PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

Every cached source, newest first. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

16,938 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  2. NVD

    CVE-2026-107350 — Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed…

    High · CVSS 3.1 8.8 · Assessor: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

    Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user.

    CVE-2026-107350
    Read original (opens in a new tab)
  3. NVD

    CVE-2026-107349 — An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service.…

    High · CVSS 3.1 7.5 · Assessor: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

    An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignore_startup_parameters list lookup loop forever. Because PgBouncer serves all clients from a single process, this saturates a CPU core and makes PgBouncer unresponsive to all clients until the process is restarted.

    CVE-2026-107349
    Read original (opens in a new tab)
  4. NVD

    CVE-2026-107348 — Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer 1.21.0 through 1.26.0 allows a remote atta…

    Medium · CVSS 3.1 5.9 · Assessor: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

    Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer 1.21.0 through 1.26.0 allows a remote attacker to cause a denial of service when max_packet_size is configured above 2147483648. A packet header declaring a length above 2^31 makes the buffer size computation overflow, leaving the growth loop unable to terminate. Because PgBouncer serves all clients from a single process, this saturates a CPU core and stalls every pooled connection until the process is restarted. Since 1.23.0 the ove…

    CVE-2026-107348
    Read original (opens in a new tab)
  5. NVD

    CVE-2026-106465 — In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603, the NetX Secure DTLS server never compares the cookie a clien…

    Medium · CVSS 4.0 6.9 · Assessor: [email protected]

    In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603, the NetX Secure DTLS server never compares the cookie a client returns with the one it issued, and treats any non-empty cookie as verified. A remote attacker can make the server send its full handshake flight, several kilobytes, to a forged source address, using it to reflect amplified traffic at a third party.

    CVE-2026-106465
    Read original (opens in a new tab)
  6. NVD

    CVE-2026-106464 — In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the NetX Secure X.509 parser accepts a certificate wh…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the NetX Secure X.509 parser accepts a certificate whose signature is an empty BIT STRING and records a signature length of 0xFFFFFFFF. A remote peer can present such a certificate during the TLS handshake, before authentication, and make the device read far outside the certificate buffer during signature verification, which is expected to fault.

    CVE-2026-106464
    Read original (opens in a new tab)
  7. NVD

    CVE-2026-105066 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SimplyRETS SimplyRETS…

    High · CVSS 3.1 7.1 · Assessor: [email protected]

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SimplyRETS SimplyRETS Real Estate IDX simply-rets allows Reflected XSS.This issue affects SimplyRETS Real Estate IDX: from n/a through 3.2.9.

    CVE-2026-105066
    Read original (opens in a new tab)
  8. NVD

    CVE-2026-104103 — Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models. Prior to 0.17.8, ludwig.datas…

    High · CVSS 3.1 8.1 · Assessor: [email protected]

    Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models. Prior to 0.17.8, ludwig.datasets.archives.extract_archive() validated tar member names before calling TarFile.extractall() but did not validate symlink members or hard-link members. A crafted archive could create a link that escaped the extraction directory and then write a later member through that link, placing attacker-controlled content at an arbitrary filesystem path with the extracting process's privileges. The sam…

    CVE-2026-104103
    Read original (opens in a new tab)
  9. NVD

    CVE-2026-103975 — Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to…

    Medium · CVSS 3.1 6.5 · Assessor: [email protected]

    Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 7.2.6, @appium/support ZIP extraction accepts an archive entry that creates a symbolic link to a location outside the extraction directory and then accepts a later regular-file entry whose legitimate name resolves through that link. The lexical containment check examines entry names without validating the symlink target or the real destination, so an attacker-controlled archive can write file…

    CVE-2026-103975
    Read original (opens in a new tab)
  10. NVD

    CVE-2026-103415 — When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without check…

    Critical · CVSS 4.0 9.3 · Assessor: [email protected]

    When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checking that the cookie fits in the outgoing packet. Both the length and the contents of that cookie come from the peer, and the write happens before certificate authentication completes, so a malicious or compromised server can overwrite memory past the caller supplied TLS packet buffer without presenting a certificate. Only the client path is affected.

    CVE-2026-103415
    Read original (opens in a new tab)
  11. NVD

    CVE-2026-103414 — The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resource f…

    High · CVSS 4.0 8.4 · Assessor: [email protected]

    The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because `gx_page_header_data_size` is never validated against the glyph data a page actually contains, the two passes can read different page headers for the same font page, derive different glyph counts, and reserve less than the load pass writes. The excess is written past the end of the arena, with content taken verbatim from the file. The overflowed…

    CVE-2026-103414
    Read original (opens in a new tab)
  13. NVD

    CVE-2026-102476 — In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL contex…

    Critical · CVSS 4.0 9.1 · Assessor: [email protected]

    In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiency purpose, the key of this cache should reflect entirely the SSL semantics of the desired SSL properties. It is possible for a client to ask for an SSL context and obtain an SSL context with weaker properties, for instance a context with hostname validation and obtain a context ignoring hostname validation. The impacted component is io.vertx:vertx-core.

    CVE-2026-102476
    Read original (opens in a new tab)
  14. NVD

    CVE-2026-102077 — An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Netwo…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series with SPC3 allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). On MX Series with SPC3 line-card and source NAT configuration, when a specific malformed IPv6 packet is received, it is not dropped but instead a session is created and NAT resources are allocated. Continued receipt of such packets will eventually lead to session or resour…

    CVE-2026-102077
    Read original (opens in a new tab)
  15. NVD

    CVE-2026-101983 — A Stack-based Buffer Overflow vulnerability in the httpd process of Juniper Networks Junos OS and Junos OS Evolved allows an…

    Critical · CVSS 4.0 9.3 · Assessor: [email protected]

    A Stack-based Buffer Overflow vulnerability in the httpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to cause remote code execution and denial of service via a J-Web virtual-domain configured.

    CVE-2026-101983
    Read original (opens in a new tab)
  16. NVD

    CVE-2026-101982 — A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS E…

    Critical · CVSS 4.0 9.3 · Assessor: [email protected]

    A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP/EVPN peer to cause root code execution on Junos OS or an rpd crash on Junos OS Evolved via protocol-valid route advertisements for an EVPN-VPWS service.

    CVE-2026-101982
    Read original (opens in a new tab)
  17. NVD

    CVE-2026-101981 — A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS E…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent LDP peer to cause an rpd crash or execute arbitrary code via a malformed LDP Label Mapping message.

    CVE-2026-101981
    Read original (opens in a new tab)
  18. NVD

    CVE-2026-101979 — A Stack-based Buffer Overflow vulnerability in the authd Juniper Networks Junos OS and Junos OS Evolved allows a network att…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    A Stack-based Buffer Overflow vulnerability in the authd Juniper Networks Junos OS and Junos OS Evolved allows a network attacker with SNMP read access to execute code with root privileges or cause a denial of service via a specific SNMP packet, when SNMP and AAA are enabled.

    CVE-2026-101979
    Read original (opens in a new tab)
  19. NVD

    CVE-2026-101976 — An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an eBGP peer which has not negotiated four-octet-AS capability sending a specifically malformed BGP update to cause a Denial-of-Service (DoS).

    CVE-2026-101976
    Read original (opens in a new tab)
  20. NVD

    CVE-2026-101975 — A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved a…

    High · CVSS 4.0 7.1 · Assessor: [email protected]

    A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to cause a denial of service via OSPF traffic processed while OSPF Source Packet Routing best-route Prefix-SID installation is configured.

    CVE-2026-101975
    Read original (opens in a new tab)
  21. NVD

    CVE-2026-101972 — An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos…

    High · CVSS 4.0 7.1 · Assessor: [email protected]

    An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via specific OSPFv2 packets sent on an OSPF-enabled interface.

    CVE-2026-101972
    Read original (opens in a new tab)
  22. NVD

    CVE-2026-101964 — A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved a…

    High · CVSS 4.0 7.1 · Assessor: [email protected]

    A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause an rpd crash via a crafted LDP packet received over an established LDP session.

    CVE-2026-101964
    Read original (opens in a new tab)
  24. NVD

    CVE-2026-101962 — An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Network…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker sending a specifically malformed BGP EVPN multicast update which is attempted to be readvertised to cause an rpd crash.

    CVE-2026-101962
    Read original (opens in a new tab)
  25. NVD

    CVE-2026-101961 — A NULL Pointer Dereference vulnerability in the routing-policy nexthop-ECMP matcher of Juniper Networks Junos OS and Junos O…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    A NULL Pointer Dereference vulnerability in the routing-policy nexthop-ECMP matcher of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a routing-daemon denial of service via a specific BGP packet received while a nexthop-ecmp qualifier is attached to a BGP import policy.

    CVE-2026-101961
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.