THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
Every cached source, newest first. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,973 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUp to date · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-106619 — ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the co…
Critical · CVSS 3.1 9.0 · Assessor: [email protected]
ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-106619Read original ↗ (opens in a new tab) - NVD
CVE-2026-106618 — ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the cont…
High · CVSS 3.1 8.8 · Assessor: [email protected]
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-106618Read original ↗ (opens in a new tab) - NVD
CVE-2026-106617 — ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the cont…
High · CVSS 3.1 8.8 · Assessor: [email protected]
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-106617Read original ↗ (opens in a new tab) - NVD
CVE-2026-106616 — ColdFusion is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to…
High · CVSS 3.1 8.6 · Assessor: [email protected]
ColdFusion is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-106616Read original ↗ (opens in a new tab) - NVD
CVE-2026-106615 — ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the cont…
High · CVSS 3.1 8.8 · Assessor: [email protected]
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-106615Read original ↗ (opens in a new tab) - NVD
CVE-2026-106614 — ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the cont…
High · CVSS 3.1 7.8 · Assessor: [email protected]
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-106614Read original ↗ (opens in a new tab) - NVD
CVE-2026-106613 — ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the co…
High · CVSS 3.1 8.8 · Assessor: [email protected]
ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.
CVE-2026-106613Read original ↗ (opens in a new tab) - NVD
CVE-2026-106612 — ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the cont…
Critical · CVSS 3.1 9.9 · Assessor: [email protected]
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-106612Read original ↗ (opens in a new tab) - NVD
CVE-2026-106090 — ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the cont…
High · CVSS 3.1 8.8 · Assessor: [email protected]
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-106090Read original ↗ (opens in a new tab) - NVD
CVE-2026-106089 — ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the cont…
High · CVSS 3.1 8.8 · Assessor: [email protected]
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-106089Read original ↗ (opens in a new tab) - NVD
CVE-2026-105994 — ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-pri…
High · CVSS 3.1 7.7 · Assessor: [email protected]
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-105994Read original ↗ (opens in a new tab) - NVD
CVE-2026-105903 — ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in ar…
Critical · CVSS 3.1 9.9 · Assessor: [email protected]
ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-105903Read original ↗ (opens in a new tab) - NVD
CVE-2026-105901 — ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the cont…
High · CVSS 3.1 8.8 · Assessor: [email protected]
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-105901Read original ↗ (opens in a new tab) - NVD
CVE-2026-105900 — ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service.…
High · CVSS 3.1 7.5 · Assessor: [email protected]
ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
CVE-2026-105900Read original ↗ (opens in a new tab) - NVD
CVE-2026-105899 — ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary co…
Critical · CVSS 3.1 10.0 · Assessor: [email protected]
ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-105899Read original ↗ (opens in a new tab) - NVD
CVE-2026-105898 — ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the cont…
High · CVSS 3.1 8.2 · Assessor: [email protected]
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
CVE-2026-105898Read original ↗ (opens in a new tab) - NVD
CVE-2026-105897 — ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Expl…
High · CVSS 3.1 8.6 · Assessor: [email protected]
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-105897Read original ↗ (opens in a new tab) - NVD
CVE-2026-105896 — Photoshop Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-serv…
Medium · CVSS 3.1 5.5 · Assessor: [email protected]
Photoshop Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-105896Read original ↗ (opens in a new tab) - NVD
CVE-2026-105443 — IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an…
High · CVSS 3.1 8.2 · Assessor: [email protected]
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install.
CVE-2026-105443Read original ↗ (opens in a new tab) - NVD
CVE-2026-105442 — IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Libe…
High · CVSS 3.1 7.5 · Assessor: [email protected]
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messaging service.
CVE-2026-105442Read original ↗ (opens in a new tab) - NVD
CVE-2026-104587 — blob42 gosuki through commit 6e2bf34 contains a Stored Cross-Site Scripting (XSS) vulnerability. The application uses text/t…
Medium · CVSS 3.1 5.4 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
blob42 gosuki through commit 6e2bf34 contains a Stored Cross-Site Scripting (XSS) vulnerability. The application uses text/template instead of html/template, failing to perform context-aware auto-escaping on the URL and DisplayURL fields of bookmarks in internal/webui/templates/bookmarks.html. An attacker can craft a malicious bookmark URL containing HTML attribute-breaking payloads that execute arbitrary JavaScript in the victim's browser context when rendered in the local web interface.
CVE-2026-104587Read original ↗ (opens in a new tab) - NVD
CVE-2026-104348 — Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in…
High · CVSS 3.1 7.8 · Assessor: [email protected]
Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-104348Read original ↗ (opens in a new tab) - NVD
CVE-2026-104347 — Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the c…
High · CVSS 3.1 7.8 · Assessor: [email protected]
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-104347Read original ↗ (opens in a new tab) - NVD
CVE-2026-104346 — Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the c…
High · CVSS 3.1 7.8 · Assessor: [email protected]
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-104346Read original ↗ (opens in a new tab) - NVD
CVE-2026-103829 — Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of…
Medium · CVSS 3.1 5.5 · Assessor: [email protected]
Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-103829Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.