THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
The complete recent NVD stream, including unscored entries. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,836 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUp to date · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-55679 — WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the pre-installation web/instalador/instalador.php endpo…
Medium · CVSS 3.1 6.5 · Assessor: [email protected]
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php exists and processes unauthenticated installation POST data. In the Linux reinstall flow, a crafted usuario value reaches a command executed by shell_exec(). The installer also writes attacker-controlled values into executable config.php and concatenates the database name nomebd into a CREATE DATABASE statement. Successful exploitation can execute commands a…
CVE-2026-55679Read original ↗ (opens in a new tab) - NVD
CVE-2026-55498 — FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.15.0, Fil…
Medium · CVSS 3.1 4.8 · Assessor: [email protected]
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.15.0, FileRise public shared-folder links with subfolder browsing enabled can follow a symbolic link inside the shared folder to a sibling directory under the upload root. An unauthenticated holder of a valid share token can use shared-folder listing, direct download, or ZIP creation to access files outside the folder that was actually shared. The flaw occurs because the affected shared-folder paths r…
CVE-2026-55498Read original ↗ (opens in a new tab) - NVD
CVE-2026-55387 — InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and est…
High · CVSS 4.0 7.2 · Assessor: [email protected]
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. In version 2.3.3 and earlier, InvoiceShelf bulk-delete request validation accepts record identifiers without consistently binding them to the authenticated user's company_id. The affected DeleteCustomersRequest, DeleteEstimatesRequest, DeleteExpensesRequest, DeleteInvoiceRequest, DeleteItemsRequest, DeletePaymentsRequest, and DeleteUserRequest validators check that identifiers exist b…
CVE-2026-55387Read original ↗ (opens in a new tab) - NVD
CVE-2026-55386 — InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and est…
High · CVSS 4.0 7.1 · Assessor: [email protected]
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf passes the authenticated user's orderByField query parameter into Laravel orderBy calls in Invoice::scopeApplyFilters without restricting the value to column identifiers. A crafted SQL expression can therefore enter the ORDER BY clause across invoice and other list endpoints, enabling boolean-based blind extraction of database information. This iss…
CVE-2026-55386Read original ↗ (opens in a new tab) - NVD
CVE-2026-55385 — InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and est…
Medium · CVSS 3.1 6.8 · Assessor: [email protected]
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf's PDFConfigurationRequest.php validates the owner-controlled gotenberg_host setting only as a syntactically valid URL. GotenbergPDFDriver::loadView later sends a multipart HTTP request containing rendered invoice, estimate, or payment HTML as document.html to that host without rejecting private, loopback, link-local, or reserved addresses. An owner…
CVE-2026-55385Read original ↗ (opens in a new tab) - NVD
CVE-2026-55384 — InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and est…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf invoice, estimate, and recurring-invoice creation paths accept client-supplied total, sub_total, tax, discount_val, and due_amount values without verifying that they match the submitted line items. An authenticated user can persist manipulated financial totals through InvoicesRequest::getInvoicePayload and the corresponding EstimatesRequest and Rec…
CVE-2026-55384Read original ↗ (opens in a new tab) - NVD
CVE-2026-55383 — InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and est…
High · CVSS 3.1 8.2 · Assessor: [email protected]
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf public customer invoice, estimate, and payment routes use an EmailLog token's numeric mailable_id without verifying mailable_type, and the JSON handlers do not enforce EmailLog::isExpired. A token issued for one document type can therefore disclose a different company's document when numeric identifiers collide, and an expired token can remain usab…
CVE-2026-55383Read original ↗ (opens in a new tab) - NVD
CVE-2026-55382 — InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and est…
High · CVSS 3.1 7.6 · Assessor: [email protected]
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf NotesController::show, NotesController::update, and NotesController::destroy authorize only the generic view notes or manage notes ability and do not pass the route-bound Note to NotePolicy::viewNotes or NotePolicy::manageNotes, so neither method checks the target note's company_id. Because the Note model has no global company scope, an authenticat…
CVE-2026-55382Read original ↗ (opens in a new tab) - NVD
CVE-2026-55381 — InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and est…
High · CVSS 3.1 7.1 · Assessor: [email protected]
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, POST /api/v1/estimates/{estimate}/convert-to-invoice in ConvertEstimateController authorizes only the caller's create-invoice ability and does not authorize access to the route-bound Estimate. Because route-model binding can resolve an estimate from any company, an authenticated user with create-invoice ability can copy another company's line items, prices, tot…
CVE-2026-55381Read original ↗ (opens in a new tab) - NVD
CVE-2026-54703 — Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the _crossnote.updateMark…
Medium · CVSS 4.0 5.8 · Assessor: [email protected]
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the _crossnote.updateMarkdown command in Markdown Preview Enhanced accepts an arbitrary URI and attacker-controlled content, then passes them to vscode.workspace.fs.writeFile without validating that the target is the Markdown file represented by the current preview. JavaScript already executing in the preview webview can invoke this command through the extension message bridge and write any file permitted by the VS C…
CVE-2026-54703Read original ↗ (opens in a new tab) - NVD
CVE-2026-54702 — Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handl…
High · CVSS 4.0 7.3 · Assessor: [email protected]
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args, constructs a command in the _crossnote namespace, and invokes vscode.commands.executeCommand without an allowlist or type validation. JavaScript already executing in the preview webview can use this bridge to invoke privileged extension commands, including file modification, code-chunk exe…
CVE-2026-54702Read original ↗ (opens in a new tab) - NVD
CVE-2026-54701 — Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, Markdown Preview Enhanced…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, Markdown Preview Enhanced reads repository-controlled .crossnote/head.html content and passes it through resolvePathsInHeader before inserting it into the head of the preview webview document without removing executable content. Script-capable markup executes while the document loads, before the React application and DOMPurify initialize, and can access acquireVsCodeApi to send messages from the webview to the extens…
CVE-2026-54701Read original ↗ (opens in a new tab) - NVD
CVE-2026-54566 — Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, Markdown Preview Enhanced…
High · CVSS 4.0 8.5 · Assessor: [email protected]
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, Markdown Preview Enhanced evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, which does not provide a security boundary from the Node.js host realm. Opening a Markdown file in a malicious repository automatically loads these files, and prototype-chain traversal can reach the host Function constructor and process object, allowing operating-system commands to ex…
CVE-2026-54566Read original ↗ (opens in a new tab) - NVD
CVE-2026-110669 — A security vulnerability has been detected in cemtan sar2html 4.0.0. This affects the function deleteHost/deleteRange/delete…
Medium · CVSS 4.0 5.5 · Assessor: [email protected]
A security vulnerability has been detected in cemtan sar2html 4.0.0. This affects the function deleteHost/deleteRange/deleteAll of the file sar2html.py. Such manipulation leads to missing authentication. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-110669Read original ↗ (opens in a new tab) - NVD
CVE-2026-110668 — A weakness has been identified in cemtan sar2html 4.0.0. Affected by this issue is the function index of the file sar2html.p…
Medium · CVSS 4.0 5.5 · Assessor: [email protected]
A weakness has been identified in cemtan sar2html 4.0.0. Affected by this issue is the function index of the file sar2html.py. This manipulation of the argument sort causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-110668Read original ↗ (opens in a new tab) - NVD
CVE-2026-110310 — A remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme r…
Medium · CVSS 4.0 6.0 · Assessor: ff89ba41-3aa1-4d27-914a-91399e9639e5
A remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to legacy PKCS#1 v1.5. Since this padding scheme is susceptible to the well-known Bleichenbacher attack, the user can use a PKCS#1 v1.5 padding oracle to recover the RSA-wrapped envelope key and decrypt the object. To remediate this issue, we recommend that users upgrade to version 3.2.2 or 4.0.3. The 1.x and 2.x lines will not be patched, users of those lines…
CVE-2026-110310Read original ↗ (opens in a new tab) - NVD
CVE-2026-102986 — Plane is an open-source project management tool. In 1.3.1 and earlier, EntityAssetEndpoint at the public project asset endpo…
High · CVSS 3.1 8.1 · Assessor: [email protected]
Plane is an open-source project management tool. In 1.3.1 and earlier, EntityAssetEndpoint at the public project asset endpoint /api/public/assets/v2/anchor/{anchor}/ requires authentication for write operations but does not verify workspace or project membership. An authenticated user who knows a published project's public DeployBoard.anchor can create FileAsset records in that project and soft-delete existing assets by identifier, allowing cross-workspace file injection, storage abuse, and data loss. The issue i…
CVE-2026-102986Read original ↗ (opens in a new tab) - NVD
CVE-2026-102985 — Plane is an open-source project management tool. In 1.3.1 and earlier, ProjectMemberViewSet.partial_update places its author…
Medium · CVSS 3.1 6.5 · Assessor: [email protected]
Plane is an open-source project management tool. In 1.3.1 and earlier, ProjectMemberViewSet.partial_update places its authorization checks inside the role update branch, so a guest or member can omit role and change another ProjectMember record's is_active field, including deactivating a project administrator. ProjectMemberPreferenceEndpoint.patch separately trusts the member_id path value and lets a project member overwrite another member's preferences. These missing object-level authorization checks permit membe…
CVE-2026-102985Read original ↗ (opens in a new tab) - NVD
CVE-2026-102980 — Plane is an open-source project management tool. Prior to 1.4.0, PageVersionEndpoint in apps/api/plane/app/views/page/versio…
Medium · CVSS 3.1 6.5 · Assessor: [email protected]
Plane is an open-source project management tool. Prior to 1.4.0, PageVersionEndpoint in apps/api/plane/app/views/page/version.py scopes page-version lookups by workspace and page identifiers but not by the project_id from the URL. ProjectPagePermission likewise derives the caller's role from the URL project while resolving the requested page workspace-wide, so a member of one project can use that project's identifier to read description_html for a public page in another project in the same workspace. The affected…
CVE-2026-102980Read original ↗ (opens in a new tab) - NVD
CVE-2026-0321 — Denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network acce…
Medium · CVSS 4.0 6.6 · Assessor: [email protected]
Denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition by sending specially crafted network traffic to or through a dataplane interface. Repeated attempts to trigger this condition result in the firewall entering maintenance mode. Cloud NGFW and Panorama are not affected by this vulnerability.
CVE-2026-0321Read original ↗ (opens in a new tab) - NVD
CVE-2026-85714 — Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.13.2, an authe…
Critical · CVSS 3.1 9.1 · Assessor: [email protected]
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.13.2, an authenticated administrator using the default H2 database and security mode can upload a crafted SQL file to POST /api/v1/database/import-database. DatabaseService.validateSqlContent() splits normalized input on semicolons and accepts a statement when it contains any allowed keyword, allowing dangerous H2 functions such as FILE_READ and CSVWRITE, plus CREATE ALIAS, to bypass the insufficient white…
CVE-2026-85714Read original ↗ (opens in a new tab) - NVD
CVE-2026-82402 — Gogs is an open source self-hosted Git service. Prior to 0.15.0+dev, an unauthenticated attacker can provide a backslash-con…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Gogs is an open source self-hosted Git service. Prior to 0.15.0+dev, an unauthenticated attacker can provide a backslash-containing target to the /redirect endpoint, and similar post-action redirect flows are also affected. internal/urlx/urlx.go IsSameSite validates a normalized form of the target while cmd/gogs/internal/web/web.go getRedirect and other callers use the original value in the Location response. This backslash normalization mismatch lets browsers interpret the Location value as a scheme-relative exte…
CVE-2026-82402Read original ↗ (opens in a new tab) - NVD
CVE-2026-82153 — Dell OS Recovery Tool, versions prior to 2.4.4, contains an Insecure Storage of Sensitive Information vulnerability. A low p…
Low · CVSS 3.1 2.2 · Assessor: [email protected]
Dell OS Recovery Tool, versions prior to 2.4.4, contains an Insecure Storage of Sensitive Information vulnerability. A low privileged attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure.
CVE-2026-82153Read original ↗ (opens in a new tab) - NVD
CVE-2026-73261 — Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TCP/IP stack enabled by MG_ENABLE_TCPIP…
High · CVSS 3.1 7.5 · Assessor: [email protected]
Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TCP/IP stack enabled by MG_ENABLE_TCPIP in src/net_builtin.c does not reject a TCP option whose declared opts[1] length exceeds the remaining option bytes. In handle_opt(), a NOP followed by a truncated MSS option causes opts[3] to be read outside the declared options area and used as the low byte of dmss. An unauthenticated remote peer can corrupt the per-connection MSS value so later mg_send() calls transmit truncated or zero-len…
CVE-2026-73261Read original ↗ (opens in a new tab) - NVD
CVE-2026-73260 — Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by MG_TL…
High · CVSS 3.1 7.5 · Assessor: [email protected]
Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by MG_TLS_BUILTIN fails to verify that a long-form DER element length fits within the remaining certificate buffer. In mg_der_to_tlv() and mg_der_next(), a peer-controlled length can advance the parser beyond the certificate and underflow the remaining uint32_t length, causing mg_tls_parse_cert_der() to continue walking an invalid pointer. An unauthenticated malicious TLS server, or a client presenti…
CVE-2026-73260Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.