PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

The complete recent NVD stream, including unscored entries. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

16,840 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  1. NVD

    CVE-2026-101307 — When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the c…

    High · CVSS 4.0 8.2 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer. A remote peer can trigger the expansion by sending a sufficient number of ACKs on an established connection. A remote attacker who can establish a TCP connection to a system using the RACK stack can trigger an out-of-bounds write of approximately 512 KB in…

    CVE-2026-101307
    Read original (opens in a new tab)
  2. NVD

    CVE-2026-101306 — SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could cl…

    Critical · CVSS 3.1 9.8 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.

    CVE-2026-101306
    Read original (opens in a new tab)
  3. NVD

    CVE-2026-101305 — renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments. A jailed process could rename a directory relativ…

    High · CVSS 3.1 8.8 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir(2). This requires the directory to reside on a filesystem that is also reachable from the jail's root. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.

    CVE-2026-101305
    Read original (opens in a new tab)
  4. NVD

    CVE-2026-101304 — When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit…

    High · CVSS 3.1 7.1 · Assessor: [email protected]

    When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FD_RESOLVE_BENEATH or the Capsicum capability rights of descriptor N. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.

    CVE-2026-101304
    Read original (opens in a new tab)
  5. NVD

    CVE-2026-101303 — The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to…

    High · CVSS 3.1 7.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address. A process in a classic (non-VNET) jail can send UDP datagrams to services listening on the host's IPv6 loopback address, bypassing jail network isolation.

    CVE-2026-101303
    Read original (opens in a new tab)
  6. NVD

    CVE-2026-101302 — TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero paddin…

    Medium · CVSS 3.1 6.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding. The code which searches for the inner record type had an off-by-one bug which could be triggered by an invalid frame, leading to an underflow followed by an unconditional NULL pointer dereference, causing a kernel panic. A remote TLS 1.3 peer can send a specially crafted record to trigger a kernel panic, resulting in a Denial of Service (DoS).

    CVE-2026-101302
    Read original (opens in a new tab)
  7. NVD

    CVE-2025-68404 — A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter. If exploited, the vu…

    High · CVSS 4.0 7.5 · Assessor: [email protected]

    A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: QuRouter 2.6.4.001 and later

    CVE-2025-68404
    Read original (opens in a new tab)
  8. NVD

    CVE-2025-68403 — An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attack…

    Medium · CVSS 4.0 4.6 · Assessor: [email protected]

    An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account, they can then exploit the vulnerability to modify data on the system. We have already fixed the vulnerability in the following version: QuRouter 2.7.2.113 and later

    CVE-2025-68403
    Read original (opens in a new tab)
  9. NVD

    CVE-2025-66275 — A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they ca…

    High · CVSS 4.0 7.7 · Assessor: [email protected]

    A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.5 and later

    CVE-2025-66275
    Read original (opens in a new tab)
  10. NVD

    CVE-2025-66272 — A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they ca…

    High · CVSS 4.0 7.7 · Assessor: [email protected]

    A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.5 and later

    CVE-2025-66272
    Read original (opens in a new tab)
  11. NVD

    CVE-2025-29897 — A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central. If a remote attacker g…

    Low · CVSS 4.0 2.3 · Assessor: [email protected]

    A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 and later

    CVE-2025-29897
    Read original (opens in a new tab)
  12. NVD

    CVE-2025-29896 — A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user accoun…

    Low · CVSS 4.0 2.3 · Assessor: [email protected]

    A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 and later

    CVE-2025-29896
    Read original (opens in a new tab)
  13. NVD

    CVE-2025-29895 — A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user accoun…

    Low · CVSS 4.0 2.3 · Assessor: [email protected]

    A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 and later

    CVE-2025-29895
    Read original (opens in a new tab)
  14. NVD

    CVE-2026-88043 — The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all ver…

    High · CVSS 3.1 7.2 · Assessor: [email protected]

    The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

    CVE-2026-88043
    Read original (opens in a new tab)
  15. NVD

    CVE-2026-86803 — The The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including…

    Medium · CVSS 3.1 6.5 · Assessor: [email protected]

    The The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.6.0 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

    CVE-2026-86803
    Read original (opens in a new tab)
  16. NVD

    CVE-2026-78087 — The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Block 'linkToPost' Feature in all…

    Medium · CVSS 3.1 6.4 · Assessor: [email protected]

    The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Block 'linkToPost' Feature in all versions up to, and including, 1.126.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

    CVE-2026-78087
    Read original (opens in a new tab)
  17. NVD

    CVE-2026-78001 — The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Stored Cross-Site…

    Medium · CVSS 3.1 6.4 · Assessor: [email protected]

    The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Designer 'data-label' Attribute in all versions up to, and including, 1.27.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

    CVE-2026-78001
    Read original (opens in a new tab)
  18. NVD

    CVE-2026-18586 — The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Sit…

    High · CVSS 3.1 7.2 · Assessor: [email protected]

    The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'order_email' in all versions up to, and including, 7.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

    CVE-2026-18586
    Read original (opens in a new tab)
  19. NVD

    CVE-2026-18557 — The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Script…

    Medium · CVSS 3.1 6.1 · Assessor: [email protected]

    The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 1.8.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

    CVE-2026-18557
    Read original (opens in a new tab)
  20. NVD

    CVE-2026-18548 — The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Stored Cross-Site Scriptin…

    High · CVSS 3.1 7.2 · Assessor: [email protected]

    The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ref' parameter in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

    CVE-2026-18548
    Read original (opens in a new tab)
  21. NVD

    CVE-2026-17031 — The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to authorization bypass in…

    High · CVSS 3.1 8.1 · Assessor: [email protected]

    The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.9.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary Media Library attachments.

    CVE-2026-17031
    Read original (opens in a new tab)
  22. NVD

    CVE-2026-17001 — The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Colum…

    Medium · CVSS 3.1 6.4 · Assessor: [email protected]

    The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Column User Meta Profile Fields in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

    CVE-2026-17001
    Read original (opens in a new tab)
  23. NVD

    CVE-2026-15180 — The Tracking Code Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'TCM_ErrorMessages' POST…

    Medium · CVSS 3.1 6.1 · Assessor: [email protected]

    The Tracking Code Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'TCM_ErrorMessages' POST Parameter in all versions up to, and including, 2.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

    CVE-2026-15180
    Read original (opens in a new tab)
  24. NVD

    CVE-2026-15090 — The Link Library plugin for WordPress is vulnerable to time-based SQL Injection via the 'link_url' parameter in all versions…

    High · CVSS 3.1 7.5 · Assessor: [email protected]

    The Link Library plugin for WordPress is vulnerable to time-based SQL Injection via the 'link_url' parameter in all versions up to, and including, 7.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

    CVE-2026-15090
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.