PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

Every cached source, newest first. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

16,987 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  1. NVD

    CVE-2026-39993 — A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user acco…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Download Station 5.10.2.313 and later Download Station 5.11.3.322 and later

    CVE-2026-39993
    Read original (opens in a new tab)
  2. NVD

    CVE-2026-24723 — A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user accou…

    Medium · CVSS 4.0 5.3 · Assessor: [email protected]

    A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later

    CVE-2026-24723
    Read original (opens in a new tab)
  3. NVD

    CVE-2026-24722 — A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user accou…

    Medium · CVSS 4.0 5.3 · Assessor: [email protected]

    A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later

    CVE-2026-24722
    Read original (opens in a new tab)
  4. NVD

    CVE-2026-24721 — A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user accou…

    Medium · CVSS 4.0 5.3 · Assessor: [email protected]

    A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later

    CVE-2026-24721
    Read original (opens in a new tab)
  5. NVD

    CVE-2026-24718 — A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they ca…

    Medium · CVSS 4.0 5.3 · Assessor: [email protected]

    A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.7 and later Qsync Central 5.1.0.3 and later Qsync Central 5.2.0.5 and later Qsync Central 5.3.0.2 and later

    CVE-2026-24718
    Read original (opens in a new tab)
  6. NVD

    CVE-2026-24715 — An observable timing discrepancy vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could a…

    Medium · CVSS 4.0 5.3 · Assessor: [email protected]

    An observable timing discrepancy vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: QuRouter 2.7.2.113 and later

    CVE-2026-24715
    Read original (opens in a new tab)
  7. NVD

    CVE-2026-22896 — A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If a remote attacker gains…

    Medium · CVSS 4.0 6.2 · Assessor: [email protected]

    A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If a remote attacker gains an administrator account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: Network & Virtual Switch in QTS 5.1.8.2823 build 20240712 and later Network & Virtual Switch in QTS 5.2.1.2930 build 20241025 and later Network & Virtual Switch in QuTS cloud c5.2.4.3041 build 20250211 and later Network & Virtual Switch…

    CVE-2026-22896
    Read original (opens in a new tab)
  9. NVD

    CVE-2026-11905 — The Elementor Website Builder – more than just a page builder plugin for WordPress is vulnerable to Sensitive Information Ex…

    Medium · CVSS 3.1 4.3 · Assessor: [email protected]

    The Elementor Website Builder – more than just a page builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.3 via the 'keys_conversion_map' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the full post_content and plaintext post_password of private, draft, pending, and future posts belonging to any author, including Administrators and Editors.

    CVE-2026-11905
    Read original (opens in a new tab)
  12. NVD

    CVE-2026-109145 — The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registrati…

    Critical · CVSS 3.1 9.8 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allowing unauthenticated attackers to register an administrator-equivalent account and take over the site.

    CVE-2026-109145
    Read original (opens in a new tab)
  13. NVD

    CVE-2026-106031 — The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before retu…

    Medium · CVSS 3.1 6.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones.

    CVE-2026-106031
    Read original (opens in a new tab)
  14. NVD

    CVE-2026-104643 — The Easy HTTPS Redirection (SSL) WordPress plugin before 2.0.2 does not perform capability checks in some of its AJAX action…

    Medium · CVSS 3.1 4.2 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The Easy HTTPS Redirection (SSL) WordPress plugin before 2.0.2 does not perform capability checks in some of its AJAX actions, allowing any authenticated user, such as a Subscriber, to read URLs its content scanner collected from private and draft posts and from site options, and to trigger a site-wide rewrite of those URLs, once an administrator has run a scan.

    CVE-2026-104643
    Read original (opens in a new tab)
  15. NVD

    CVE-2026-103324 — The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly verify the authenticity of the…

    Medium · CVSS 3.1 5.3 · Assessor: [email protected]

    The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly verify the authenticity of the payment notifications it receives, as the secret used to sign them is empty by default, allowing unauthenticated attackers to forge an approved-payment notification and mark arbitrary orders as paid, or force them to failed.

    CVE-2026-103324
    Read original (opens in a new tab)
  16. NVD

    CVE-2026-103304 — The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellat…

    Medium · CVSS 3.1 5.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the emails the site sends.

    CVE-2026-103304
    Read original (opens in a new tab)
  17. NVD

    CVE-2026-101308 — When an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then…

    Medium · CVSS 3.1 5.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    When an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap(2) call on another thread can complete during this window, after which the resize path frees the now-mapped buffer without rechecking. An unprivileged local user with access to a sound device can exploit this race to trigger a use-after-free in the kernel, potentially escalating privileges.

    CVE-2026-101308
    Read original (opens in a new tab)
  18. NVD

    CVE-2026-101307 — When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the c…

    High · CVSS 4.0 8.2 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer. A remote peer can trigger the expansion by sending a sufficient number of ACKs on an established connection. A remote attacker who can establish a TCP connection to a system using the RACK stack can trigger an out-of-bounds write of approximately 512 KB in…

    CVE-2026-101307
    Read original (opens in a new tab)
  19. NVD

    CVE-2026-101306 — SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could cl…

    Critical · CVSS 3.1 9.8 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.

    CVE-2026-101306
    Read original (opens in a new tab)
  20. NVD

    CVE-2026-101305 — renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments. A jailed process could rename a directory relativ…

    High · CVSS 3.1 8.8 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir(2). This requires the directory to reside on a filesystem that is also reachable from the jail's root. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.

    CVE-2026-101305
    Read original (opens in a new tab)
  21. NVD

    CVE-2026-101304 — When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit…

    High · CVSS 3.1 7.1 · Assessor: [email protected]

    When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FD_RESOLVE_BENEATH or the Capsicum capability rights of descriptor N. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.

    CVE-2026-101304
    Read original (opens in a new tab)
  22. NVD

    CVE-2026-101303 — The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to…

    High · CVSS 3.1 7.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address. A process in a classic (non-VNET) jail can send UDP datagrams to services listening on the host's IPv6 loopback address, bypassing jail network isolation.

    CVE-2026-101303
    Read original (opens in a new tab)
  23. NVD

    CVE-2026-101302 — TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero paddin…

    Medium · CVSS 3.1 6.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding. The code which searches for the inner record type had an off-by-one bug which could be triggered by an invalid frame, leading to an underflow followed by an unconditional NULL pointer dereference, causing a kernel panic. A remote TLS 1.3 peer can send a specially crafted record to trigger a kernel panic, resulting in a Denial of Service (DoS).

    CVE-2026-101302
    Read original (opens in a new tab)
  24. NVD

    CVE-2025-68404 — A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter. If exploited, the vu…

    High · CVSS 4.0 7.5 · Assessor: [email protected]

    A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: QuRouter 2.6.4.001 and later

    CVE-2025-68404
    Read original (opens in a new tab)
  25. NVD

    CVE-2025-68403 — An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attack…

    Medium · CVSS 4.0 4.6 · Assessor: [email protected]

    An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account, they can then exploit the vulnerability to modify data on the system. We have already fixed the vulnerability in the following version: QuRouter 2.7.2.113 and later

    CVE-2025-68403
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.