THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
Every cached source, newest first. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,973 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUp to date · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-96956 — Stack-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.
High · CVSS 3.1 8.0 · Assessor: [email protected]
Stack-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-96956Read original ↗ (opens in a new tab) - NVD
CVE-2026-96523 — Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the c…
High · CVSS 3.1 7.8 · Assessor: [email protected]
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-96523Read original ↗ (opens in a new tab) - NVD
CVE-2026-96522 — Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the c…
High · CVSS 3.1 7.8 · Assessor: [email protected]
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-96522Read original ↗ (opens in a new tab) - NVD
CVE-2026-96521 — Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the c…
High · CVSS 3.1 7.8 · Assessor: [email protected]
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-96521Read original ↗ (opens in a new tab) - NVD
CVE-2026-95696 — IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of se…
High · CVSS 3.1 7.5 · Assessor: [email protected]
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception.
CVE-2026-95696Read original ↗ (opens in a new tab) - NVD
CVE-2026-95695 — IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security rest…
Critical · CVSS 3.1 9.1 · Assessor: [email protected]
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.
CVE-2026-95695Read original ↗ (opens in a new tab) - NVD
CVE-2026-95641 — Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the c…
High · CVSS 3.1 7.8 · Assessor: [email protected]
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-95641Read original ↗ (opens in a new tab) - NVD
CVE-2026-95640 — Photoshop Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-serv…
Medium · CVSS 3.1 5.5 · Assessor: [email protected]
Photoshop Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-95640Read original ↗ (opens in a new tab) - NVD
CVE-2026-95639 — Photoshop Desktop is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in t…
High · CVSS 3.1 8.6 · Assessor: [email protected]
Photoshop Desktop is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
CVE-2026-95639Read original ↗ (opens in a new tab) - NVD
CVE-2026-95638 — Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in…
High · CVSS 3.1 7.8 · Assessor: [email protected]
Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-95638Read original ↗ (opens in a new tab) - NVD
CVE-2026-95637 — Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the c…
High · CVSS 3.1 7.8 · Assessor: [email protected]
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-95637Read original ↗ (opens in a new tab) - NVD
CVE-2026-95636 — Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code executi…
High · CVSS 3.1 7.8 · Assessor: [email protected]
Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-95636Read original ↗ (opens in a new tab) - NVD
CVE-2026-95635 — Photoshop Desktop is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of…
High · CVSS 3.1 7.8 · Assessor: [email protected]
Photoshop Desktop is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-95635Read original ↗ (opens in a new tab) - NVD
CVE-2026-94520 — Use of externally-controlled format string in SQL Server allows an authorized attacker to deny service over a network.
Medium · CVSS 3.1 4.9 · Assessor: [email protected]
Use of externally-controlled format string in SQL Server allows an authorized attacker to deny service over a network.
CVE-2026-94520Read original ↗ (opens in a new tab) - NVD
CVE-2026-94512 — Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
High · CVSS 3.1 8.8 · Assessor: [email protected]
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
CVE-2026-94512Read original ↗ (opens in a new tab) - NVD
CVE-2026-93909 — IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerabilit…
Critical · CVSS 3.1 9.1 · Assessor: [email protected]
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.
CVE-2026-93909Read original ↗ (opens in a new tab) - NVD
CVE-2026-93905 — IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corr…
High · CVSS 3.1 8.2 · Assessor: [email protected]
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances.
CVE-2026-93905Read original ↗ (opens in a new tab) - NVD
CVE-2026-93895 — IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to byp…
Critical · CVSS 3.1 9.1 · Assessor: [email protected]
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.
CVE-2026-93895Read original ↗ (opens in a new tab) - NVD
CVE-2026-90530 — ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerabilit…
Critical · CVSS 3.1 9.3 · Assessor: [email protected]
ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed. RDS is purely a development feature meant for debugging purposes, and switching ColdFusion to Production Secure Profile automatically disables R…
CVE-2026-90530Read original ↗ (opens in a new tab) - NVD
CVE-2026-88089 — Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.
Medium · CVSS 3.1 6.7 · Assessor: [email protected]
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.
CVE-2026-88089Read original ↗ (opens in a new tab) - NVD
CVE-2026-88088 — Integer overflow or wraparound in SQL Server allows an authorized attacker to elevate privileges locally.
High · CVSS 3.1 7.0 · Assessor: [email protected]
Integer overflow or wraparound in SQL Server allows an authorized attacker to elevate privileges locally.
CVE-2026-88088Read original ↗ (opens in a new tab) - NVD
CVE-2026-88086 — Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over an adjacent network.
Medium · CVSS 3.1 5.3 · Assessor: [email protected]
Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over an adjacent network.
CVE-2026-88086Read original ↗ (opens in a new tab) - NVD
CVE-2026-88085 — Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.
Medium · CVSS 3.1 6.4 · Assessor: [email protected]
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.
CVE-2026-88085Read original ↗ (opens in a new tab) - NVD
CVE-2026-88084 — Allocation of resources without limits or throttling in SQL Server allows an authorized attacker to deny service over a netw…
Medium · CVSS 3.1 5.3 · Assessor: [email protected]
Allocation of resources without limits or throttling in SQL Server allows an authorized attacker to deny service over a network.
CVE-2026-88084Read original ↗ (opens in a new tab) - NVD
CVE-2026-88083 — Stack-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
High · CVSS 3.1 7.5 · Assessor: [email protected]
Stack-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
CVE-2026-88083Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.