PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

The complete recent NVD stream, including unscored entries. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

17,017 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  1. NVD

    CVE-2026-103905 — The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logo…

    High · CVSS 4.0 8.7 · Assessor: a6d3dc9e-0591-4a13-bce7-0f5b31ff6158

    The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking whether the requesting user is authenticated. An unauthenticated remote attacker can therefore switch the shop's plugin safe mode on and off, which deactivates all installed plugins and their functionality, such as payment and shipping integrations, resulting in a shop-wide denial of service. The attack requires a single request and can be automated against many insta…

    CVE-2026-103905
    Read original (opens in a new tab)
  2. NVD

    CVE-2026-103904 — The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating the…

    High · CVSS 4.0 8.6 · Assessor: a6d3dc9e-0591-4a13-bce7-0f5b31ff6158

    The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent items. These names are stored in the consent statistics and rendered without output encoding in the administration backend. An unauthenticated remote attacker can thereby inject script code that is executed in the browser session of an administrator viewing the consent statistics page, allowing actions to be performed with the administrator's privileges.

    CVE-2026-103904
    Read original (opens in a new tab)
  3. NVD

    CVE-2026-103358 — Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Email Template Customizer for WooComme…

    High · CVSS 3.1 7.5 · Assessor: [email protected]

    Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Code Injection.This issue affects Email Template Customizer for WooCommerce: from n/a through 1.3.4.

    CVE-2026-103358
    Read original (opens in a new tab)
  4. NVD

    CVE-2026-103308 — The Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the authenticity of payment gateway return reque…

    Medium · CVSS 3.1 6.5 · Assessor: [email protected]

    The Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the authenticity of payment gateway return requests, relying on a merchant secret that is empty on a store which has not entered its credentials, allowing unauthenticated attackers to mark arbitrary orders as paid and to disclose the name, email address and postal address of any order's customer.

    CVE-2026-103308
    Read original (opens in a new tab)
  5. NVD

    CVE-2026-101341 — Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved for th…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse. Zone files which are written out by NSD itself, such for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlle…

    CVE-2026-101341
    Read original (opens in a new tab)
  6. NVD

    CVE-2026-101339 — A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rendezvous server)…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rendezvous server) can overwrite the stack with up to 191 bytes of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).

    CVE-2026-101339
    Read original (opens in a new tab)
  7. NVD

    CVE-2026-101338 — When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write attacker controlled data of unlimited size. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).

    CVE-2026-101338
    Read original (opens in a new tab)
  8. NVD

    CVE-2026-101337 — When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).

    CVE-2026-101337
    Read original (opens in a new tab)
  9. NVD

    CVE-2026-101301 — The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen before e…

    Medium · CVSS 3.1 5.3 · Assessor: [email protected]

    The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen before entering its snippet safe mode, allowing unauthenticated visitors to disable all of the site's automatically inserted snippets for their own requests.

    CVE-2026-101301
    Read original (opens in a new tab)
  10. NVD

    CVE-2026-100229 — A flaw was found in GStreamer's H.266 codec parser library (libgstcodecparsers). An out-of-bounds write vulnerability exists…

    Medium · CVSS 3.1 6.5 · Assessor: [email protected]

    A flaw was found in GStreamer's H.266 codec parser library (libgstcodecparsers). An out-of-bounds write vulnerability exists in the DCI parsing function, where a reserved field value is incorrectly accepted, causing the parser to write beyond the bounds of an internal structure. An attacker could exploit this by providing a specially crafted H.266 bitstream to a third-party application that uses this library API, potentially causing a crash or memory corruption. No standard GStreamer pipeline element currently inv…

    CVE-2026-100229
    Read original (opens in a new tab)
  11. NVD

    CVE-2026-90954 — A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archi…

    High · CVSS 3.1 7.8 · Assessor: [email protected]

    A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can exploit this ordering: the first member declares a symlink pointing to an absolute path (e.g., '/'), which is deferred as unsafe but flushed after the first member. The second member declares a regular file whose path traverses the now-live…

    CVE-2026-90954
    Read original (opens in a new tab)
  12. NVD

    CVE-2026-88829 — A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL p…

    High · CVSS 3.1 7.2 · Assessor: [email protected]

    A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. An attacker can send a pipelined second request that is relayed verbatim to the backend, bypassing the configured path restrictions. This allows accessing arbitrary paths on the backend server that were not intended to be exposed through the proxy.

    CVE-2026-88829
    Read original (opens in a new tab)
  13. NVD

    CVE-2026-86476 — A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached G…

    High · CVSS 3.1 8.4 · Assessor: [email protected]

    A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets that exceed the actual backing memory allocation. The metadata is not range-checked during deserialization, and the video frame mapping code does not verify that the declared plane geometry fits within the buffer before allowing consumers to read or write video data. A local attacker who controls the sending side of a GStreamer inter-pro…

    CVE-2026-86476
    Read original (opens in a new tab)
  18. NVD

    CVE-2026-109971 — A flaw was found in the clevis PKCS#11 pin. The clevis-decrypt-pkcs11 script passes the PKCS#11 token PIN as a command-line…

    Medium · CVSS 3.1 4.7 · Assessor: [email protected]

    A flaw was found in the clevis PKCS#11 pin. The clevis-decrypt-pkcs11 script passes the PKCS#11 token PIN as a command-line argument to pkcs11-tool, making it visible to any local user through process listing or the /proc filesystem.

    CVE-2026-109971
    Read original (opens in a new tab)
  19. NVD

    CVE-2026-109970 — A flaw was found in the clevis PKCS#11 pin. The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext t…

    Medium · CVSS 3.1 4.7 · Assessor: [email protected]

    A flaw was found in the clevis PKCS#11 pin. The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to a file without setting restrictive permissions. Under the default process umask, the file is world-readable. Additionally, the PIN file is not reliably cleaned up if the decryption script exits early, leaving the PIN accessible indefinitely.

    CVE-2026-109970
    Read original (opens in a new tab)
  20. NVD

    CVE-2026-109969 — A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon creates AF_UNIX sockets without ex…

    Medium · CVSS 3.1 4.7 · Assessor: [email protected]

    A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon creates AF_UNIX sockets without explicit permission restrictions or peer credential verification. Under a permissive process umask, any local user can connect to the control socket and inject arbitrary device/key pairs, or connect to the data socket to receive LUKS passphrases.

    CVE-2026-109969
    Read original (opens in a new tab)
  21. NVD

    CVE-2026-100231 — A flaw was found in the GStreamer multimedia framework's ASF muxer plugin (asfmux). When writing string metadata tags contai…

    Medium · CVSS 3.1 6.1 · Assessor: [email protected]

    A flaw was found in the GStreamer multimedia framework's ASF muxer plugin (asfmux). When writing string metadata tags containing Unicode characters outside the Basic Multilingual Plane (such as emoji) to an ASF container, the plugin incorrectly calculates the buffer size needed for the UTF-16LE representation. The size calculation assumes each Unicode code point requires 2 bytes, but non-BMP characters require 4 bytes (surrogate pairs). This leads to a heap out-of-bounds write when the actual UTF-16LE conversion i…

    CVE-2026-100231
    Read original (opens in a new tab)
  23. NVD

    CVE-2026-14851 — A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which expose…

    Critical · CVSS 4.0 9.2 · Assessor: [email protected]

    A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information (PII) and financial data – including customer names, addresses, invoice numbers, payment details and tax information – to unauthorised individuals. The issue is caused by a lack of authorisation checks at the endpoint responsible for serving PDF invoice files. Furthermore, some URLs for invoicing documents appear to be publicly accessible via search engin…

    CVE-2026-14851
    Read original (opens in a new tab)
  24. NVD

    CVE-2026-107428 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid…

    High · CVSS 3.1 7.1 · Assessor: [email protected]

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Reflected XSS.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.

    CVE-2026-107428
    Read original (opens in a new tab)
  25. NVD

    CVE-2026-103671 — External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin"…

    Medium · CVSS 4.0 5.3 · Assessor: [email protected]

    External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained.

    CVE-2026-103671
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.