PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

The complete recent NVD stream, including unscored entries. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

16,974 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  1. NVD

    CVE-2026-101294 — IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 coul…

    High · CVSS 3.1 8.7 · Assessor: [email protected]

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass cryptographic signature verification due to improper verification of cryptographic signature.

    CVE-2026-101294
    Read original (opens in a new tab)
  2. NVD

    CVE-2026-100131 — Substance3D - Sampler is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.…

    Medium · CVSS 3.1 5.5 · Assessor: [email protected]

    Substance3D - Sampler is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

    CVE-2026-100131
    Read original (opens in a new tab)
  3. NVD

    CVE-2026-100130 — Substance3D - Sampler is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.…

    Medium · CVSS 3.1 5.5 · Assessor: [email protected]

    Substance3D - Sampler is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

    CVE-2026-100130
    Read original (opens in a new tab)
  4. NVD

    CVE-2026-100129 — Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of t…

    High · CVSS 3.1 7.8 · Assessor: [email protected]

    Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

    CVE-2026-100129
    Read original (opens in a new tab)
  5. NVD

    CVE-2026-100128 — Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of t…

    High · CVSS 3.1 7.8 · Assessor: [email protected]

    Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

    CVE-2026-100128
    Read original (opens in a new tab)
  6. NVD

    CVE-2026-100127 — Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of t…

    High · CVSS 3.1 7.8 · Assessor: [email protected]

    Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

    CVE-2026-100127
    Read original (opens in a new tab)
  7. NVD

    CVE-2026-100126 — Bridge is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker cou…

    Medium · CVSS 3.1 5.5 · Assessor: [email protected]

    Bridge is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

    CVE-2026-100126
    Read original (opens in a new tab)
  8. NVD

    CVE-2026-100112 — Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the c…

    High · CVSS 3.1 7.8 · Assessor: [email protected]

    Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

    CVE-2026-100112
    Read original (opens in a new tab)
  9. NVD

    CVE-2026-100111 — Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the c…

    High · CVSS 3.1 7.8 · Assessor: [email protected]

    Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

    CVE-2026-100111
    Read original (opens in a new tab)
  10. NVD

    CVE-2026-90532 — Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code executi…

    Critical · CVSS 3.1 10.0 · Assessor: [email protected]

    Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.

    CVE-2026-90532
    Read original (opens in a new tab)
  11. NVD

    CVE-2026-90531 — Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that…

    Critical · CVSS 3.1 9.6 · Assessor: [email protected]

    Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.

    CVE-2026-90531
    Read original (opens in a new tab)
  12. NVD

    CVE-2026-86022 — VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double qu…

    High · CVSS 3.1 7.0 · Assessor: [email protected]

    VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it into a command string that QProcess::start(const QString&) reparses into arguments through ProcessUtils::startDetached. The automatic path in src/controllers/viewareacontroller.cpp and the Open With path in src/controllers/notebooknodecontroller.cpp both reach this sink. On Linux and macOS, an attacker-controlled double quote in a POSIX note filename can terminate the…

    CVE-2026-86022
    Read original (opens in a new tab)
  13. NVD

    CVE-2026-86016 — VNote is a note-taking platform. Prior to 4.3.0, VNote uses the assignment `preNode.innerHTML = p_metaData` in src/data/extr…

    High · CVSS 3.1 8.2 · Assessor: [email protected]

    VNote is a note-taking platform. Prior to 4.3.0, VNote uses the assignment `preNode.innerHTML = p_metaData` in src/data/extra/web/js/markdownit.js to insert YAML frontmatter metadata into a pre element before the protectFromXss sanitization path runs. Opening an attacker-supplied Markdown note can therefore execute stored JavaScript in the file:// viewer context. Because QWebEngineSettings::LocalContentCanAccessRemoteUrls enables local content to access remote URLs, the script can read reachable local note files a…

    CVE-2026-86016
    Read original (opens in a new tab)
  14. NVD

    CVE-2026-83960 — Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this…

    Medium · CVSS 3.1 5.4 · Assessor: [email protected]

    Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

    CVE-2026-83960
    Read original (opens in a new tab)
  15. NVD

    CVE-2026-83958 — Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this…

    Medium · CVSS 3.1 5.4 · Assessor: [email protected]

    Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

    CVE-2026-83958
    Read original (opens in a new tab)
  16. NVD

    CVE-2026-83662 — Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this…

    Critical · CVSS 3.1 9.3 · Assessor: [email protected]

    Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

    CVE-2026-83662
    Read original (opens in a new tab)
  17. NVD

    CVE-2026-75732 — Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code executi…

    Critical · CVSS 3.1 9.9 · Assessor: [email protected]

    Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.

    CVE-2026-75732
    Read original (opens in a new tab)
  19. NVD

    CVE-2026-63174 — Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to a…

    High · CVSS 4.0 8.6 · Assessor: [email protected]

    Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside their authority because the spaceAffectList affectation was performed without verifying the caller's rights to the target space. Attackers can exploit the missing readRight() check in the import flow's join INSERT to break tenant isolation and manipulate user-space assignments across unauthorized spaces.

    CVE-2026-63174
    Read original (opens in a new tab)
  20. NVD

    CVE-2026-63172 — Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrat…

    High · CVSS 4.0 7.1 · Assessor: [email protected]

    Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to create user accounts by invoking the user-edit action without a function-level authorization check. Attackers can exploit the missing editRight() enforcement in actionVueEditUser to create unauthorized user accounts, leading to privilege escalation.

    CVE-2026-63172
    Read original (opens in a new tab)
  21. NVD

    CVE-2026-63165 — Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows atta…

    High · CVSS 4.0 8.6 · Assessor: [email protected]

    Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by manipulating the sortEvents parameter, which is concatenated into the ORDER BY clause without sanitization in app/ModCalendar/CtrlCalendar.php. Attackers can exploit this flaw using error-based techniques such as extractvalue payloads to extract database information, including version data, from the underlying system.

    CVE-2026-63165
    Read original (opens in a new tab)
  22. NVD

    CVE-2026-63163 — Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in the MobileFileDownload route that a…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in the MobileFileDownload route that allows unauthenticated attackers to download arbitrary files by computing an md5(filename) token instead of passing a proper authorization check. Attackers can guess or determine file names to generate the corresponding md5 token and retrieve protected files without authorization, leading to unauthorized information disclosure.

    CVE-2026-63163
    Read original (opens in a new tab)
  23. NVD

    CVE-2026-63162 — Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary file…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary directory by supplying an unanchored tmpFolderName value in the upload destination path. Attackers can exploit this flaw, for example by setting tmpFolderName to a traversal sequence targeting the web root, to write attacker-controlled files and achieve remote code execution.

    CVE-2026-63162
    Read original (opens in a new tab)
  24. NVD

    CVE-2026-63161 — Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack auth…

    High · CVSS 4.0 8.6 · Assessor: [email protected]

    Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack authenticated sessions by planting a known session identifier in a victim's browser prior to login. Attackers can exploit the application's failure to regenerate the session id upon successful authentication to gain unauthorized access to the victim's authenticated session after they log in.

    CVE-2026-63161
    Read original (opens in a new tab)
  25. NVD

    CVE-2026-63160 — Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim se…

    Critical · CVSS 4.0 9.1 · Assessor: [email protected]

    Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or backup disclosure, can replay the plaintext value to authenticate as the victim user without needing their password.

    CVE-2026-63160
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.