PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

The complete recent NVD stream, including unscored entries. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

16,909 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  1. NVD

    CVE-2026-112100 — A vulnerability was determined in DeepPavlov up to 1.7.0. This affects the function MultiTaskPipelinePreprocessor.__init__ o…

    Low · CVSS 4.0 2.0 · Assessor: [email protected]

    A vulnerability was determined in DeepPavlov up to 1.7.0. This affects the function MultiTaskPipelinePreprocessor.__init__ of the file deeppavlov/models/preprocessors/multitask_preprocessor.py. This manipulation of the argument preprocessor causes code injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

    CVE-2026-112100
    Read original (opens in a new tab)
  4. NVD

    CVE-2026-111406 — Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive…

    Critical · CVSS 3.1 9.9 · Assessor: [email protected]

    Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.16.1.

    CVE-2026-111406
    Read original (opens in a new tab)
  5. NVD

    CVE-2026-111398 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PT Norther Lights Production…

    High · CVSS 3.1 7.7 · Assessor: [email protected]

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Path Traversal.This issue affects MapSVG: from n/a through 8.16.1.

    CVE-2026-111398
    Read original (opens in a new tab)
  6. NVD

    CVE-2026-110898 — Incorrect Privilege Assignment vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-li…

    Medium · CVSS 3.1 6.4 · Assessor: [email protected]

    Incorrect Privilege Assignment vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Privilege Escalation.This issue affects Essential Addons for Elementor: from n/a through 6.8.5.

    CVE-2026-110898
    Read original (opens in a new tab)
  9. NVD

    CVE-2026-108837 — Allocation of resources without limits or throttling vulnerability in Apache Kylin. Given an attacker has got project admin…

    High · CVSS 3.1 7.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Allocation of resources without limits or throttling vulnerability in Apache Kylin. Given an attacker has got project admin permission, an cache API maybe used to cause computed-column resource exhaustion. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

    CVE-2026-108837
    Read original (opens in a new tab)
  10. NVD

    CVE-2026-108833 — Default startup profile miss security settings in Apache Kylin. Any deployment has security setting profile turned on does n…

    High · CVSS 3.1 7.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Default startup profile miss security settings in Apache Kylin. Any deployment has security setting profile turned on does not impact. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

    CVE-2026-108833
    Read original (opens in a new tab)
  11. NVD

    CVE-2026-108823 — Exposure of Sensitive Information to an Unauthorized Actor during job manipulation in Apache Kylin. The impact is minor unle…

    High · CVSS 3.1 7.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Exposure of Sensitive Information to an Unauthorized Actor during job manipulation in Apache Kylin. The impact is minor unless job services are exposed to public network, which is uncommon. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

    CVE-2026-108823
    Read original (opens in a new tab)
  12. NVD

    CVE-2026-108780 — Potential JDBC source configuration validation vulnerability in Apache Kylin. The impact is minor, unless the kylin backend…

    Medium · CVSS 3.1 6.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Potential JDBC source configuration validation vulnerability in Apache Kylin. The impact is minor, unless the kylin backend services are open to public network. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

    CVE-2026-108780
    Read original (opens in a new tab)
  13. NVD

    CVE-2026-108776 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. The impa…

    Medium · CVSS 3.1 5.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. The impact is moderate if kylin service is in query only mode, which is the default and most common mode. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

    CVE-2026-108776
    Read original (opens in a new tab)
  14. NVD

    CVE-2026-108771 — Missing authentication for in-house broadcast and polymorphic deserialization vulnerability in Apache Kylin. Impact most to…

    Critical · CVSS 3.1 9.8 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Missing authentication for in-house broadcast and polymorphic deserialization vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

    CVE-2026-108771
    Read original (opens in a new tab)
  15. NVD

    CVE-2026-108766 — Missing authorization on jdbc source config update in Apache Kylin. Impact most to the kylin services that are directly expo…

    Medium · CVSS 3.1 6.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Missing authorization on jdbc source config update in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

    CVE-2026-108766
    Read original (opens in a new tab)
  16. NVD

    CVE-2026-108764 — Server-Side request forgery (SSRF) vulnerability in Apache Kylin. Impact most to the kylin job service that are directly exp…

    Medium · CVSS 3.1 6.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Server-Side request forgery (SSRF) vulnerability in Apache Kylin. Impact most to the kylin job service that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

    CVE-2026-108764
    Read original (opens in a new tab)
  17. NVD

    CVE-2026-108762 — Path-confinement bypass during metadata backup deletion in Apache Kylin. Impact most to the kylin services that are directly…

    High · CVSS 3.1 7.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Path-confinement bypass during metadata backup deletion in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

    CVE-2026-108762
    Read original (opens in a new tab)
  18. NVD

    CVE-2026-13695 — SQL injection (SQLi) vulnerability—specifically a UNION-based vulnerability—in the Integratec application that affects the s…

    High · CVSS 4.0 8.8 · Assessor: [email protected]

    SQL injection (SQLi) vulnerability—specifically a UNION-based vulnerability—in the Integratec application that affects the sInfo parameter sent via POST to the endpoint /login/ap_Login.aspx/start. Successful exploitation of this vulnerability could allow an attacker to steal data from the database, such as credentials and user information, and cause errors and partial denial-of-service conditions. Furthermore, this vulnerability could facilitate other types of follow-up attacks, such as data exfiltration or privil…

    CVE-2026-13695
    Read original (opens in a new tab)
  19. NVD

    CVE-2026-112180 — MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated records ar…

    Medium · CVSS 4.0 5.1 · Assessor: 5a6e4751-2f3f-4070-9419-94fb35b644e8

    MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated records are not removed from the database, leaving them as orphaned entries. The affected record types include event report tags, event graph entries, proposal (shadow attribute) correlations, fuzzy ssdeep correlation chunks, and attachment scan results. These orphaned records may contain sensitive threat intelligence data such as correlation mappings, scan results, and report metadata that should have…

    CVE-2026-112180
    Read original (opens in a new tab)
  20. NVD

    CVE-2026-112179 — In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The…

    Medium · CVSS 4.0 5.3 · Assessor: 5a6e4751-2f3f-4070-9419-94fb35b644e8

    In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags was applied only once after the iteration over all reports, rather than to each individual report. As a result: - All reports except the last one in the set were pushed to the remote MISP instance with their non-exportable tags intact, effectively disclosing restricted tag information to the receiving instance. - When the last report in the set was withheld (e…

    CVE-2026-112179
    Read original (opens in a new tab)
  21. NVD

    CVE-2026-112178 — MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted a…

    High · CVSS 4.0 7.1 · Assessor: 5a6e4751-2f3f-4070-9419-94fb35b644e8

    MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user's sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only attributes. - A user belonging to a sharing group could view proposals on attributes or objects with that sharing group, regardless of the attribute's distribution level (levels 1-3 should restrict visibi…

    CVE-2026-112178
    Read original (opens in a new tab)
  22. NVD

    CVE-2026-112161 — MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A l…

    High · CVSS 4.0 8.5 · Assessor: [email protected]

    MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the ‘bin/cygwin1.dll’ library contained within it with a malicious library. When the victim opens a Local Shell session or uses a Cygwin-based function, the application extracts the component and loads the tampered library, executing code with the victim’s permissions. Exploitation requires write access to the plugin and does not,…

    CVE-2026-112161
    Read original (opens in a new tab)
  23. NVD

    CVE-2026-112098 — A security flaw has been discovered in DeepPavlov up to 1.7.0. Impacted is the function resolve of the file deeppavlov/core/…

    Low · CVSS 4.0 2.1 · Assessor: [email protected]

    A security flaw has been discovered in DeepPavlov up to 1.7.0. Impacted is the function resolve of the file deeppavlov/core/common/params.py of the component Config Reference Resolver. The manipulation results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

    CVE-2026-112098
    Read original (opens in a new tab)
  24. NVD

    CVE-2026-112097 — A vulnerability was found in SourceCodester Inventory System 1.0. This issue affects some unknown processing of the file /ap…

    Medium · CVSS 4.0 5.1 · Assessor: [email protected]

    A vulnerability was found in SourceCodester Inventory System 1.0. This issue affects some unknown processing of the file /api/transactions_handler.php?action=save_sale of the component Sales Management Handler. The manipulation of the argument Hsn_Code results in cross site scripting. It is possible to launch the attack remotely.

    CVE-2026-112097
    Read original (opens in a new tab)
  25. NVD

    CVE-2026-112096 — A vulnerability has been found in SourceCodester Inventory System 1.0. This vulnerability affects unknown code of the file /…

    Low · CVSS 4.0 2.0 · Assessor: [email protected]

    A vulnerability has been found in SourceCodester Inventory System 1.0. This vulnerability affects unknown code of the file /api/transactions_handler.php?action=save_purchase of the component Purchase Records Handler. The manipulation of the argument Product_Name/Product_Code/Vendor_Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

    CVE-2026-112096
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.