PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

The complete recent NVD stream, including unscored entries. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

16,906 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  1. NVD

    CVE-2026-106465 — In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603, the NetX Secure DTLS server never compares the cookie a clien…

    Medium · CVSS 4.0 6.9 · Assessor: [email protected]

    In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603, the NetX Secure DTLS server never compares the cookie a client returns with the one it issued, and treats any non-empty cookie as verified. A remote attacker can make the server send its full handshake flight, several kilobytes, to a forged source address, using it to reflect amplified traffic at a third party.

    CVE-2026-106465
    Read original (opens in a new tab)
  2. NVD

    CVE-2026-106464 — In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the NetX Secure X.509 parser accepts a certificate wh…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the NetX Secure X.509 parser accepts a certificate whose signature is an empty BIT STRING and records a signature length of 0xFFFFFFFF. A remote peer can present such a certificate during the TLS handshake, before authentication, and make the device read far outside the certificate buffer during signature verification, which is expected to fault.

    CVE-2026-106464
    Read original (opens in a new tab)
  3. NVD

    CVE-2026-105066 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SimplyRETS SimplyRETS…

    High · CVSS 3.1 7.1 · Assessor: [email protected]

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SimplyRETS SimplyRETS Real Estate IDX simply-rets allows Reflected XSS.This issue affects SimplyRETS Real Estate IDX: from n/a through 3.2.9.

    CVE-2026-105066
    Read original (opens in a new tab)
  4. NVD

    CVE-2026-104103 — Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models. Prior to 0.17.8, ludwig.datas…

    High · CVSS 3.1 8.1 · Assessor: [email protected]

    Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models. Prior to 0.17.8, ludwig.datasets.archives.extract_archive() validated tar member names before calling TarFile.extractall() but did not validate symlink members or hard-link members. A crafted archive could create a link that escaped the extraction directory and then write a later member through that link, placing attacker-controlled content at an arbitrary filesystem path with the extracting process's privileges. The sam…

    CVE-2026-104103
    Read original (opens in a new tab)
  5. NVD

    CVE-2026-103975 — Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to…

    Medium · CVSS 3.1 6.5 · Assessor: [email protected]

    Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 7.2.6, @appium/support ZIP extraction accepts an archive entry that creates a symbolic link to a location outside the extraction directory and then accepts a later regular-file entry whose legitimate name resolves through that link. The lexical containment check examines entry names without validating the symlink target or the real destination, so an attacker-controlled archive can write file…

    CVE-2026-103975
    Read original (opens in a new tab)
  6. NVD

    CVE-2026-103415 — When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without check…

    Critical · CVSS 4.0 9.3 · Assessor: [email protected]

    When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checking that the cookie fits in the outgoing packet. Both the length and the contents of that cookie come from the peer, and the write happens before certificate authentication completes, so a malicious or compromised server can overwrite memory past the caller supplied TLS packet buffer without presenting a certificate. Only the client path is affected.

    CVE-2026-103415
    Read original (opens in a new tab)
  7. NVD

    CVE-2026-103414 — The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resource f…

    High · CVSS 4.0 8.4 · Assessor: [email protected]

    The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because `gx_page_header_data_size` is never validated against the glyph data a page actually contains, the two passes can read different page headers for the same font page, derive different glyph counts, and reserve less than the load pass writes. The excess is written past the end of the arena, with content taken verbatim from the file. The overflowed…

    CVE-2026-103414
    Read original (opens in a new tab)
  9. NVD

    CVE-2026-102476 — In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL contex…

    Critical · CVSS 4.0 9.1 · Assessor: [email protected]

    In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiency purpose, the key of this cache should reflect entirely the SSL semantics of the desired SSL properties. It is possible for a client to ask for an SSL context and obtain an SSL context with weaker properties, for instance a context with hostname validation and obtain a context ignoring hostname validation. The impacted component is io.vertx:vertx-core.

    CVE-2026-102476
    Read original (opens in a new tab)
  10. NVD

    CVE-2026-102077 — An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Netwo…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series with SPC3 allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). On MX Series with SPC3 line-card and source NAT configuration, when a specific malformed IPv6 packet is received, it is not dropped but instead a session is created and NAT resources are allocated. Continued receipt of such packets will eventually lead to session or resour…

    CVE-2026-102077
    Read original (opens in a new tab)
  11. NVD

    CVE-2026-101983 — A Stack-based Buffer Overflow vulnerability in the httpd process of Juniper Networks Junos OS and Junos OS Evolved allows an…

    Critical · CVSS 4.0 9.3 · Assessor: [email protected]

    A Stack-based Buffer Overflow vulnerability in the httpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to cause remote code execution and denial of service via a J-Web virtual-domain configured.

    CVE-2026-101983
    Read original (opens in a new tab)
  12. NVD

    CVE-2026-101982 — A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS E…

    Critical · CVSS 4.0 9.3 · Assessor: [email protected]

    A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP/EVPN peer to cause root code execution on Junos OS or an rpd crash on Junos OS Evolved via protocol-valid route advertisements for an EVPN-VPWS service.

    CVE-2026-101982
    Read original (opens in a new tab)
  13. NVD

    CVE-2026-101981 — A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS E…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent LDP peer to cause an rpd crash or execute arbitrary code via a malformed LDP Label Mapping message.

    CVE-2026-101981
    Read original (opens in a new tab)
  14. NVD

    CVE-2026-101979 — A Stack-based Buffer Overflow vulnerability in the authd Juniper Networks Junos OS and Junos OS Evolved allows a network att…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    A Stack-based Buffer Overflow vulnerability in the authd Juniper Networks Junos OS and Junos OS Evolved allows a network attacker with SNMP read access to execute code with root privileges or cause a denial of service via a specific SNMP packet, when SNMP and AAA are enabled.

    CVE-2026-101979
    Read original (opens in a new tab)
  15. NVD

    CVE-2026-101976 — An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an eBGP peer which has not negotiated four-octet-AS capability sending a specifically malformed BGP update to cause a Denial-of-Service (DoS).

    CVE-2026-101976
    Read original (opens in a new tab)
  16. NVD

    CVE-2026-101975 — A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved a…

    High · CVSS 4.0 7.1 · Assessor: [email protected]

    A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to cause a denial of service via OSPF traffic processed while OSPF Source Packet Routing best-route Prefix-SID installation is configured.

    CVE-2026-101975
    Read original (opens in a new tab)
  17. NVD

    CVE-2026-101972 — An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos…

    High · CVSS 4.0 7.1 · Assessor: [email protected]

    An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via specific OSPFv2 packets sent on an OSPF-enabled interface.

    CVE-2026-101972
    Read original (opens in a new tab)
  18. NVD

    CVE-2026-101964 — A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved a…

    High · CVSS 4.0 7.1 · Assessor: [email protected]

    A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause an rpd crash via a crafted LDP packet received over an established LDP session.

    CVE-2026-101964
    Read original (opens in a new tab)
  20. NVD

    CVE-2026-101962 — An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Network…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker sending a specifically malformed BGP EVPN multicast update which is attempted to be readvertised to cause an rpd crash.

    CVE-2026-101962
    Read original (opens in a new tab)
  21. NVD

    CVE-2026-101961 — A NULL Pointer Dereference vulnerability in the routing-policy nexthop-ECMP matcher of Juniper Networks Junos OS and Junos O…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    A NULL Pointer Dereference vulnerability in the routing-policy nexthop-ECMP matcher of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a routing-daemon denial of service via a specific BGP packet received while a nexthop-ecmp qualifier is attached to a BGP import policy.

    CVE-2026-101961
    Read original (opens in a new tab)
  22. NVD

    CVE-2026-101959 — A Function Call With Incorrect Variable or Reference as Argument vulnerability in the routing protocol daemon (rpd) of Junip…

    High · CVSS 4.0 7.1 · Assessor: [email protected]

    A Function Call With Incorrect Variable or Reference as Argument vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause an rpd crash via specifically malformed LSP-ping.

    CVE-2026-101959
    Read original (opens in a new tab)
  23. NVD

    CVE-2026-101954 — An Improper Authentication vulnerability in the J-Web management interface and its NETCONF session handling of Juniper Netwo…

    Critical · CVSS 4.0 9.3 · Assessor: [email protected]

    An Improper Authentication vulnerability in the J-Web management interface and its NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to obtain root-level device configuration access and take over the device via a reachable J-Web HTTP or HTTPS service when web management is enabled.

    CVE-2026-101954
    Read original (opens in a new tab)
  24. NVD

    CVE-2026-101952 — An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Ju…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP ISO-VPN peer to cause an rpd crash by sending a specific ISO-VPN update which is then processed by BMP route monitoring or NSR.

    CVE-2026-101952
    Read original (opens in a new tab)
  25. NVD

    CVE-2026-101949 — A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evol…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated remote BGP neighbor to cause a denial of service via a VPN-flowspec BGP update if it is readvertised and BMP post-policy RIB-out monitoring is configured.

    CVE-2026-101949
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.