PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

The complete recent NVD stream, including unscored entries. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

16,869 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  1. NVD

    CVE-2026-111125 — CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attac…

    Medium · CVSS 4.0 6.9 · Assessor: [email protected]

    CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via input_nnybble in fits_hdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS_1 declaring oversized tile geometry to crash applications calling fits_read_pix or disclose limited heap memory.

    CVE-2026-111125
    Read original (opens in a new tab)
  2. NVD

    CVE-2026-111124 — CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that all…

    Medium · CVSS 4.0 6.9 · Assessor: [email protected]

    CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fits_rand_value table via a zero or negative ZDITHER0 seed. Attackers can supply a crafted FITS file with a SUBTRACTIVE_DITHER_1 compressed image, read through fits_open_file() and fits_read_pix(), to cause crashes or leak heap contents in decoded pixels.

    CVE-2026-111124
    Read original (opens in a new tab)
  3. NVD

    CVE-2026-111123 — FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memor…

    Medium · CVSS 4.0 6.9 · Assessor: [email protected]

    FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying unvalidated SoundFont modulator destination values. Attackers can craft an SF2 file with PMOD/IMOD destinations of 63 to 255 that, when loaded and played, write past the voice generator array and updated_gen_bit, causing memory corruption and crashes.

    CVE-2026-111123
    Read original (opens in a new tab)
  4. NVD

    CVE-2026-110878 — Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scri…

    Medium · CVSS 4.0 5.1 · Assessor: [email protected]

    Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts via unescaped Operation Type and Location names in RuleForm.php and RuleInfolist.php. Attackers can store HTML/JavaScript payloads in names that execute when warehouse managers or administrators view or edit Inventory Rules, performing actions in their session context.

    CVE-2026-110878
    Read original (opens in a new tab)
  5. NVD

    CVE-2026-110877 — AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load() in src/dmo.cpp that allows attacke…

    Medium · CVSS 4.0 6.8 · Assessor: [email protected]

    AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load() in src/dmo.cpp that allows attackers to read past a heap allocation by supplying a truncated TwinTeam DMO file. Attackers can supply a 12- or 13-byte file passing dmo_unpacker::decrypt(), opened via CAdPlug::factory, to read bytes beyond packed_module and potentially crash the application.

    CVE-2026-110877
    Read original (opens in a new tab)
  6. NVD

    CVE-2026-110876 — AdPlug through 2.4 contains an out-of-bounds read vulnerability in src/xsm.cpp that allows attackers to read before note_tab…

    Medium · CVSS 4.0 6.8 · Assessor: [email protected]

    AdPlug through 2.4 contains an out-of-bounds read vulnerability in src/xsm.cpp that allows attackers to read before note_table by supplying a negative note index. Attackers can craft an XSM file with the ofTAZ! signature and a song byte of 0x80 or higher, causing a global-buffer-overflow read during playback that may crash affected applications.

    CVE-2026-110876
    Read original (opens in a new tab)
  7. NVD

    CVE-2026-110875 — AdPlug through 2.4 contains a heap-based buffer overflow in CksmPlayer::update() in src/ksm.cpp that writes past the fixed d…

    Medium · CVSS 4.0 6.9 · Assessor: [email protected]

    AdPlug through 2.4 contains a heap-based buffer overflow in CksmPlayer::update() in src/ksm.cpp that writes past the fixed databuf[2048] array without bounds checking. Attackers can supply a crafted .ksm module whose notes share one time slot to overflow the heap player object, causing memory corruption and denial of service.

    CVE-2026-110875
    Read original (opens in a new tab)
  8. NVD

    CVE-2026-110874 — Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which call…

    High · CVSS 4.0 7.5 · Assessor: [email protected]

    Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize() without class restrictions when json_decode() fails. Attackers able to write stored extrafields, export configurations or blocked log entries can plant serialized objects that trigger gadget chains for code execution or file manipulation.

    CVE-2026-110874
    Read original (opens in a new tab)
  9. NVD

    CVE-2026-110378 — Missing Authorization vulnerability in WP E-Signature Ninja Forms Signature Contract Add-On ninja-signature-contract-forms-a…

    Medium · CVSS 3.1 5.3 · Assessor: [email protected]

    Missing Authorization vulnerability in WP E-Signature Ninja Forms Signature Contract Add-On ninja-signature-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ninja Forms Signature Contract Add-On: from n/a through 3.2.5.

    CVE-2026-110378
    Read original (opens in a new tab)
  10. NVD

    CVE-2026-110375 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Download Moni…

    Medium · CVSS 3.1 6.5 · Assessor: [email protected]

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Download Monitor download-monitor allows Stored XSS.This issue affects Download Monitor: from n/a through 5.3.3.

    CVE-2026-110375
    Read original (opens in a new tab)
  11. NVD

    CVE-2026-110374 — Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Exploiting Incorr…

    Medium · CVSS 3.1 4.3 · Assessor: [email protected]

    Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login with phone number: from n/a through 1.8.77.

    CVE-2026-110374
    Read original (opens in a new tab)
  12. NVD

    CVE-2026-110364 — Missing Authorization vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-qua…

    Medium · CVSS 3.1 5.3 · Assessor: [email protected]

    Missing Authorization vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Quantity – Measurement Price Calculator for WooCommerce: from n/a through 2.3.23.

    CVE-2026-110364
    Read original (opens in a new tab)
  13. NVD

    CVE-2026-110362 — Missing Authorization vulnerability in Planet studio PlanetStudio Payment Gateway planetstudio-payment-gateway allows Exploi…

    Medium · CVSS 3.1 5.3 · Assessor: [email protected]

    Missing Authorization vulnerability in Planet studio PlanetStudio Payment Gateway planetstudio-payment-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PlanetStudio Payment Gateway: from n/a through 1.3.3.

    CVE-2026-110362
    Read original (opens in a new tab)
  16. NVD

    CVE-2026-109932 — undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.1…

    High · CVSS 3.1 7.5 · Assessor: [email protected]

    undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client, including the bundled WebSocket exposed by Node.js, can be driven to exhaust process memory by a malicious or compromised WebSocket server. For every PING frame received, the client automatically writes a PONG response and ignores the backpressure signal from the socket write, so a server that streams small PING frames while never reading the client's PONGs makes th…

    CVE-2026-109932
    Read original (opens in a new tab)
  17. NVD

    CVE-2026-109924 — undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12…

    High · CVSS 3.1 7.5 · Assessor: [email protected]

    undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed data fields with no blank event separator, or a single unfinished line split across many chunks, the parser retains a growing amount of per-field and per-chunk state that the byte-based maxEventSize and maxResponseSize limits do not bo…

    CVE-2026-109924
    Read original (opens in a new tab)
  18. NVD

    CVE-2026-109897 — Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Config…

    Medium · CVSS 3.1 5.4 · Assessor: [email protected]

    Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through 3.3.12.

    CVE-2026-109897
    Read original (opens in a new tab)
  19. NVD

    CVE-2026-109893 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Prest…

    Medium · CVSS 3.1 6.5 · Assessor: [email protected]

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Presto Player presto-player allows Stored XSS.This issue affects Presto Player: from n/a through 4.5.3.

    CVE-2026-109893
    Read original (opens in a new tab)
  20. NVD

    CVE-2026-109869 — undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.…

    High · CVSS 3.1 7.5 · Assessor: ce714d77-add3-4f53-aff5-83d477b104bb

    undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses because of a content-encoding limit, but it created the internal response stream before that check and returned without attaching an error listener or aborting the request, s…

    CVE-2026-109869
    Read original (opens in a new tab)
  21. NVD

    CVE-2026-109841 — undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch() implem…

    High · CVSS 3.1 7.5 · Assessor: [email protected]

    undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch() implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its ASCII-lowercase form, so a valid but non-lowercase token such as an uppercase or mixed-case SHA256 is treated as unknown and skipped. When no recognized algorithm remains, undici treats the integrity list as empty and accepts…

    CVE-2026-109841
    Read original (opens in a new tab)
  22. NVD

    CVE-2026-109829 — undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless…

    Critical · CVSS 3.1 9.1 · Assessor: [email protected]

    undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original request URL before the redirect handler changes the origin, so a response produced after a cross-origin redirect is stored under the original key. An attacker who controls the target of a redirect from a trusted URL can have their response cached under that tr…

    CVE-2026-109829
    Read original (opens in a new tab)
  23. NVD

    CVE-2026-109689 — Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Con…

    Medium · CVSS 3.1 5.3 · Assessor: [email protected]

    Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 3.7.4.

    CVE-2026-109689
    Read original (opens in a new tab)
  24. NVD

    CVE-2026-109383 — undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12…

    Critical · CVSS 3.1 9.1 · Assessor: [email protected]

    undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent functions, a caller-supplied tls option containing a checkServerIdentity callback is silently dropped before it reaches the TLS layer. As a result, a TLS peer whose certificate a custom checkServerIdentity was written to reje…

    CVE-2026-109383
    Read original (opens in a new tab)
  25. NVD

    CVE-2026-109131 — The Hub collection module documentation renderer in the unified Ansible Automation Platform UI (built from upstream ansible-…

    Medium · CVSS 3.1 5.4 · Assessor: [email protected]

    The Hub collection module documentation renderer in the unified Ansible Automation Platform UI (built from upstream ansible-ui, frontend/hub) renders a documentation URL part (formatPartURL in DocumentationParsers.tsx) as a link without restricting the URL protocol/scheme. A collection whose documentation contains a link using a script-executing URL scheme can therefore cause script to run in the same origin as the Hub UI when another authenticated user views and activates that link in the collection documentation…

    CVE-2026-109131
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.