PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

Every cached source, newest first. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

16,987 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  1. NVD

    CVE-2025-66275 — A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they ca…

    High · CVSS 4.0 7.7 · Assessor: [email protected]

    A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.5 and later

    CVE-2025-66275
    Read original (opens in a new tab)
  2. NVD

    CVE-2025-66272 — A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they ca…

    High · CVSS 4.0 7.7 · Assessor: [email protected]

    A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.5 and later

    CVE-2025-66272
    Read original (opens in a new tab)
  3. NVD

    CVE-2025-29897 — A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central. If a remote attacker g…

    Low · CVSS 4.0 2.3 · Assessor: [email protected]

    A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 and later

    CVE-2025-29897
    Read original (opens in a new tab)
  4. NVD

    CVE-2025-29896 — A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user accoun…

    Low · CVSS 4.0 2.3 · Assessor: [email protected]

    A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 and later

    CVE-2025-29896
    Read original (opens in a new tab)
  5. NVD

    CVE-2025-29895 — A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user accoun…

    Low · CVSS 4.0 2.3 · Assessor: [email protected]

    A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 and later

    CVE-2025-29895
    Read original (opens in a new tab)
  6. NVD

    CVE-2026-88043 — The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all ver…

    High · CVSS 3.1 7.2 · Assessor: [email protected]

    The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

    CVE-2026-88043
    Read original (opens in a new tab)
  7. NVD

    CVE-2026-86803 — The The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including…

    Medium · CVSS 3.1 6.5 · Assessor: [email protected]

    The The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.6.0 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

    CVE-2026-86803
    Read original (opens in a new tab)
  8. NVD

    CVE-2026-78087 — The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Block 'linkToPost' Feature in all…

    Medium · CVSS 3.1 6.4 · Assessor: [email protected]

    The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Block 'linkToPost' Feature in all versions up to, and including, 1.126.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

    CVE-2026-78087
    Read original (opens in a new tab)
  9. NVD

    CVE-2026-78001 — The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Stored Cross-Site…

    Medium · CVSS 3.1 6.4 · Assessor: [email protected]

    The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Designer 'data-label' Attribute in all versions up to, and including, 1.27.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

    CVE-2026-78001
    Read original (opens in a new tab)
  10. NVD

    CVE-2026-18586 — The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Sit…

    High · CVSS 3.1 7.2 · Assessor: [email protected]

    The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'order_email' in all versions up to, and including, 7.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

    CVE-2026-18586
    Read original (opens in a new tab)
  11. NVD

    CVE-2026-18557 — The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Script…

    Medium · CVSS 3.1 6.1 · Assessor: [email protected]

    The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 1.8.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

    CVE-2026-18557
    Read original (opens in a new tab)
  12. NVD

    CVE-2026-18548 — The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Stored Cross-Site Scriptin…

    High · CVSS 3.1 7.2 · Assessor: [email protected]

    The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ref' parameter in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

    CVE-2026-18548
    Read original (opens in a new tab)
  13. NVD

    CVE-2026-17031 — The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to authorization bypass in…

    High · CVSS 3.1 8.1 · Assessor: [email protected]

    The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.9.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary Media Library attachments.

    CVE-2026-17031
    Read original (opens in a new tab)
  14. NVD

    CVE-2026-17001 — The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Colum…

    Medium · CVSS 3.1 6.4 · Assessor: [email protected]

    The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Column User Meta Profile Fields in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

    CVE-2026-17001
    Read original (opens in a new tab)
  15. NVD

    CVE-2026-15180 — The Tracking Code Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'TCM_ErrorMessages' POST…

    Medium · CVSS 3.1 6.1 · Assessor: [email protected]

    The Tracking Code Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'TCM_ErrorMessages' POST Parameter in all versions up to, and including, 2.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

    CVE-2026-15180
    Read original (opens in a new tab)
  16. NVD

    CVE-2026-15090 — The Link Library plugin for WordPress is vulnerable to time-based SQL Injection via the 'link_url' parameter in all versions…

    High · CVSS 3.1 7.5 · Assessor: [email protected]

    The Link Library plugin for WordPress is vulnerable to time-based SQL Injection via the 'link_url' parameter in all versions up to, and including, 7.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

    CVE-2026-15090
    Read original (opens in a new tab)
  17. CISA · Industrial

    Eclipse Foundation Eclipse Milo

    Successful exploitation of these vulnerabilities could allow an attacker to delete protected data, recover user credentials and impersonate legitimate users, or cause the server to stop responding to all clients.

    CVE-2026-62927CVE-2026-63252CVE-2026-58080CVE-2026-63248CVE-2026-60007+1 more in the original
    Read original (opens in a new tab)
  20. CISA · Industrial

    J4Care dcm4che

    Successful exploitation of these vulnerabilities could allow an attacker to delete stored medical images, disclose patient information, inject forged studies, reassign patient records, overwrite files, and cause a denial-of-service condition.

    CVE-2026-97851CVE-2026-107621CVE-2026-105273CVE-2026-101021CVE-2026-105279+1 more in the original
    Read original (opens in a new tab)
  24. NVD

    CVE-2026-3712 — The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.10…

    High · CVSS 3.1 7.3 · Assessor: [email protected]

    The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.10 This is due to the scripts service endpoint constructing its URL whitelist dynamically from the attacker-controlled HTTP 'Host' header. This makes it possible for unauthenticated attackers to spoof the header to match any target URL, bypassing the whitelist and forcing the server to make HTTP requests to arbitrary internal or external destinations and return the response content.

    CVE-2026-3712
    Read original (opens in a new tab)
  25. NVD

    CVE-2026-14572 — The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scri…

    Medium · CVSS 3.1 6.4 · Assessor: [email protected]

    The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Page Builder Text Content in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with kirki_content_access capability granted by an administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

    CVE-2026-14572
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.