THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
The complete recent NVD stream, including unscored entries. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,840 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUp to date · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-0993 — SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated remote…
High · CVSS 4.0 8.7 · Assessor: [email protected]
SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated remote attackers to cause a denial of service by sending an oversized boundary value in the Content-Type header of a crafted POST request. Attackers can exploit the embedded HTTP server's multipart/form-data boundary parser to cause the device to become fully unresponsive — dropping all management access and traffic forwarding during its self-recovery cycle.
CVE-2026-0993Read original ↗ (opens in a new tab) - NVD
CVE-2026-110809 — A security vulnerability has been detected in sgl-project SGLang up to 0.5.19. Affected by this issue is the function Sessio…
Low · CVSS 4.0 2.1 · Assessor: [email protected]
A security vulnerability has been detected in sgl-project SGLang up to 0.5.19. Affected by this issue is the function Session.create_req of the file python/sglang/srt/session/session_controller.py of the component Session Cleanup. Such manipulation leads to denial of service. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The pull request to fix this issue awaits acceptance.
CVE-2026-110809Read original ↗ (opens in a new tab) - NVD
CVE-2026-110873 — Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared collaborators to overwrite…
High · CVSS 4.0 7.1 · Assessor: [email protected]
Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared collaborators to overwrite a workflow's error_workflow_id because the field is missing from OWNER_ONLY_EXECUTION_FIELDS. Attackers can point the error workflow to their own workflow with an HTTP node, and when the parent workflow errors the owner's decrypted credentials are injected and exfiltrated.
CVE-2026-110873Read original ↗ (opens in a new tab) - NVD
CVE-2026-110872 — Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client repl…
High · CVSS 4.0 8.2 · Assessor: [email protected]
Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection._onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before authentication, blocking the Node.js event loop and exhausting memory.
CVE-2026-110872Read original ↗ (opens in a new tab) - NVD
CVE-2026-110871 — Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows us…
High · CVSS 4.0 7.1 · Assessor: [email protected]
Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines, blocking the Node.js event loop during DKIM signing.
CVE-2026-110871Read original ↗ (opens in a new tab) - NVD
CVE-2026-110870 — Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal characters reach envelope.to and RCPT TO, causing rejected delivery or parser interpretation conflicts that bypass domain allow-lists.
CVE-2026-110870Read original ↗ (opens in a new tab) - NVD
CVE-2026-110869 — Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH me…
High · CVSS 4.0 8.7 · Assessor: [email protected]
Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with 250-AUTH, a long whitespace run and a non-matching token, blocking the Node.js event loop for tens of seconds to hours before authentication.
CVE-2026-110869Read original ↗ (opens in a new tab) - NVD
CVE-2026-110868 — Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP clien…
High · CVSS 4.0 8.4 · Assessor: [email protected]
Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain AWS credentials or leak sensitive information through Renovate logs.
CVE-2026-110868Read original ↗ (opens in a new tab) - NVD
CVE-2026-110867 — Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment va…
Critical · CVSS 4.0 9.0 · Assessor: [email protected]
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset. Attackers controlling an externally sourced preset can override variables like PATH, LD_PRELOAD, NODE_OPTIONS, or GIT_SSL_CAINFO in child processes on self-hosted instances.
CVE-2026-110867Read original ↗ (opens in a new tab) - NVD
CVE-2026-110866 — Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skip…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency version can have it pushed into the PR and run in CI before the required release age elapses.
CVE-2026-110866Read original ↗ (opens in a new tab) - NVD
CVE-2026-110865 — Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders…
High · CVSS 4.0 7.1 · Assessor: [email protected]
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules[].headers to inject custom HTTP headers into requests Renovate sends to other hosts.
CVE-2026-110865Read original ↗ (opens in a new tab) - NVD
CVE-2026-110864 — Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin that a…
Critical · CVSS 4.0 9.1 · Assessor: [email protected]
Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin that allows unauthenticated attackers to sign in as other users by forging encrypted profiles. When the proxy shares the global secret and cookie-stored state is used, attackers can obtain encrypted state for a fake profile with a victim's verified email to take over the account via implicit linking.
CVE-2026-110864Read original ↗ (opens in a new tab) - NVD
CVE-2026-110863 — Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerability that allows authen…
High · CVSS 4.0 8.6 · Assessor: [email protected]
Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerability that allows authenticated users to sign in as other users by registering a personal SSO provider. Attackers can copy a legitimate provider's OIDC issuer or SAML entity ID and assert a victim's subject or NameID, because account lookup ignores providerId, creating sessions for victim accounts.
CVE-2026-110863Read original ↗ (opens in a new tab) - NVD
CVE-2026-110862 — Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated atta…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. Attackers can start an OAuth sign-in with a victim's email and submit the returned state to Magic Link verification, gaining sessions or creating falsely email-verified accounts.
CVE-2026-110862Read original ↗ (opens in a new tab) - NVD
CVE-2026-110861 — Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.…
Medium · CVSS 4.0 6.3 · Assessor: [email protected]
Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote attackers can send bursts of concurrent requests that pass the check together, exceeding configured limits on password sign-in, two-factor verification, one-time code, password reset, and other rate-limited endpoints.
CVE-2026-110861Read original ↗ (opens in a new tab) - NVD
CVE-2026-110860 — GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move(), which checks the destination only…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move(), which checks the destination only lexically and does not reject symbolic links in intermediate path components. An untrusted repository can commit a symlink such as vendor pointing outside the worktree, so an application moving an initialized submodule beneath it relocates the checkout externally and corrupts the index and .gitmodules.
CVE-2026-110860Read original ↗ (opens in a new tab) - NVD
CVE-2026-110859 — GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that allows remote attackers to read…
High · CVSS 4.0 8.7 · Assessor: [email protected]
GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that allows remote attackers to read arbitrary files by supplying a branch name parsed as a git option. Attackers can host a repository whose default branch is named --pathspec-from-file=, causing cloning applications that check out the active branch to leak file contents through GitCommandError messages.
CVE-2026-110859Read original ↗ (opens in a new tab) - NVD
CVE-2026-110858 — GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard…
Critical · CVSS 4.0 9.2 · Assessor: [email protected]
GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only keyword arguments, not the positional refspec. Attackers controlling the refspec can supply --upload-pack= to execute OS commands as the calling process over local-path or SSH transports.
CVE-2026-110858Read original ↗ (opens in a new tab) - NVD
CVE-2026-110857 — GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.ls_r…
High · CVSS 4.0 7.7 · Assessor: [email protected]
GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.ls_remote forwards URLs without check_unsafe_protocols validation. Attackers can supply ext:: remote-helper URLs to execute commands when git permits the ext transport, while merge_base and IndexFile.move also accept unguarded option injection.
CVE-2026-110857Read original ↗ (opens in a new tab) - NVD
CVE-2026-110856 — GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by…
High · CVSS 4.0 8.7 · Assessor: [email protected]
GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid epoch or timezone, causing quadratic backtracking and CPU exhaustion.
CVE-2026-110856Read original ↗ (opens in a new tab) - NVD
CVE-2026-110855 — GitPython before 3.2.0 contains an information disclosure vulnerability that allows malicious repositories to expand environ…
High · CVSS 4.0 7.1 · Assessor: [email protected]
GitPython before 3.2.0 contains an information disclosure vulnerability that allows malicious repositories to expand environment variables via separate_git_dir in Repo._clone(), which omits expand_vars=False when calling Git.polish_url(). Attackers can craft a .gitmodules submodule name containing variable syntax so that clone plus submodule_update exposes secrets in .git/modules directory names and DEBUG logs.
CVE-2026-110855Read original ↗ (opens in a new tab) - NVD
CVE-2026-110854 — Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 does not handle errors raised while sending verification or passw…
High · CVSS 4.0 8.2 · Assessor: [email protected]
Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 does not handle errors raised while sending verification or password reset emails, causing the server process to exit. A client holding only the public application keys can sign up, request a verification email, or request a password reset while the mail provider rejects, rate limits, or is unavailable, crashing the server.
CVE-2026-110854Read original ↗ (opens in a new tab) - NVD
CVE-2026-110853 — n8n before 1.123.83 contains an authorization bypass vulnerability that allows authenticated members to spoof workflow ident…
High · CVSS 4.0 7.1 · Assessor: [email protected]
n8n before 1.123.83 contains an authorization bypass vulnerability that allows authenticated members to spoof workflow identity by supplying a trusted identifier in Execute Sub-workflow inline JSON mode. Attackers can set this identifier to resolve credentials from projects they do not belong to and modify another workflow's static data and error-workflow dispatch.
CVE-2026-110853Read original ↗ (opens in a new tab) - NVD
CVE-2026-110852 — n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an authentication bypass because dynamic-path webh…
Medium · CVSS 4.0 6.3 · Assessor: [email protected]
n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an authentication bypass because dynamic-path webhook resolution matched requests on the path alone, ignoring the server-generated identifier that is the URL's only unguessable component. Unauthenticated attackers can omit this identifier in requests to webhook, form, or MCP routes to execute workflows in unrelated projects under those projects' credentials.
CVE-2026-110852Read original ↗ (opens in a new tab) - NVD
CVE-2026-110851 — n8n before 2.41.4 and 2.42.x before 2.42.1 contains an authorization bypass in the Agents create endpoint, which accepts a c…
Medium · CVSS 4.0 6.1 · Assessor: [email protected]
n8n before 2.41.4 and 2.42.x before 2.42.1 contains an authorization bypass in the Agents create endpoint, which accepts a caller-supplied Agent ID, checks permissions only against the requested project, and updates an existing Agent without verifying which project owns it. An authenticated user with read-only Agent access to another project can supply an existing Agent ID to move that Agent into their own project and rewrite its name, schema and version.
CVE-2026-110851Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.