, pending, and future posts belonging to any author, including Administrators and Editors.

    CVE-2026-11905
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.