THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
Every cached source, newest first. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
18,826 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUp to date · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-41541 — An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central. If a remote attacker gain…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.7 and later Qsync Central 5.1.0.3 and later Qsync Central 5.2.0.5 and later Qsync Central 5.3.0.2 and later
CVE-2026-41541Read original ↗ (opens in a new tab) - NVD
CVE-2026-39997 — A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, t…
High · CVSS 4.0 8.9 · Assessor: [email protected]
A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.22 and later
CVE-2026-39997Read original ↗ (opens in a new tab) - NVD
CVE-2026-39991 — A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user ac…
Medium · CVSS 4.0 4.8 · Assessor: [email protected]
A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.12 and later
CVE-2026-39991Read original ↗ (opens in a new tab) - NVD
CVE-2026-39989 — A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read application data. We have already fixed the vulnerability in the following version: Download Station 5.10.1.312 and later Download Station 5.11.2.321 and later
CVE-2026-39989Read original ↗ (opens in a new tab) - NVD
CVE-2026-34015 — A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they ca…
High · CVSS 4.0 8.7 · Assessor: [email protected]
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
CVE-2026-34015Read original ↗ (opens in a new tab) - NVD
CVE-2026-34014 — An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a lo…
High · CVSS 4.0 8.4 · Assessor: [email protected]
An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Download Station 5.10.1.312 and later Download Station 5.11.2.321 and later
CVE-2026-34014Read original ↗ (opens in a new tab) - NVD
CVE-2026-34009 — An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker…
High · CVSS 4.0 8.4 · Assessor: [email protected]
An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later
CVE-2026-34009Read original ↗ (opens in a new tab) - NVD
CVE-2026-34008 — An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a loc…
High · CVSS 4.0 8.5 · Assessor: [email protected]
An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later
CVE-2026-34008Read original ↗ (opens in a new tab) - NVD
CVE-2026-34007 — An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could all…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later
CVE-2026-34007Read original ↗ (opens in a new tab) - NVD
CVE-2026-34006 — A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: sMedio DTCP MOVE 1.4.5 and later
CVE-2026-34006Read original ↗ (opens in a new tab) - NVD
CVE-2026-26245 — A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can…
High · CVSS 4.0 7.1 · Assessor: [email protected]
A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
CVE-2026-26245Read original ↗ (opens in a new tab) - NVD
CVE-2026-26244 — A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can…
High · CVSS 4.0 7.1 · Assessor: [email protected]
A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
CVE-2026-26244Read original ↗ (opens in a new tab) - NVD
CVE-2026-26243 — A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they ca…
High · CVSS 4.0 7.2 · Assessor: [email protected]
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.6 and later Qsync Central 5.1.0.2 and later Qsync Central 5.2.0.4 and later
CVE-2026-26243Read original ↗ (opens in a new tab) - NVD
CVE-2026-19864 — Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object. When the credentials co…
Medium · CVSS 4.0 5.6 · Assessor: [email protected]
Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session is persisted to a session data store, the password may consequently be written to persistent storage in plaintext. An attacker with sufficient privileges to read the persisted session data may obtain the plaintext passwords of authenticated users.
CVE-2026-19864Read original ↗ (opens in a new tab) - NVD
CVE-2026-19863 — An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contai…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path. This is caused by the authenticator using an unanchored substring match when identifying the login page. If the login path appears later within a protected request path, the request may be treated as the login page and its authentication or role requirement replaced with ALLOWED. Exploitation requires the protected resource path to contain the configured login pa…
CVE-2026-19863Read original ↗ (opens in a new tab) - NVD
CVE-2026-18662 — In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints wi…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. Resulting in later http-method-omission sets overriding previous constraints with the same http-method-omission set.
CVE-2026-18662Read original ↗ (opens in a new tab) - NVD
CVE-2026-18660 — In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensiti…
High · CVSS 4.0 8.8 · Assessor: [email protected]
In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case.
CVE-2026-18660Read original ↗ (opens in a new tab) - NVD
CVE-2026-18659 — In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, and `jetty-eeN-servlet`, the Jakart…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, and `jetty-eeN-servlet`, the Jakarta Spec constraints defined as `http-method-omission` can be bypassed by using substrings of the defined HTTP Methods.
CVE-2026-18659Read original ↗ (opens in a new tab) - CERT-EU
2026-017: Critical Vulnerability in Cisco Secure Email Gateway
On 14 October 2026, Cisco published a security advisory addressing a critical vulnerability affecting the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway. This vulnerability could allow an unauthenticated, remote attacker to write arbitrary files and execute commands with root privileges on the underlying operating system. The Cisco PSIRT is aware of active exploitation of this vulnerability. CERT-EU strongly recommends updating the Content Scanner Tools package or upgrading Cisco AsyncOS S…
- NVD
CVE-2026-96614 — "ゲオアプリ" provided by GEO CORPORATION is vulnerable to improper authorization in handler for a custom URL scheme. An attacker…
Medium · CVSS 4.0 5.1 · Assessor: [email protected]
"ゲオアプリ" provided by GEO CORPORATION is vulnerable to improper authorization in handler for a custom URL scheme. An attacker may be able to cause the application's in-app browser to access an arbitrary website, potentially leading to phishing attacks or disclosure of a service's session ID.
CVE-2026-96614Read original ↗ (opens in a new tab) - NVD
CVE-2026-79823 — HPE NonStop EMS Distributor is vulnerable to buffer overflow condition that may result in undesirable behavior.
Medium · CVSS 3.1 4.0 · Assessor: [email protected]
HPE NonStop EMS Distributor is vulnerable to buffer overflow condition that may result in undesirable behavior.
CVE-2026-79823Read original ↗ (opens in a new tab) - NVD
CVE-2026-77711 — When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authent…
High · CVSS 4.0 8.2 · Assessor: [email protected]
When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required). The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the `Proxy-Authentication` header, which arrives to the server, that now has access to the proxy credentials.
CVE-2026-77711Read original ↗ (opens in a new tab) - NVD
CVE-2026-76184 — In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to control t…
High · CVSS 4.0 8.2 · Assessor: [email protected]
In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to control the redirects, then HttpClient matches authentication credentials against `/secure` rather than normalizing the path to `/evil`, and will therefore follow the redirect sending the `Authorization` header for `/secure` to `/evil`. This also mean that the attacker must have an evil application deployed on the same domain as the target.
CVE-2026-76184Read original ↗ (opens in a new tab) - NVD
CVE-2026-76182 — In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `ind…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, where `$path` is the request path in context. However, URI paths may contain characters that are reserved in URI queries so that a path of `/s&a=1` when applied to the template becomes `index?p=/s&a=1`, which is interpreted as 2 query parameters: `p=/s` and `a=1`, rather than just one query parameter `p` whose value is `/s&a=1`.
CVE-2026-76182Read original ↗ (opens in a new tab) - NVD
CVE-2026-75559 — The smartphone application "Vehicle Inspection Certificate Viewer" contains a vulnerability in which sensitive information m…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
The smartphone application "Vehicle Inspection Certificate Viewer" contains a vulnerability in which sensitive information may be included in data transmitted by the application, potentially leading to the exposure of API integration credentials such as an access ID and access key.
CVE-2026-75559Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.