PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

Every cached source, newest first. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

16,907 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  2. NVD

    CVE-2026-105390 — Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7 allows…

    Medium · CVSS 4.0 6.9 · Assessor: [email protected]

    Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7 allows local attackers to trigger a deadlock via a crafted write to the ovpn-dco device, causing the host to become unresponsive.

    CVE-2026-105390
    Read original (opens in a new tab)
  3. NVD

    CVE-2026-97381 — Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 con…

    Critical · CVSS 3.1 9.9 · Assessor: [email protected]

    Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the hosting document's hostname, a hostname that is not on the permitted list falls through without setting E_ACCESSDENIED, causing IsPermitted to return S_OK. An attacker who induces a user to visit a malicious webpage in Internet Explorer can invoke the control to enumerate update a…

    CVE-2026-97381
    Read original (opens in a new tab)
  5. NVD

    CVE-2026-95633 — CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result i…

    High · CVSS 3.1 7.5 · Assessor: [email protected]

    CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

    CVE-2026-95633
    Read original (opens in a new tab)
  6. NVD

    CVE-2026-95632 — CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result i…

    High · CVSS 3.1 7.5 · Assessor: [email protected]

    CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

    CVE-2026-95632
    Read original (opens in a new tab)
  7. NVD

    CVE-2026-94453 — Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connectio…

    High · CVSS 3.1 7.5 · Assessor: d42dc95b-23f1-4e06-9076-20753a0fb0df

    Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to iface_endpoint inside ike_sa.sa->st_iface_endpoint. Once this invalid pointer is used, the daemon crashes and restarts. This vulnerability can be triggered before the remote peer has authenticated itself. Continued exploita…

    CVE-2026-94453
    Read original (opens in a new tab)
  11. NVD

    CVE-2026-77207 — Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan…

    High · CVSS 3.1 7.5 · Assessor: d42dc95b-23f1-4e06-9076-20753a0fb0df

    Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then iterates the certificate list with SEC_PKCS7GetCertificateList(). The two NSS APIs disagree on a SignedData that carries a CRL but no certificates: ContainsCertsOrCrls() returns PR_TRUE (there is a CRL), so the guard passes, but GetCertificateList() returns NULL…

    CVE-2026-77207
    Read original (opens in a new tab)
  12. NVD

    CVE-2026-77206 — Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result…

    High · CVSS 3.1 7.5 · Assessor: d42dc95b-23f1-4e06-9076-20753a0fb0df

    Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike->sa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pl…

    CVE-2026-77206
    Read original (opens in a new tab)
  13. NVD

    CVE-2026-77205 — Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the N…

    Low · CVSS 3.1 3.7 · Assessor: d42dc95b-23f1-4e06-9076-20753a0fb0df

    Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimate peers from connecting. The add_decoded_cert() function missed a call to CERT_DestroyCertificate() due to an incorrect fix for CVE-2026-14957. Sending bogus certificates with new serial numbers could prevent the real certificates with those serial numbers fro…

    CVE-2026-77205
    Read original (opens in a new tab)
  14. NVD

    CVE-2026-48378 — CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature by…

    Medium · CVSS 3.1 5.3 · Assessor: [email protected]

    CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue does not require user interaction.

    CVE-2026-48378
    Read original (opens in a new tab)
  15. NVD

    CVE-2026-48377 — CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature by…

    Medium · CVSS 3.1 5.3 · Assessor: [email protected]

    CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue does not require user interaction.

    CVE-2026-48377
    Read original (opens in a new tab)
  23. NVD

    CVE-2026-110165 — Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execut…

    Critical · CVSS 3.1 9.6 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

    CVE-2026-110165
    Read original (opens in a new tab)
  24. NVD

    CVE-2026-110164 — Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary cod…

    High · CVSS 3.1 8.8 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    CVE-2026-110164
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.