PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

Every cached source, newest first. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

16,907 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  1. NVD

    CVE-2026-103307 — The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input…

    High · CVSS 3.1 8.6 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement, and verifies its payment webhook with a signing secret that is empty by default, allowing unauthenticated attackers to perform SQL injection attacks and to mark arbitrary orders as paid.

    CVE-2026-103307
    Read original (opens in a new tab)
  2. NVD

    CVE-2026-94370 — A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quic…

    Medium · CVSS 4.0 6.5 · Assessor: a59d8014-47c4-4630-ab43-e1b13cbe58e3

    A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::String interface type, and that text is held in a std::string, the conversion to the internal string type copies the pointer without taking ownership of it. Two objects then release the same memory, producing a double free, an invalid free, or a use-after-free.

    CVE-2026-94370
    Read original (opens in a new tab)
  3. NVD

    CVE-2026-50218 — Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding.…

    High · CVSS 3.1 8.5 · Assessor: [email protected]

    Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding. By convincing a user to interact with a malicious link, an attacker can use a spoofed JWT token to inject arbitrary parameters into the client software, resulting in unauthorized reconfiguration and full compromise of the application's functionality. This attack can also be targeted against an already seeded client if the attacker knows the URL of the IDP that the client used for enrollment.

    CVE-2026-50218
    Read original (opens in a new tab)
  4. NVD

    CVE-2026-50217 — A use-after-free vulnerability in the Windows WFP callout driver of Akamai Guardicore Platform Agent (GPA) allows a local lo…

    Medium · CVSS 3.1 4.7 · Assessor: [email protected]

    A use-after-free vulnerability in the Windows WFP callout driver of Akamai Guardicore Platform Agent (GPA) allows a local low-privileged user to cause a denial of service (system crash / BSOD) via an outbound ICMPv6 packet containing an IPv6 Hop-by-Hop extension header. When the IPv6 ICMP redirect policy is active, the packet is copied into a buffer that is freed but subsequently passed to a downstream filter. The size of the freed allocation is attacker-controlled (via packet length), enabling kernel pool groomin…

    CVE-2026-50217
    Read original (opens in a new tab)
  5. NVD

    CVE-2026-50216 — An integer underflow exists in the DNS proxy component of the macOS NetworkExtension system extension shipped with Akamai Gu…

    Medium · CVSS 3.1 5.3 · Assessor: [email protected]

    An integer underflow exists in the DNS proxy component of the macOS NetworkExtension system extension shipped with Akamai Guardicore Platform Agent (GPA) for macOS, whereby if a UDP datagram shorter than 96 bytes that begins with a specific value is received, a subsequent size computation underflows to a near-SIZE_MAX value, causing an allocation failure and uncaught Objective-C exception that aborts the root system extension.

    CVE-2026-50216
    Read original (opens in a new tab)
  6. NVD

    CVE-2026-110459 — A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect A…

    High · CVSS 3.1 8.6 · Assessor: fe490ce8-0395-4072-90d8-2707e1bdf984

    A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain information, make unauthorized changes, and execute a Denial of Service (DoS) attack on the device.

    CVE-2026-110459
    Read original (opens in a new tab)
  10. NVD

    CVE-2026-50215 — A use-after-free exists in the Windows WFP packet-capture driver shipped with Akamai Guardicore Platform Agent (GPA) before…

    Medium · CVSS 3.1 4.4 · Assessor: [email protected]

    A use-after-free exists in the Windows WFP packet-capture driver shipped with Akamai Guardicore Platform Agent (GPA) before 7.4. When an IPv6 proxy/redirect rule is active, a local attacker with Administrator privileges can send a single crafted outbound IPv6 packet via a raw IPV6_HDRINCL socket to trigger this at DISPATCH_LEVEL, resulting in an immediate system crash.

    CVE-2026-50215
    Read original (opens in a new tab)
  11. NVD

    CVE-2026-46449 — The Akamai Guardicore Platform Agent (GPA) before 7.4 for macOS is affected by a local privilege escalation vulnerability wi…

    Medium · CVSS 3.1 6.7 · Assessor: [email protected]

    The Akamai Guardicore Platform Agent (GPA) before 7.4 for macOS is affected by a local privilege escalation vulnerability within the wapptunneld component. The vulnerability is caused by a lack of input validation when the service uses network interface names to execute system utilities, resulting in command injection. An unprivileged local user with permissions to modify network interface names can exploit this by renaming a network interface to include a malicious shell payload via System Settings. When the "Log…

    CVE-2026-46449
    Read original (opens in a new tab)
  12. NVD

    CVE-2026-110456 — A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerabi…

    Medium · CVSS 3.1 5.3 · Assessor: fe490ce8-0395-4072-90d8-2707e1bdf984

    A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access internal resources through the device.

    CVE-2026-110456
    Read original (opens in a new tab)
  13. NVD

    CVE-2026-110455 — A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnera…

    High · CVSS 3.1 8.1 · Assessor: fe490ce8-0395-4072-90d8-2707e1bdf984

    A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI Key to execute a Command Injection on the device.

    CVE-2026-110455
    Read original (opens in a new tab)
  20. NVD

    CVE-2026-105429 — Improper neutralization of special elements in the NetBird client SSH configuration manager (client/ssh/config/manager.go) i…

    High · CVSS 4.0 8.9 · Assessor: 33c584b5-0579-4c06-b2a0-8d8329fcab9c

    Improper neutralization of special elements in the NetBird client SSH configuration manager (client/ssh/config/manager.go) in NetBird versions 0.60.0 through 0.74.6 allows a malicious or compromised peer to execute arbitrary commands on other NetBird client hosts. The client writes a system-wide OpenSSH drop-in file (/etc/ssh/ssh_config.d/99-netbird.conf, or the equivalent under %PROGRAMDATA%\ssh\ssh_config.d on Windows) that embeds each peer FQDN or hostname inside a double-quoted Match host directive without esc…

    CVE-2026-105429
    Read original (opens in a new tab)
  21. NVD

    CVE-2026-103369 — The Social Share Buttons & Analytics Plugin – GetSocial.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting…

    Medium · CVSS 3.1 6.4 · Assessor: [email protected]

    The Social Share Buttons & Analytics Plugin – GetSocial.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'response' parameter in all versions up to, and including, 4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is stored in the gs-alert-msg, gs-alert-utm, and…

    CVE-2026-103369
    Read original (opens in a new tab)
  22. NVD

    CVE-2026-101926 — The Hyyan WooCommerce Polylang Integration plugin for WordPress is vulnerable to SQL Injection via the 'variation_ids' param…

    Medium · CVSS 3.1 6.5 · Assessor: [email protected]

    The Hyyan WooCommerce Polylang Integration plugin for WordPress is vulnerable to SQL Injection via the 'variation_ids' parameter of the 'woocommerce_remove_variations' AJAX action in versions up to, and including, 1.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to ex…

    CVE-2026-101926
    Read original (opens in a new tab)
  23. NVD

    CVE-2026-101924 — The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.5 v…

    High · CVSS 3.1 7.2 · Assessor: [email protected]

    The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.5 via the 'Last referrers' meta box on the plugin's Overview admin page. This is due to insufficient output escaping of the visitor-supplied query string that the plugin records in its statistics table: the newstatpress_generate_overview_lastreferrers() function concatenates the stored urlrequested value into a single-quoted href attribute after only FILTER_SANITIZE_URL, which does not encode th…

    CVE-2026-101924
    Read original (opens in a new tab)
  24. NVD

    CVE-2026-97471 — The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and i…

    Medium · CVSS 3.1 5.3 · Assessor: [email protected]

    The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.16.1 via the 'args[link_target]' parameter. This makes it possible for unauthenticated attackers to extract arbitrary user meta values for any user ID, including administrator email addresses, login names, wp_user_level, and WooCommerce customer PII such as billing_email, billing_phone, and billing_address_1. The awb-instagram-nonce required to trigger this endpoint is printed in…

    CVE-2026-97471
    Read original (opens in a new tab)
  25. NVD

    CVE-2026-97398 — The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode At…

    High · CVSS 3.1 7.2 · Assessor: [email protected]

    The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and including, 7.5.54.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the 'Parse Vimeo and YouTube links' (parse_comments) option to be enabled and the liststyle attribute set to…

    CVE-2026-97398
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.