PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

Every cached source, newest first. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

16,910 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  2. NVD

    CVE-2026-82026 — Radar before 1.12.2 contains a missing authorization vulnerability in the handleLocalTerminal WebSocket endpoint (/api/local…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    Radar before 1.12.2 contains a missing authorization vulnerability in the handleLocalTerminal WebSocket endpoint (/api/local-terminal) that allows authenticated or unauthenticated attackers to spawn a privileged shell by relying only on a runtime-mode check instead of role-based access control. Attackers can connect to the endpoint to execute /bin/bash -l on the Radar host with Radar's own kubeconfig and process credentials injected into the shell environment, achieving remote code execution with Radar's privilege…

    CVE-2026-82026
    Read original (opens in a new tab)
  3. NVD

    CVE-2026-16741 — Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TR7 Cyber ​​Defe…

    Critical · CVSS 3.1 9.8 · Assessor: [email protected]

    Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TR7 Cyber ​​Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber ​​Defense Inc. TR7 ASP on physical appliance allows OS Command Injection. This issue affects TR7 ASP: from 1.0.40.236 before 1.0.1554.2331; TR7 ASP: from 1.6.42.239 before 1.6.1554.2331.

    CVE-2026-16741
    Read original (opens in a new tab)
  4. NVD

    CVE-2026-16740 — Missing authentication for critical function vulnerability in TR7 Cyber ​​Defense Inc. TR7 ASP on virtual appliance and TR7…

    Critical · CVSS 3.1 9.8 · Assessor: [email protected]

    Missing authentication for critical function vulnerability in TR7 Cyber ​​Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber ​​Defense Inc. TR7 ASP on physical appliance allows OS Command Injection. This issue affects TR7 ASP: from 1.0.40.236 before 1.0.1554.2331; TR7 ASP: from 1.6.42.239 before 1.6.1554.2331.

    CVE-2026-16740
    Read original (opens in a new tab)
  5. NVD

    CVE-2026-109968 — A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon logs LUKS disk encryption passphra…

    Medium · CVSS 3.1 5.5 · Assessor: [email protected]

    A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon logs LUKS disk encryption passphrases in plaintext to a log file. The log file is created without restrictive permissions, making it world-readable under the default process umask. A local attacker can read the log file to obtain the LUKS passphrase.

    CVE-2026-109968
    Read original (opens in a new tab)
  7. NVD

    CVE-2026-107867 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetProductT…

    High · CVSS 3.1 7.1 · Assessor: [email protected]

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetProductTables jet-product-tables allows Reflected XSS.This issue affects JetProductTables: from n/a through 1.2.4.

    CVE-2026-107867
    Read original (opens in a new tab)
  8. NVD

    CVE-2026-107433 — Missing Authorization vulnerability in miniOrange WP OAuth Server miniorange-oauth-20-server allows Exploiting Incorrectly C…

    Medium · CVSS 3.1 6.5 · Assessor: [email protected]

    Missing Authorization vulnerability in miniOrange WP OAuth Server miniorange-oauth-20-server allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP OAuth Server: from n/a through 6.4.0.

    CVE-2026-107433
    Read original (opens in a new tab)
  9. NVD

    CVE-2026-107426 — Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incor…

    High · CVSS 3.1 7.3 · Assessor: [email protected]

    Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.

    CVE-2026-107426
    Read original (opens in a new tab)
  10. NVD

    CVE-2026-107425 — Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat…

    Medium · CVSS 3.1 6.5 · Assessor: [email protected]

    Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through 5.9.7.

    CVE-2026-107425
    Read original (opens in a new tab)
  12. NVD

    CVE-2026-107422 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in axew3.com WP w3all php…

    Medium · CVSS 3.1 6.5 · Assessor: [email protected]

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in axew3.com WP w3all phpBB wp-w3all-phpbb-integration allows Stored XSS.This issue affects WP w3all phpBB: from n/a through 3.1.0.

    CVE-2026-107422
    Read original (opens in a new tab)
  14. NVD

    CVE-2026-107417 — Missing Authorization vulnerability in Muralidharan Ramasamy Push Notification for Post and BuddyPress push-notification-for…

    Medium · CVSS 3.1 6.5 · Assessor: [email protected]

    Missing Authorization vulnerability in Muralidharan Ramasamy Push Notification for Post and BuddyPress push-notification-for-post-and-buddypress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Push Notification for Post and BuddyPress: from n/a through 3.23.

    CVE-2026-107417
    Read original (opens in a new tab)
  17. NVD

    CVE-2026-85298 — An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Appl…

    High · CVSS 4.0 7.3 · Assessor: f45cbf4e-4146-4068-b7e1-655ffc2c548c

    An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration versions prior to 2026-08-27 allows an authenticated user to escalate privileges and impersonate a service account in the project. This vulnerability was patched on 27 August 2026, and no customer action is needed.

    CVE-2026-85298
    Read original (opens in a new tab)
  21. NVD

    CVE-2026-97315 — The Responsive Blocks WordPress plugin before 2.3.0 does not sanitise or escape some of the values submitted with its Form b…

    Medium · CVSS 3.1 5.4 · Assessor: [email protected]

    The Responsive Blocks WordPress plugin before 2.3.0 does not sanitise or escape some of the values submitted with its Form block before adding them to the HTML notification email sent to the site owner, allowing unauthenticated users to inject arbitrary HTML, such as phishing links, into that email.

    CVE-2026-97315
    Read original (opens in a new tab)
  22. NVD

    CVE-2026-88998 — The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integrity of incoming payment notifications, and t…

    Medium · CVSS 3.1 5.3 · Assessor: [email protected]

    The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integrity of incoming payment notifications, and the validated signature does not cover the order or the amount, allowing unauthenticated attackers to forge a payment confirmation and mark arbitrary orders as paid without paying.

    CVE-2026-88998
    Read original (opens in a new tab)
  23. NVD

    CVE-2026-88842 — A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. Wh…

    Low · CVSS 3.1 3.3 · Assessor: [email protected]

    A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.

    CVE-2026-88842
    Read original (opens in a new tab)
  24. NVD

    CVE-2026-82844 — The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a…

    Medium · CVSS 3.1 5.3 · Assessor: [email protected]

    The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway, allowing unauthenticated visitors to submit paid forms without paying. The form's confirmation is delivered and its notification emails are sent even though no order exists at the payment provider and no payment is recorded.

    CVE-2026-82844
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.