THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
Every cached source, newest first. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,938 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUp to date · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-63626 — Mongoose is an embedded web server and network library. Prior to 7.23, ppp_handle_ipv6cp() in src/l2_ppp.c trusts the 16-bit…
High · CVSS 3.1 8.8 · Assessor: [email protected]
Mongoose is an embedded web server and network library. Prior to 7.23, ppp_handle_ipv6cp() in src/l2_ppp.c trusts the 16-bit IPv6CP len field without checking it against the received payload size. On a PPP or PPPoE link using MG_ENABLE_TCPIP and MG_ENABLE_IPV6, an unauthenticated adjacent peer can complete the required LCP exchange and send a short Configure-Request with an oversized length, causing ppp_tx_frame() to read beyond recv_queue.buf and write beyond tx.buf. The same length misuse can also expose adjacen…
CVE-2026-63626Read original ↗ (opens in a new tab) - NVD
CVE-2026-55787 — Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.3, validate_url_ssrf and is_private_…
High · CVSS 3.1 7.1 · Assessor: [email protected]
Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.3, validate_url_ssrf and is_private_ip in src/core/utils.py compare resolved addresses only against native private IPv4 and IPv6 ranges and do not unwrap IPv4-mapped, IPv4-compatible, 6to4, or NAT64 transition addresses. An authenticated workflow author can provide a transition-form literal URL through the Execution API POST /v1/execute route, http.get, or sibling guarded outbound-request modules, causing the guard to accept an…
CVE-2026-55787Read original ↗ (opens in a new tab) - NVD
CVE-2026-55786 — Flyto2 Core is an execution kernel for automation and AI-agent workflows. From 2.26.2 until 2.26.4, the HTTP MCP POST /mcp r…
High · CVSS 3.1 8.4 · Assessor: [email protected]
Flyto2 Core is an execution kernel for automation and AI-agent workflows. From 2.26.2 until 2.26.4, the HTTP MCP POST /mcp route accepts unauthenticated JSON-RPC tools/call requests and forwards execute_module arguments to the module registry without the require_auth dependency used by the REST execution routes. An unauthenticated caller can select sandbox.execute_shell and supply its command parameter, which reaches asyncio.create_subprocess_shell with the privileges of the flyto-core server process. The endpoint…
CVE-2026-55786Read original ↗ (opens in a new tab) - NVD
CVE-2026-55167 — LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP direc…
Medium · CVSS 3.1 4.2 · Assessor: [email protected]
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to 9.6, installations with WebAuthn two-factor authentication leave the challenge in the same PHP session after the authentication response is processed. A user who has already completed valid password authentication can therefore retain the same signed WebAuthn ceremony state instead of consuming it once. The practical risk is limited by the requirement for a valid password, the…
CVE-2026-55167Read original ↗ (opens in a new tab) - NVD
CVE-2026-54525 — Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.28, Markdown Preview Enhanced…
High · CVSS 3.1 8.8 · Assessor: [email protected]
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.28, Markdown Preview Enhanced preview-link handling passes a decoded, Markdown-controlled link target to a Windows file-opening helper that invokes child_process.exec with the start command. When a Windows user opens an untrusted Markdown file and clicks a crafted external or unsupported-scheme link, shell metacharacters in the decoded target are interpreted by cmd.exe as command separators, allowing an attacker-selected…
CVE-2026-54525Read original ↗ (opens in a new tab) - NVD
CVE-2026-53999 — Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native ap…
High · CVSS 3.1 7.7 · Assessor: [email protected]
Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. Prior to 0.58.0, the Kubernetes controller deserializes the user-controlled radapp.io/status annotation on a Deployment and uses its container resource identifier for deletion without confirming ownership by that Deployment. An attacker with permission to modify Deployment annotations and knowledge of a target Radius resource ID can forge radapp.io/status and set radapp.io/enabled to fals…
CVE-2026-53999Read original ↗ (opens in a new tab) - NVD
CVE-2026-110775 — Nexent through 2.7.0 contains a missing authorization vulnerability in check_file_access that allows authenticated users to…
High · CVSS 4.0 7.1 · Assessor: [email protected]
Nexent through 2.7.0 contains a missing authorization vulnerability in check_file_access that allows authenticated users to read other tenants' knowledge-base files by skipping tenant comparison for knowledge_base/ reads. Attackers in multi-tenant deployments can list objects via GET /file/storage for presigned URLs or use GET /file/download/{object_name} to download other tenants' source documents.
CVE-2026-110775Read original ↗ (opens in a new tab) - NVD
CVE-2026-110774 — Blinko through 1.8.8 contains a broken access control vulnerability in the /api/file route that allows authenticated users t…
Medium · CVSS 4.0 6.0 · Assessor: [email protected]
Blinko through 1.8.8 contains a broken access control vulnerability in the /api/file route that allows authenticated users to read other users' private attachments due to a flawed owner check. Attackers can supply another user's stored filename, following a basename plus millisecond-timestamp pattern, to download private, non-shared attachments.
CVE-2026-110774Read original ↗ (opens in a new tab) - NVD
CVE-2026-110773 — GrowChief through 0.3.0 contains a missing authorization vulnerability in the getAllUsers handler that allows any authentica…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
GrowChief through 0.3.0 contains a missing authorization vulnerability in the getAllUsers handler that allows any authenticated user to list users across all organizations because the IsSuperAdmin guard is absent. Attackers with a self-registered low-privilege account can send an empty or short search value to GET /users/all-users to enumerate user ids, emails, names and organization IDs of every tenant.
CVE-2026-110773Read original ↗ (opens in a new tab) - NVD
CVE-2026-110772 — Sure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability in Transactions::BulkUpdatesController#creat…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Sure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability in Transactions::BulkUpdatesController#create that allows family members to bypass account sharing permissions. Authenticated members with read_only or no share can submit arbitrary entry_ids to modify other members' transaction dates, names, notes, categories, merchants and tags, corrupting budgets and reports.
CVE-2026-110772Read original ↗ (opens in a new tab) - NVD
CVE-2026-110771 — Shopizer through 3.2.5 contains an authorization bypass vulnerability that allows authenticated customers to post reviews as…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Shopizer through 3.2.5 contains an authorization bypass vulnerability that allows authenticated customers to post reviews as other customers by supplying a customerId field. Attackers can send crafted requests to POST /api/v1/auth/products/{id}/reviews to publish reviews and ratings attributed to other store customers, corrupting authorship and product ratings.
CVE-2026-110771Read original ↗ (opens in a new tab) - NVD
CVE-2026-110770 — Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brut…
Critical · CVSS 4.0 9.2 · Assessor: [email protected]
Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force password reset codes via POST /api/v1/users/reset-password. Attackers can request a six-digit code for a known email, then guess it without rate limiting, lockout, or invalidation to take over accounts, including administrators.
CVE-2026-110770Read original ↗ (opens in a new tab) - NVD
CVE-2026-110769 — holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any messa…
High · CVSS 4.0 8.3 · Assessor: [email protected]
holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any messaging-platform user to submit agent tasks because the #isAllowed check accepts all senders when the default allowFrom list is empty. Attackers who can message the operator's Telegram, Slack, Discord, or other bot can have ChannelIngress.handle pass turns to the workspace agent, running configured tools on the operator's machine.
CVE-2026-110769Read original ↗ (opens in a new tab) - NVD
CVE-2026-110768 — holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that auth…
Medium · CVSS 4.0 6.3 · Assessor: [email protected]
holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that authorizes senders by mutable username rather than only numeric id. Attackers who register a released username listed in allowFrom can submit turns to the bound workspace agent, which runs configured tools on the operator's machine.
CVE-2026-110768Read original ↗ (opens in a new tab) - NVD
CVE-2026-110767 — Gitingest through 0.3.1 contains a symlink following vulnerability in ingest_query single-file blob ingestion that allows un…
High · CVSS 4.0 8.7 · Assessor: [email protected]
Gitingest through 0.3.1 contains a symlink following vulnerability in ingest_query single-file blob ingestion that allows unauthenticated attackers to read server files by submitting symlink blob URLs. Attackers can commit a symlink to a public repository and submit its blob URL, causing the server to return any file the service user can read, up to 10 MB.
CVE-2026-110767Read original ↗ (opens in a new tab) - NVD
CVE-2026-110766 — Colanode server through 0.4.7 contains a path traversal vulnerability that allows authenticated users to read arbitrary .jpe…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Colanode server through 0.4.7 contains a path traversal vulnerability that allows authenticated users to read arbitrary .jpeg files by supplying an encoded traversal sequence in avatarId. Attackers can send percent-encoded ../ sequences to GET /client/v1/avatars/:avatarId to escape the avatars directory and read .jpeg files belonging to other workspaces.
CVE-2026-110766Read original ↗ (opens in a new tab) - NVD
CVE-2026-110765 — FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature ver…
High · CVSS 4.0 8.2 · Assessor: [email protected]
FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature verification when the intuit-signature header is omitted. Unauthenticated attackers knowing a tenant and environment ID can replay forged payment notifications to repeatedly add payment amounts, marking invoices paid or overpaid.
CVE-2026-110765Read original ↗ (opens in a new tab) - NVD
CVE-2026-110764 — AstronRPA through 1.1.6 contains an insecure direct object reference vulnerability in the resource-service /file/download en…
Medium · CVSS 4.0 6.0 · Assessor: [email protected]
AstronRPA through 1.1.6 contains an insecure direct object reference vulnerability in the resource-service /file/download endpoint that allows authenticated users to download other tenants' files by supplying their fileId. Attackers can enumerate predictable time-ordered Snowflake file IDs, since FileMapper.getFile performs no owner or tenant check, to retrieve S3-stored files uploaded by other tenants.
CVE-2026-110764Read original ↗ (opens in a new tab) - NVD
CVE-2026-110763 — lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDeptByCompany endpoint that skips URI permission checks. Authenticated low-privilege users can iterate sequential employeeId values to read every employee's department membership within the tenant.
CVE-2026-110763Read original ↗ (opens in a new tab) - NVD
CVE-2026-110762 — bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view restrict…
Medium · CVSS 4.0 6.3 · Assessor: [email protected]
bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view restricted subforum posts because hide_sitewide ignores ancestor forum visibility. Topics and replies in public subforums nested under private or hidden parents expose title, permalink and body via the BuddyPress activity stream and REST endpoint.
CVE-2026-110762Read original ↗ (opens in a new tab) - NVD
CVE-2026-110761 — ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test c…
High · CVSS 4.0 8.7 · Assessor: [email protected]
ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary objects via crafted Test archives. Attackers can inject a malicious tst_sequence sequence attribute that is passed to unserialize(), abusing Guzzle or Monolog gadget chains to write PHP files and execute code.
CVE-2026-110761Read original ↗ (opens in a new tab) - NVD
CVE-2026-110667 — A security flaw has been discovered in cemtan sar2html 4.0.0. Affected by this vulnerability is an unknown functionality of…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
A security flaw has been discovered in cemtan sar2html 4.0.0. Affected by this vulnerability is an unknown functionality of the file sar2html.py. The manipulation of the argument SECRET_KEY results in hard-coded credentials. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-110667Read original ↗ (opens in a new tab) - NVD
CVE-2026-110666 — A vulnerability was identified in cemtan sar2html 4.0.0. Affected is the function updateDb of the file sar2html.py of the co…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
A vulnerability was identified in cemtan sar2html 4.0.0. Affected is the function updateDb of the file sar2html.py of the component File Upload. The manipulation leads to path traversal. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-110666Read original ↗ (opens in a new tab) - NVD
CVE-2026-110536 — A vulnerability was determined in D-Link DIR-868L 2.01b05. This impacts the function system of the file /htdocs/cgibin of th…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
A vulnerability was determined in D-Link DIR-868L 2.01b05. This impacts the function system of the file /htdocs/cgibin of the component HNAP CGI Handler. Executing a manipulation of the argument SOAPACTION can lead to os command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2026-110536Read original ↗ (opens in a new tab) - NVD
CVE-2026-110248 — Insertion of sensitive information into log files in the git_utils[.]py component in Amazon SageMaker Python SDK V3 before 3…
Medium · CVSS 4.0 6.0 · Assessor: ff89ba41-3aa1-4d27-914a-91399e9639e5
Insertion of sensitive information into log files in the git_utils[.]py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails, because the runclone_command() function does not redact credentials from subprocess error output. To remediate this issue, users should upgrade to Amazon SageMaker Python SDK V3 3.10.0 or V2 2.257.3.
CVE-2026-110248Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.