PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

Every cached source, newest first. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

18,855 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  1. NVD

    CVE-2026-102463 — In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the binary array decoder in…

    High · CVSS 4.0 8.2 · Assessor: [email protected]

    In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the binary array decoder in vertx-pg-client (DataTypeCodec.binaryDecodeArray) allocates a Java array sized by a server-declared 32-bit dimension count with no upper bound. A malicious or compromised PostgreSQL server, or an on-path attacker intercepting an unencrypted connection, can send a crafted DataRow message with an excessively large array dimension value, causing the client to attempt a multi-gigabyte heap alloc…

    CVE-2026-102463
    Read original (opens in a new tab)
  2. NVD

    CVE-2026-102462 — In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the TDS message decoder in…

    High · CVSS 4.0 8.2 · Assessor: [email protected]

    In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the TDS message decoder in the Vert.x MSSQL client (vertx-mssql-client) aggregates inbound TDS packets into a composite direct-memory buffer without any cumulative size limit. A malicious, compromised, or man-in-the-middle SQL Server can send a continuous stream of TDS packets without setting the END_OF_MESSAGE status flag, causing unbounded direct-memory allocation on the client and leading to an out-of-memory crash.…

    CVE-2026-102462
    Read original (opens in a new tab)
  3. NVD

    CVE-2026-102461 — In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the uniqueItems keyword val…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the uniqueItems keyword validation uses an O(n²) pairwise comparison loop with no short-circuit or size limit. A remote unauthenticated attacker can submit a moderately-sized JSON array that consumes disproportionate CPU time, leading to denial of service. The impacted component is io.vertx:vertx-json-schema. The following Vert.x modules depend on vertx-json-schema and are also affected: io.vertx:vertx-web-openapi-rout…

    CVE-2026-102461
    Read original (opens in a new tab)
  4. NVD

    CVE-2026-101290 — A remote attacker may send a specially crafted network packet that causes the affected application to perform an out-of-boun…

    High · CVSS 3.1 7.5 · Assessor: [email protected]

    A remote attacker may send a specially crafted network packet that causes the affected application to perform an out-of-bounds memory read due to insufficient validation of packet length. This may result in an application crash and a denial-of-service condition.

    CVE-2026-101290
    Read original (opens in a new tab)
  5. NVD

    CVE-2026-101287 — Authentication bypass vulnerability in Stela, versions prior to 1.60.1, due to the use of a cookie named “authProcess” witho…

    Critical · CVSS 4.0 9.3 · Assessor: [email protected]

    Authentication bypass vulnerability in Stela, versions prior to 1.60.1, due to the use of a cookie named “authProcess” without validating its integrity. The application stores the user identifier (userId) and the status of the authentication process (validSteps) in this cookie and relies on these values—which can be modified by the client—to complete the login process. A remote attacker, without valid credentials or interaction from other users, could manipulate the cookie to bypass authentication checks and imper…

    CVE-2026-101287
    Read original (opens in a new tab)
  6. NVD

    CVE-2025-23390 — A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certifi…

    Medium · CVSS 3.1 6.3 · Assessor: [email protected]

    A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate when connecting through SSH if the certificate isn’t set in the `known_hosts` file. This could allow the execution of a man-in-the-middle (MitM) attack against Fleet. In case the server that is being connected to has a trusted entry in the known_hosts file, then Fleet will correctly check the authenticity of the presented certificate.

    CVE-2025-23390
    Read original (opens in a new tab)
  7. NVD

    CVE-2024-22031 — A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster,…

    High · CVSS 3.1 8.5 · Assessor: [email protected]

    A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the different cluster, resulting in a privilege escalation. This happens because the namespace used on the local cluster to store related resources (PRTBs and secrets) is the name of the project.

    CVE-2024-22031
    Read original (opens in a new tab)
  8. NVD

    CVE-2023-32198 — A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the cert…

    High · CVSS 3.1 8.0 · Assessor: [email protected]

    A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) attack against services using Steve.

    CVE-2023-32198
    Read original (opens in a new tab)
  9. NVD

    CVE-2026-108092 — The Blog2Social – Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Insecure Direct Object Reference…

    Medium · CVSS 3.1 4.3 · Assessor: [email protected]

    The Blog2Social – Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 9.1.4. This is due to the b2s_ship_item and b2s_ship_item_reload_url AJAX handlers lacking per-object authorization on the postId parameter. This makes it possible for authenticated attackers with Contributor-level access and above to read the title and content of any post, including private and pending posts belonging to other users.

    CVE-2026-108092
    Read original (opens in a new tab)
  10. NVD

    CVE-2026-102475 — In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer int…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer interceptor that relies on a max buffered bytes limit to ensure a bounded buffer for each request. This can be used to force a server to indefinitely allocate heap. This vulnerability requires to use an intercepting body transformer. The impacted component is io.vertx:vertx-http-proxy.

    CVE-2026-102475
    Read original (opens in a new tab)
  11. NVD

    CVE-2026-102467 — In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the WebSocket implementatio…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the WebSocket implementation does not define a maximum number of bytes allocation when decompressing frames or messages. This can be used to implement DDOS attacks with a zip bomb. The impacted component is io.vertx:vertx-core.

    CVE-2026-102467
    Read original (opens in a new tab)
  12. NVD

    CVE-2026-102465 — In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x Redis client RES…

    High · CVSS 4.0 8.2 · Assessor: [email protected]

    In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x Redis client RESP parser pre-allocates arrays to a length declared by the server without enforcing an upper bound. A malicious or compromised Redis server, or an attacker in a man-in-the-middle position, can send a crafted RESP response declaring an extremely large array, push, or attribute length, causing the client to attempt a massive heap allocation. The resulting OutOfMemoryError crashes the Vert.x even…

    CVE-2026-102465
    Read original (opens in a new tab)
  13. NVD

    CVE-2026-101311 — The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had…

    High · CVSS 3.1 7.0 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync. Additionally, writes to the framebuffer BAR could set arbitrary width and height values without validation, and the framebuffer BAR I/O and RFB rendering threads were not synchronized. A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.

    CVE-2026-101311
    Read original (opens in a new tab)
  14. NVD

    CVE-2026-101310 — The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream. A zero…

    High · CVSS 3.1 7.0 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields were also subject to modification by the guest after validation. A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.

    CVE-2026-101310
    Read original (opens in a new tab)
  15. NVD

    CVE-2026-101309 — The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest. The size was re-read from…

    High · CVSS 3.1 7.0 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block (TRB) fields were loaded without protection against concurrent modification by the guest. This race condition could be triggered by a guest running malicious, privileged code. A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Caps…

    CVE-2026-101309
    Read original (opens in a new tab)
  16. NVD

    CVE-2026-96537 — The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pa…

    High · CVSS 3.1 7.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missing ones, and change the options that reference them.

    CVE-2026-96537
    Read original (opens in a new tab)
  17. NVD

    CVE-2026-92429 — The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook be…

    Medium · CVSS 3.1 5.3 · Assessor: [email protected]

    The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including marking unpaid orders as paid and cancelling completed orders.

    CVE-2026-92429
    Read original (opens in a new tab)
  18. NVD

    CVE-2026-92428 — The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook be…

    Medium · CVSS 3.1 5.3 · Assessor: [email protected]

    The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including orders that were already paid or completed.

    CVE-2026-92428
    Read original (opens in a new tab)
  19. NVD

    CVE-2026-81534 — The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Execution in versions up to, an…

    High · CVSS 3.1 8.8 · Assessor: [email protected]

    The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. This is due to insufficient authorization and input sanitization in the send_test_mail() function, which allows user-controlled PHP code to be written to executable files in the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary PHP code on the server, leading to full site compromise.

    CVE-2026-81534
    Read original (opens in a new tab)
  23. NVD

    CVE-2026-74920 — The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it in…

    High · CVSS 3.1 7.1 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against any visitor, including a logged-in administrator.

    CVE-2026-74920
    Read original (opens in a new tab)
  24. NVD

    CVE-2026-58100 — kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bou…

    High · CVSS 3.1 7.0 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and register knotes with file descriptor numbers beyond the end of the child's table, causing an out-of-bounds read. An unprivileged local user may be able to exploit these races to escalate privileges.

    CVE-2026-58100
    Read original (opens in a new tab)
  25. NVD

    CVE-2026-58099 — When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally…

    High · CVSS 3.1 7.0 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock. If another thread freed a marker while the lock was dropped, the subsequent in-flux decrement operated on freed memory. An unprivileged local user may be able to exploit these races to escalate privileges.

    CVE-2026-58099
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.