THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
Every cached source, newest first. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,900 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUp to date · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-110625 — ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/flagged_item.php via…
Medium · CVSS 4.0 5.1 · Assessor: [email protected]
ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/flagged_item.php via the unencoded type GET parameter. Attackers can send crafted flagged_item.php?type= links to logged-in administrators or moderators to execute injected script in the admin panel origin.
CVE-2026-110625Read original ↗ (opens in a new tab) - NVD
CVE-2026-110624 — Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other g…
Low · CVSS 4.0 2.3 · Assessor: [email protected]
Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and document types by supplying a group_id parameter. Attackers who know a group's UUID can query GET /tags/all or GET /document-types/all, which skip the user_belongs_to check, to disclose metadata of groups they do not belong to.
CVE-2026-110624Read original ↗ (opens in a new tab) - NVD
CVE-2026-110623 — Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticat…
High · CVSS 4.0 7.7 · Assessor: [email protected]
Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes/access/{node_id} to grant themselves any role, then read, modify, or delete victims' documents and revoke existing shares.
CVE-2026-110623Read original ↗ (opens in a new tab) - NVD
CVE-2026-110622 — Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate o…
High · CVSS 4.0 7.7 · Assessor: [email protected]
Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip has_node_perm checks. Attackers knowing page UUIDs can call /pages/, /pages/move, or /pages/extract to rotate, delete, or extract victims' pages, and trigger OCR via /tasks/ocr.
CVE-2026-110622Read original ↗ (opens in a new tab) - NVD
CVE-2026-110621 — Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authen…
High · CVSS 4.0 8.7 · Assessor: [email protected]
Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own organisation. Attackers can create an organisation and add a victim project by its public tracking ID to read analytics, change settings, or delete it.
CVE-2026-110621Read original ↗ (opens in a new tab) - NVD
CVE-2026-110620 — Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSe…
Medium · CVSS 4.0 6.1 · Assessor: [email protected]
Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId. Authenticated owners or managers of any organization can pair their own organization identifier with victim resource IDs to delete survey responses, modify segments and quotas, or alter pending invitations.
CVE-2026-110620Read original ↗ (opens in a new tab) - NVD
CVE-2026-110619 — frp 0.41.0 through 0.71.1 contains a missing authentication vulnerability that allows unauthenticated remote attackers to ac…
Medium · CVSS 4.0 6.3 · Assessor: [email protected]
frp 0.41.0 through 0.71.1 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access pprof debug endpoints because handlers are registered on the root mux outside Basic Authentication. Attackers can query /debug/pprof/ endpoints on frps dashboard or frpc admin listeners to obtain cmdline, goroutine stacks, heap profiles, and trigger CPU profiling.
CVE-2026-110619Read original ↗ (opens in a new tab) - NVD
CVE-2026-110618 — SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unauthen…
High · CVSS 4.0 8.6 · Assessor: [email protected]
SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unauthenticated network attackers to invoke remote-control APIs. Attackers can call the default-enabled endpoints to read SMS, call logs and contacts, send SMS, and export or overwrite configuration via the clone API.
CVE-2026-110618Read original ↗ (opens in a new tab) - NVD
CVE-2026-110617 — we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that…
Medium · CVSS 4.0 6.3 · Assessor: [email protected]
we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthenticated attackers to download export archives because its authentication dependency is commented out. Attackers can supply an mp_id and guessable timestamp-based export filename to retrieve archives under data/docs, and set delete_after_download=true to delete them.
CVE-2026-110617Read original ↗ (opens in a new tab) - NVD
CVE-2026-110616 — NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access th…
Critical · CVSS 4.0 9.2 · Assessor: [email protected]
NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the auth_token field defaults to null and is never assigned. Attackers sending requests without Authorization or Origin headers to non-loopback listeners can control agent instances, rewrite configurations including provider credentials, and manage cron jobs and MCP servers.
CVE-2026-110616Read original ↗ (opens in a new tab) - NVD
CVE-2026-110615 — jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows auth…
High · CVSS 4.0 7.1 · Assessor: [email protected]
jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to change other users' account status. Attackers can submit crafted ids and status values to disable every non-owner account in their tenant, locking out administrators, or re-enable disabled accounts.
CVE-2026-110615Read original ↗ (opens in a new tab) - NVD
CVE-2026-110614 — Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support generic query framework…
High · CVSS 4.0 7.1 · Assessor: [email protected]
Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support generic query framework that allows users to inject SQL via the sortBy request parameter. Attackers can reach any generic list route of controllers extending BaseQueryController or BaseQueryRestful to append unvalidated SQL to the ORDER BY clause and extract database contents using boolean- or time-based blind techniques.
CVE-2026-110614Read original ↗ (opens in a new tab) - NVD
CVE-2026-110613 — youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view…
High · CVSS 4.0 7.1 · Assessor: [email protected]
youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view every customer's orders via the app order list endpoint. Attackers can page through the oms_order table using a self-registered account to read order ids, order_sn values, member ids, payment amounts, and order status.
CVE-2026-110613Read original ↗ (opens in a new tab) - NVD
CVE-2026-110612 — vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs usin…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain super administrator access to any URL on vlife instances.
CVE-2026-110612Read original ↗ (opens in a new tab) - NVD
CVE-2026-110611 — REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a cal…
Medium · CVSS 4.0 6.0 · Assessor: [email protected]
REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a caller-supplied chatid without verifying ownership. Authenticated low-privilege users can supply another user's chatid to chat-init, chat-delete, chat-feedback, or chat-stream-stop to read, delete, exfiltrate, or interrupt AI assistant conversations.
CVE-2026-110611Read original ↗ (opens in a new tab) - NVD
CVE-2026-110610 — ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch arbitrary URLs by supplying referImageUrl to the midjourney imagine endpoint. Attackers can force Hutool HttpUtil.downloadBytes() requests to loopback, private, or cloud metadata addresses to probe internal-only HTTP services and reach metadata endpoints.
CVE-2026-110610Read original ↗ (opens in a new tab) - NVD
CVE-2026-110609 — Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged…
High · CVSS 4.0 7.1 · Assessor: [email protected]
Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the queryErpOrderItem MyBatis statement using raw ${} substitution. Attackers can send crafted keyword values to the queryWarehousingDetails or queryOutgoingDetails endpoints to extract database data, including other tenants' data, using boolean, UNION, error or time-based techniques.
CVE-2026-110609Read original ↗ (opens in a new tab) - NVD
CVE-2026-110608 — BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerability in the OrderController…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerability in the OrderController cancel and receive handlers that allows authenticated members to act on other members' orders by supplying their orderId. Attackers can cancel victims' pending orders to release allocated stock or confirm receipt of shipped orders, advancing fulfilment and settlement without the victim's consent.
CVE-2026-110608Read original ↗ (opens in a new tab) - NVD
CVE-2026-110607 — BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated bu…
High · CVSS 4.0 7.1 · Assessor: [email protected]
BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling the PaymentController.testPostPay handler. Attackers can generate a payment log via /member/payment/load and request /member/payment/test_post_pay_{paymentLogSn} to obtain goods without paying or settle other members' orders.
CVE-2026-110607Read original ↗ (opens in a new tab) - NVD
CVE-2026-110606 — LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgR…
Medium · CVSS 4.0 4.8 · Assessor: [email protected]
LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader() caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the decrypted header to read adjacent stack memory and crash the process.
CVE-2026-110606Read original ↗ (opens in a new tab) - NVD
CVE-2026-110605 — libschrift through 0.10.2 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a…
Medium · CVSS 4.0 6.8 · Assessor: [email protected]
libschrift through 0.10.2 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a font with unitsPerEm of 0 in the head table. Attackers can provide a crafted TrueType font whose NaN glyph coordinates bypass clip_points(), causing an out-of-bounds raster read in draw_line() during sft_render() and crashing the process.
CVE-2026-110605Read original ↗ (opens in a new tab) - NVD
CVE-2026-110604 — Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxml_strtod() when the locale decimal point…
Low · CVSS 4.0 2.0 · Assessor: [email protected]
Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxml_strtod() when the locale decimal point is not '.'. Attackers can supply XML with a 63-digit REAL value followed by '.' to write a NUL byte past the 64-byte stack buffer, corrupting stack memory or crashing the process.
CVE-2026-110604Read original ↗ (opens in a new tab) - NVD
CVE-2026-110603 — LASzip through 3.5.0 contains an invalid free vulnerability in laszip_read_header() that allows attackers to free uninitiali…
Medium · CVSS 4.0 5.8 · Assessor: [email protected]
LASzip through 3.5.0 contains an invalid free vulnerability in laszip_read_header() that allows attackers to free uninitialized heap pointers via truncated variable length record data. Attackers can supply a crafted LAS/LAZ file with an inflated VLR count that, when opened and destroyed through the C API, crashes the process and corrupts the heap.
CVE-2026-110603Read original ↗ (opens in a new tab) - NVD
CVE-2026-110602 — libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajd_open() in mspack/kwajd.c that free…
Medium · CVSS 4.0 5.8 · Assessor: [email protected]
libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajd_open() in mspack/kwajd.c that frees unzeroed filename and extra pointers on header read errors. Attackers can supply a truncated, empty, or wrong-signature KWAJ file to crash the process or obtain an arbitrary-free memory corruption primitive.
CVE-2026-110602Read original ↗ (opens in a new tab) - NVD
CVE-2026-110601 — libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out-of-bounds write vulnerability in gif_init_frame() in s…
Medium · CVSS 4.0 5.8 · Assessor: [email protected]
libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out-of-bounds write vulnerability in gif_init_frame() in src/fromgif.c, which never checks the GIF transparent color index against the palette size. Attackers can supply a crafted GIF with a small color table and large transparent index, processed with a background color set, to write bytes past the palette buffer, causing heap corruption or crashes.
CVE-2026-110601Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.