THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
The complete recent NVD stream, including unscored entries. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,906 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUp to date · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-54525 — Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.28, Markdown Preview Enhanced…
High · CVSS 3.1 8.8 · Assessor: [email protected]
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.28, Markdown Preview Enhanced preview-link handling passes a decoded, Markdown-controlled link target to a Windows file-opening helper that invokes child_process.exec with the start command. When a Windows user opens an untrusted Markdown file and clicks a crafted external or unsupported-scheme link, shell metacharacters in the decoded target are interpreted by cmd.exe as command separators, allowing an attacker-selected…
CVE-2026-54525Read original ↗ (opens in a new tab) - NVD
CVE-2026-53999 — Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native ap…
High · CVSS 3.1 7.7 · Assessor: [email protected]
Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. Prior to 0.58.0, the Kubernetes controller deserializes the user-controlled radapp.io/status annotation on a Deployment and uses its container resource identifier for deletion without confirming ownership by that Deployment. An attacker with permission to modify Deployment annotations and knowledge of a target Radius resource ID can forge radapp.io/status and set radapp.io/enabled to fals…
CVE-2026-53999Read original ↗ (opens in a new tab) - NVD
CVE-2026-110775 — Nexent through 2.7.0 contains a missing authorization vulnerability in check_file_access that allows authenticated users to…
High · CVSS 4.0 7.1 · Assessor: [email protected]
Nexent through 2.7.0 contains a missing authorization vulnerability in check_file_access that allows authenticated users to read other tenants' knowledge-base files by skipping tenant comparison for knowledge_base/ reads. Attackers in multi-tenant deployments can list objects via GET /file/storage for presigned URLs or use GET /file/download/{object_name} to download other tenants' source documents.
CVE-2026-110775Read original ↗ (opens in a new tab) - NVD
CVE-2026-110774 — Blinko through 1.8.8 contains a broken access control vulnerability in the /api/file route that allows authenticated users t…
Medium · CVSS 4.0 6.0 · Assessor: [email protected]
Blinko through 1.8.8 contains a broken access control vulnerability in the /api/file route that allows authenticated users to read other users' private attachments due to a flawed owner check. Attackers can supply another user's stored filename, following a basename plus millisecond-timestamp pattern, to download private, non-shared attachments.
CVE-2026-110774Read original ↗ (opens in a new tab) - NVD
CVE-2026-110773 — GrowChief through 0.3.0 contains a missing authorization vulnerability in the getAllUsers handler that allows any authentica…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
GrowChief through 0.3.0 contains a missing authorization vulnerability in the getAllUsers handler that allows any authenticated user to list users across all organizations because the IsSuperAdmin guard is absent. Attackers with a self-registered low-privilege account can send an empty or short search value to GET /users/all-users to enumerate user ids, emails, names and organization IDs of every tenant.
CVE-2026-110773Read original ↗ (opens in a new tab) - NVD
CVE-2026-110772 — Sure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability in Transactions::BulkUpdatesController#creat…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Sure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability in Transactions::BulkUpdatesController#create that allows family members to bypass account sharing permissions. Authenticated members with read_only or no share can submit arbitrary entry_ids to modify other members' transaction dates, names, notes, categories, merchants and tags, corrupting budgets and reports.
CVE-2026-110772Read original ↗ (opens in a new tab) - NVD
CVE-2026-110771 — Shopizer through 3.2.5 contains an authorization bypass vulnerability that allows authenticated customers to post reviews as…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Shopizer through 3.2.5 contains an authorization bypass vulnerability that allows authenticated customers to post reviews as other customers by supplying a customerId field. Attackers can send crafted requests to POST /api/v1/auth/products/{id}/reviews to publish reviews and ratings attributed to other store customers, corrupting authorship and product ratings.
CVE-2026-110771Read original ↗ (opens in a new tab) - NVD
CVE-2026-110770 — Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brut…
Critical · CVSS 4.0 9.2 · Assessor: [email protected]
Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force password reset codes via POST /api/v1/users/reset-password. Attackers can request a six-digit code for a known email, then guess it without rate limiting, lockout, or invalidation to take over accounts, including administrators.
CVE-2026-110770Read original ↗ (opens in a new tab) - NVD
CVE-2026-110769 — holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any messa…
High · CVSS 4.0 8.3 · Assessor: [email protected]
holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any messaging-platform user to submit agent tasks because the #isAllowed check accepts all senders when the default allowFrom list is empty. Attackers who can message the operator's Telegram, Slack, Discord, or other bot can have ChannelIngress.handle pass turns to the workspace agent, running configured tools on the operator's machine.
CVE-2026-110769Read original ↗ (opens in a new tab) - NVD
CVE-2026-110768 — holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that auth…
Medium · CVSS 4.0 6.3 · Assessor: [email protected]
holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that authorizes senders by mutable username rather than only numeric id. Attackers who register a released username listed in allowFrom can submit turns to the bound workspace agent, which runs configured tools on the operator's machine.
CVE-2026-110768Read original ↗ (opens in a new tab) - NVD
CVE-2026-110767 — Gitingest through 0.3.1 contains a symlink following vulnerability in ingest_query single-file blob ingestion that allows un…
High · CVSS 4.0 8.7 · Assessor: [email protected]
Gitingest through 0.3.1 contains a symlink following vulnerability in ingest_query single-file blob ingestion that allows unauthenticated attackers to read server files by submitting symlink blob URLs. Attackers can commit a symlink to a public repository and submit its blob URL, causing the server to return any file the service user can read, up to 10 MB.
CVE-2026-110767Read original ↗ (opens in a new tab) - NVD
CVE-2026-110766 — Colanode server through 0.4.7 contains a path traversal vulnerability that allows authenticated users to read arbitrary .jpe…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Colanode server through 0.4.7 contains a path traversal vulnerability that allows authenticated users to read arbitrary .jpeg files by supplying an encoded traversal sequence in avatarId. Attackers can send percent-encoded ../ sequences to GET /client/v1/avatars/:avatarId to escape the avatars directory and read .jpeg files belonging to other workspaces.
CVE-2026-110766Read original ↗ (opens in a new tab) - NVD
CVE-2026-110765 — FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature ver…
High · CVSS 4.0 8.2 · Assessor: [email protected]
FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature verification when the intuit-signature header is omitted. Unauthenticated attackers knowing a tenant and environment ID can replay forged payment notifications to repeatedly add payment amounts, marking invoices paid or overpaid.
CVE-2026-110765Read original ↗ (opens in a new tab) - NVD
CVE-2026-110764 — AstronRPA through 1.1.6 contains an insecure direct object reference vulnerability in the resource-service /file/download en…
Medium · CVSS 4.0 6.0 · Assessor: [email protected]
AstronRPA through 1.1.6 contains an insecure direct object reference vulnerability in the resource-service /file/download endpoint that allows authenticated users to download other tenants' files by supplying their fileId. Attackers can enumerate predictable time-ordered Snowflake file IDs, since FileMapper.getFile performs no owner or tenant check, to retrieve S3-stored files uploaded by other tenants.
CVE-2026-110764Read original ↗ (opens in a new tab) - NVD
CVE-2026-110763 — lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDeptByCompany endpoint that skips URI permission checks. Authenticated low-privilege users can iterate sequential employeeId values to read every employee's department membership within the tenant.
CVE-2026-110763Read original ↗ (opens in a new tab) - NVD
CVE-2026-110762 — bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view restrict…
Medium · CVSS 4.0 6.3 · Assessor: [email protected]
bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view restricted subforum posts because hide_sitewide ignores ancestor forum visibility. Topics and replies in public subforums nested under private or hidden parents expose title, permalink and body via the BuddyPress activity stream and REST endpoint.
CVE-2026-110762Read original ↗ (opens in a new tab) - NVD
CVE-2026-110761 — ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test c…
High · CVSS 4.0 8.7 · Assessor: [email protected]
ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary objects via crafted Test archives. Attackers can inject a malicious tst_sequence sequence attribute that is passed to unserialize(), abusing Guzzle or Monolog gadget chains to write PHP files and execute code.
CVE-2026-110761Read original ↗ (opens in a new tab) - NVD
CVE-2026-110667 — A security flaw has been discovered in cemtan sar2html 4.0.0. Affected by this vulnerability is an unknown functionality of…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
A security flaw has been discovered in cemtan sar2html 4.0.0. Affected by this vulnerability is an unknown functionality of the file sar2html.py. The manipulation of the argument SECRET_KEY results in hard-coded credentials. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-110667Read original ↗ (opens in a new tab) - NVD
CVE-2026-110666 — A vulnerability was identified in cemtan sar2html 4.0.0. Affected is the function updateDb of the file sar2html.py of the co…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
A vulnerability was identified in cemtan sar2html 4.0.0. Affected is the function updateDb of the file sar2html.py of the component File Upload. The manipulation leads to path traversal. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-110666Read original ↗ (opens in a new tab) - NVD
CVE-2026-110536 — A vulnerability was determined in D-Link DIR-868L 2.01b05. This impacts the function system of the file /htdocs/cgibin of th…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
A vulnerability was determined in D-Link DIR-868L 2.01b05. This impacts the function system of the file /htdocs/cgibin of the component HNAP CGI Handler. Executing a manipulation of the argument SOAPACTION can lead to os command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2026-110536Read original ↗ (opens in a new tab) - NVD
CVE-2026-110248 — Insertion of sensitive information into log files in the git_utils[.]py component in Amazon SageMaker Python SDK V3 before 3…
Medium · CVSS 4.0 6.0 · Assessor: ff89ba41-3aa1-4d27-914a-91399e9639e5
Insertion of sensitive information into log files in the git_utils[.]py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails, because the runclone_command() function does not redact credentials from subprocess error output. To remediate this issue, users should upgrade to Amazon SageMaker Python SDK V3 3.10.0 or V2 2.257.3.
CVE-2026-110248Read original ↗ (opens in a new tab) - NVD
CVE-2026-109506 — Multiple TP-Link Wi-Fi range extenders use a custom, reversible XOR-and-dictionary transformation in the HTTP web-management…
Medium · CVSS 4.0 5.9 · Assessor: f23511db-6c3e-4e32-a477-6aa17d310630
Multiple TP-Link Wi-Fi range extenders use a custom, reversible XOR-and-dictionary transformation in the HTTP web-management login flow. An unauthenticated attacker on the same local network who can capture the network traffic associated with legitimate administrator login may be able to derive an alternative credential value that produces the same accepted authentication result and use it to authenticate to the device’s web-management interface with administrator privileges. Exploitation requires the management l…
CVE-2026-109506Read original ↗ (opens in a new tab) - NVD
CVE-2026-104143 — DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store a crafted c…
High · CVSS 4.0 8.7 · Assessor: [email protected]
DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store a crafted custom dateFormat for a dataset field. DatasetTableFieldDTO.dateFormat is inserted without validation into date conversion templates used by Dimension2SQLObj, CustomWhere2Str, Field2SQLObj, WhereTree2Str, and ExtWhere2Str. When a chart renders the field on a cross-datasource dataset, Calcite parsing is bypassed and the crafted format can directly alter the generated SQL. On a single-datasource…
CVE-2026-104143Read original ↗ (opens in a new tab) - NVD
CVE-2026-104142 — DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store crafted Fie…
High · CVSS 4.0 8.7 · Assessor: [email protected]
DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store crafted FieldGroupDTO.min, FieldGroupDTO.max, FieldGroupDTO.startTime, or FieldGroupDTO.endTime values in dataset group-field binning definitions. Utils.transGroupFieldToSql inserts these free-form values into generated CASE expressions without validation, and the resulting SQL can reach unparameterized backend query execution when a chart uses the field. This stored SQL injection can compromise the con…
CVE-2026-104142Read original ↗ (opens in a new tab) - NVD
CVE-2026-104141 — DataEase is an open source data visualization and analysis tool. Authenticated users with datasource access can supply craft…
High · CVSS 4.0 8.7 · Assessor: [email protected]
DataEase is an open source data visualization and analysis tool. Authenticated users with datasource access can supply crafted schema names, connection usernames, table names, or database names to datasource metadata operations, including getSchema, validate, save, and update flows. CalciteProvider inserts these identifiers into metadata queries that are executed through a plain JDBC Statement, allowing the generated SQL to be altered and run against the configured backend with application-held datasource credenti…
CVE-2026-104141Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.