PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

The complete recent NVD stream, including unscored entries. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

16,977 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  1. NVD

    CVE-2026-104995 — The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via t…

    High · CVSS 3.1 8.1 · Assessor: [email protected]

    The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajax_template' value parsed from the client-controlled 'bps_directory' cookie during BuddyPress AJAX directory requests. The bps_directory_ajax() filter (hooked onto bp_legacy_object_template_path and bp_nouveau_object_template_path) reads the cookie, applies only a referer-derived 'page' comparison in bps_get_directory_data() (where bps_current_page() uses HTTP_REFERER during AJAX and is…

    CVE-2026-104995
    Read original (opens in a new tab)
  2. NVD

    CVE-2026-104767 — The Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress is vulnerable to Privilege Escalat…

    High · CVSS 3.1 7.5 · Assessor: [email protected]

    The Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 20260828. This is due to the `maybe_add_role_to_user()` function unconditionally re-assigning every role stored in the `dfxwcrc_foreign_roles` user meta cache without verifying that each cached role is still actively assigned by the external provider — a condition made permanent by `remember_foreign_roles()`, which merges new foreign roles into the cache…

    CVE-2026-104767
    Read original (opens in a new tab)
  3. NVD

    CVE-2026-104749 — The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerab…

    High · CVSS 3.1 7.5 · Assessor: [email protected]

    The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Privilege Escalation via Log Re-execution in all versions up to, and including, 2.10.6 The vulnerability exists because `IntegrationHandler::executeWithCapture()` stores raw, attacker-controlled field values — including `user_pass` and `user_email` — verbatim into `wp_btcbi_log.field_data` on anonymous front-end requests with no capability check, and `LogHandler::reexecute()` feeds that…

    CVE-2026-104749
    Read original (opens in a new tab)
  4. NVD

    CVE-2026-103425 — The Booking Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions…

    Medium · CVSS 3.1 6.4 · Assessor: [email protected]

    The Booking Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.7.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

    CVE-2026-103425
    Read original (opens in a new tab)
  5. NVD

    CVE-2026-103423 — The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.29…

    High · CVSS 3.1 7.5 · Assessor: [email protected]

    The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.29 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve personally identifiable information for every booked customer stored in the booking_package_booked_customers table, including names, email addresses, phone numbers, physical addresses, and cancellation tokens. The nonce nominally pro…

    CVE-2026-103423
    Read original (opens in a new tab)
  6. NVD

    CVE-2026-110385 — A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker w…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account. The Document Builder API improperly processes user-controlled converter XML supplied through the optional third argument of builder.SaveFile(). By injecting a duplicate m_sFileTo element, an attacker can override the server-generated output path and write arbitrary content outside the de…

    CVE-2026-110385
    Read original (opens in a new tab)
  7. NVD

    CVE-2026-110359 — Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation. This is caused by a privileged se…

    High · CVSS 3.1 7.8 · Assessor: [email protected]

    Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation. This is caused by a privileged service running from the %PROGRAMDATA%\Hyland\DesktopHost\bin folder with weak permissions. A local user can exploit this to escalate privileges.

    CVE-2026-110359
    Read original (opens in a new tab)
  8. NVD

    CVE-2026-108473 — Multiple Kasa devices contain an improper authentication vulnerability in the local device-management protocol. An unauthent…

    High · CVSS 4.0 8.7 · Assessor: f23511db-6c3e-4e32-a477-6aa17d310630

    Multiple Kasa devices contain an improper authentication vulnerability in the local device-management protocol. An unauthenticated adjacent attacker may send management instructions to an affected device without adequate authentication or authorization, allowing modification of the device state or management settings. Under certain usage conditions involving interaction between the user, mobile application, and device-cloud service, insufficient protection of account-related communications may also expose account…

    CVE-2026-108473
    Read original (opens in a new tab)
  9. NVD

    CVE-2026-92817 — The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An aut…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vision project could provide their valid Vision session identifier and gain Designer-level privileges. An attacker could exploit these elevated privileges to execute arbitrary code in the context of the Ignition Gateway process.

    CVE-2026-92817
    Read original (opens in a new tab)
  14. NVD

    CVE-2026-105390 — Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7 allows…

    Medium · CVSS 4.0 6.9 · Assessor: [email protected]

    Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7 allows local attackers to trigger a deadlock via a crafted write to the ovpn-dco device, causing the host to become unresponsive.

    CVE-2026-105390
    Read original (opens in a new tab)
  15. NVD

    CVE-2026-97381 — Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 con…

    Critical · CVSS 3.1 9.9 · Assessor: [email protected]

    Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the hosting document's hostname, a hostname that is not on the permitted list falls through without setting E_ACCESSDENIED, causing IsPermitted to return S_OK. An attacker who induces a user to visit a malicious webpage in Internet Explorer can invoke the control to enumerate update a…

    CVE-2026-97381
    Read original (opens in a new tab)
  17. NVD

    CVE-2026-95633 — CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result i…

    High · CVSS 3.1 7.5 · Assessor: [email protected]

    CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

    CVE-2026-95633
    Read original (opens in a new tab)
  18. NVD

    CVE-2026-95632 — CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result i…

    High · CVSS 3.1 7.5 · Assessor: [email protected]

    CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

    CVE-2026-95632
    Read original (opens in a new tab)
  19. NVD

    CVE-2026-94453 — Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connectio…

    High · CVSS 3.1 7.5 · Assessor: d42dc95b-23f1-4e06-9076-20753a0fb0df

    Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to iface_endpoint inside ike_sa.sa->st_iface_endpoint. Once this invalid pointer is used, the daemon crashes and restarts. This vulnerability can be triggered before the remote peer has authenticated itself. Continued exploita…

    CVE-2026-94453
    Read original (opens in a new tab)
  23. NVD

    CVE-2026-77207 — Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan…

    High · CVSS 3.1 7.5 · Assessor: d42dc95b-23f1-4e06-9076-20753a0fb0df

    Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then iterates the certificate list with SEC_PKCS7GetCertificateList(). The two NSS APIs disagree on a SignedData that carries a CRL but no certificates: ContainsCertsOrCrls() returns PR_TRUE (there is a CRL), so the guard passes, but GetCertificateList() returns NULL…

    CVE-2026-77207
    Read original (opens in a new tab)
  24. NVD

    CVE-2026-77206 — Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result…

    High · CVSS 3.1 7.5 · Assessor: d42dc95b-23f1-4e06-9076-20753a0fb0df

    Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike->sa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pl…

    CVE-2026-77206
    Read original (opens in a new tab)
  25. NVD

    CVE-2026-77205 — Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the N…

    Low · CVSS 3.1 3.7 · Assessor: d42dc95b-23f1-4e06-9076-20753a0fb0df

    Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimate peers from connecting. The add_decoded_cert() function missed a call to CERT_DestroyCertificate() due to an incorrect fix for CVE-2026-14957. Sending bogus certificates with new serial numbers could prevent the real certificates with those serial numbers fro…

    CVE-2026-77205
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.