PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

Every cached source, newest first. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

18,826 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  2. NVD

    CVE-2026-110726 — In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client b…

    Medium · CVSS 3.1 6.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses t…

    CVE-2026-110726
    Read original (opens in a new tab)
  10. NVD

    CVE-2026-108498 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bannersky BSK PDF Mana…

    High · CVSS 3.1 7.1 · Assessor: [email protected]

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bannersky BSK PDF Manager bsk-pdf-manager allows Stored XSS.This issue affects BSK PDF Manager: from n/a through 3.8.1.

    CVE-2026-108498
    Read original (opens in a new tab)
  12. NVD

    CVE-2026-108491 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms Everest…

    High · CVSS 3.1 7.1 · Assessor: [email protected]

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms Everest Forms everest-forms allows Stored XSS.This issue affects Everest Forms: from n/a through 3.6.1.

    CVE-2026-108491
    Read original (opens in a new tab)
  19. NVD

    CVE-2026-53882 — An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization S…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Virtualization Station 4.1.1.130 and later

    CVE-2026-53882
    Read original (opens in a new tab)
  20. NVD

    CVE-2026-50619 — A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attack…

    Critical · CVSS 4.0 9.3 · Assessor: [email protected]

    A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsirch 7.0.3.0 and later

    CVE-2026-50619
    Read original (opens in a new tab)
  21. NVD

    CVE-2026-50612 — An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie. If a remote attacker gains a us…

    Critical · CVSS 4.0 9.4 · Assessor: [email protected]

    An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: QuMagie 2.9.2 and later

    CVE-2026-50612
    Read original (opens in a new tab)
  22. NVD

    CVE-2026-47790 — A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains a user acco…

    Medium · CVSS 4.0 6.3 · Assessor: [email protected]

    A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: QuFTP Service 1.4.6 and later QuFTP Service 1.5.5 and later QuFTP Service 1.6.5 and later

    CVE-2026-47790
    Read original (opens in a new tab)
  23. NVD

    CVE-2026-47786 — An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could…

    Critical · CVSS 4.0 9.3 · Assessor: [email protected]

    An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.23 and later HybridDesk Station 4.3.4 and later

    CVE-2026-47786
    Read original (opens in a new tab)
  24. NVD

    CVE-2026-44084 — An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, t…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later

    CVE-2026-44084
    Read original (opens in a new tab)
  25. NVD

    CVE-2026-41545 — A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator acc…

    High · CVSS 4.0 8.6 · Assessor: [email protected]

    A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: QuMagie 2.9.1 and later

    CVE-2026-41545
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.