THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
The complete recent NVD stream, including unscored entries. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,848 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUp to date · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-105065 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme.com XStore xsto…
High · CVSS 3.1 7.1 · Assessor: [email protected]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme.com XStore xstore allows Reflected XSS.This issue affects XStore: from n/a before 9.7.9.
CVE-2026-105065Read original ↗ (opens in a new tab) - NVD
CVE-2026-102631 — In authd before 0.7.1, the user identity matching in UpdateUser (internal/users/manager.go) resolves an incoming login by th…
Medium · CVSS 4.0 5.9 · Assessor: [email protected]
In authd before 0.7.1, the user identity matching in UpdateUser (internal/users/manager.go) resolves an incoming login by the broker-scoped provider ID, but falls back to matching the username when the provider ID does not belong to any known user, and does not reject a conflicting non-empty provider ID. If an identity provider reassigns an email address, which authd uses as the username, to a new account, the new account inherits the previous user's local UID and home directory on its next login. This allows the…
CVE-2026-102631Read original ↗ (opens in a new tab) - NVD
CVE-2026-102527 — Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /_og/d/*.png route accepts…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /_og/d/*.png route accepts unsigned requests while resolvePathCacheKey() produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server responses. An unauthenticated attacker can provide attacker-controlled image data through the title parameter together with a derived cacheKey and populate the cache slot used for a legitimate Open Graph image, causing spoof…
CVE-2026-102527Read original ↗ (opens in a new tab) - NVD
CVE-2026-100409 — OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCache…
High · CVSS 3.1 7.5 · Assessor: [email protected]
OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cache lookup. An unauthenticated attacker can use a percent-encoded pathname that does not match authorization middleware but decodes to the cache key of a protected route, causing cached content to be returned without authori…
CVE-2026-100409Read original ↗ (opens in a new tab) - NVD
CVE-2026-100354 — kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema valid…
High · CVSS 3.1 7.5 · Assessor: [email protected]
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document validation accept the circular reference. A request or response that reaches the affected schema causes unbounded recursion in Schema.visitJSON or openapi3filter.decodeValue and exhausts the Go goroutine stack. The resulting fatal stack overflow cannot be caught…
CVE-2026-100354Read original ↗ (opens in a new tab) - NVD
CVE-2026-100353 — kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that…
High · CVSS 3.1 7.5 · Assessor: [email protected]
kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI 3.1 array schemas. An unauthenticated remote client can trigger a deterministic nil-pointer panic through an array query parameter, a deepObject query parameter containing an array property, or an application/x-www-form-urlencoded request body whose array property appears inside an allOf, anyOf, or oneOf s…
CVE-2026-100353Read original ↗ (opens in a new tab) - NVD
CVE-2026-97712 — Sonatype Nexus Repository 3 allows a user that holds the role create or role update permission to grant roles and privileges…
High · CVSS 4.0 8.7 · Assessor: 103e4ec9-0a87-450b-af77-479448ddef11
Sonatype Nexus Repository 3 allows a user that holds the role create or role update permission to grant roles and privileges that the account does not hold. This can give the user more access than intended, up to full administrative access.
CVE-2026-97712Read original ↗ (opens in a new tab) - NVD
CVE-2026-97667 — Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script co…
Medium · CVSS 4.0 5.1 · Assessor: 103e4ec9-0a87-450b-af77-479448ddef11
Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of an uploaded R package. The script runs in the browser of a user who opens the details of that package in the Browse user interface, with the permissions of the viewing user. In this description, a user account means an account that has supplied valid credentials. The anonymous user, if enabled, is also a user account and can hold this permission if an administrator gr…
CVE-2026-97667Read original ↗ (opens in a new tab) - NVD
CVE-2026-97666 — Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled input to a Java class lo…
Medium · CVSS 4.0 6.9 · Assessor: 103e4ec9-0a87-450b-af77-479448ddef11
Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled input to a Java class loading call through an ExtDirect endpoint. This allows the attacker to learn whether specific classes are present in the application. The issue does not by itself allow code execution.
CVE-2026-97666Read original ↗ (opens in a new tab) - NVD
CVE-2026-97665 — A missing authorization check in Nexus Repository 3's NuGet Components API upload path allows an account holding only reposi…
High · CVSS 4.0 7.1 · Assessor: 103e4ec9-0a87-450b-af77-479448ddef11
A missing authorization check in Nexus Repository 3's NuGet Components API upload path allows an account holding only repository read and browse privileges to upload and persist NuGet symbol packages (.snupkg) to a hosted repository, bypassing the write-permission check enforced for ordinary package uploads. Exploitation requires a hosted NuGet repository with Symbol Server enabled. If anonymous access is enabled, the built-in anonymous user holds read and browse privileges across all repositories by default, so t…
CVE-2026-97665Read original ↗ (opens in a new tab) - NVD
CVE-2026-97394 — kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array…
High · CVSS 3.1 7.5 · Assessor: [email protected]
kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-form-urlencoded or multipart/form-data request bodies, response headers, and other array parameter surfaces. A remote unauthenticated client can reach an affected operation with a nonempty request or matching response and deterministically trigger a nil-pointer panic during Vali…
CVE-2026-97394Read original ↗ (opens in a new tab) - NVD
CVE-2026-95155 — FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers t…
High · CVSS 3.1 7.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue.
CVE-2026-95155Read original ↗ (opens in a new tab) - NVD
CVE-2026-92982 — A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulne…
High · CVSS 3.1 8.5 · Assessor: [email protected]
A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressions to be executed within the operator pod. This can lead to arbitrary code execution and privilege escalation, granting the attacker control over the operator's service account with cluster-wide permissions.
CVE-2026-92982Read original ↗ (opens in a new tab) - NVD
CVE-2026-88753 — A Regular-Expression Denial of Service (ReDoS) in the Markdown2. extract_metadata() function (lib/markdown2.py) of trentm ma…
High · CVSS 3.1 7.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
A Regular-Expression Denial of Service (ReDoS) in the Markdown2. extract_metadata() function (lib/markdown2.py) of trentm markdown2 through v2.5.5 allows attackers to cause a Denial of Service (DoS) via a crafted Markdown document.
CVE-2026-88753Read original ↗ (opens in a new tab) - NVD
CVE-2026-75505 — EspoCRM is an open source customer relationship management application. Prior to 10.0.2, an authenticated user with mass-upd…
Medium · CVSS 4.0 6.0 · Assessor: [email protected]
EspoCRM is an open source customer relationship management application. Prior to 10.0.2, an authenticated user with mass-update permission can supply a known attachment identifier to the mass-update functionality. The mass-update processor duplicates the attachment without checking whether the caller can read it, bypassing record-level and field-level restrictions and exposing the file contents through the copied attachment. Obtaining a valid attachment identifier may be difficult. This issue is fixed in version 1…
CVE-2026-75505Read original ↗ (opens in a new tab) - NVD
CVE-2026-71490 — OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\Core\ACL::hasPrivilege() appends a dir…
High · CVSS 3.1 7.1 · Assessor: [email protected]
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\Core\ACL::hasPrivilege() appends a directly assigned comma-separated value as one string and then uses an exact comparison when checking user-config-readonly. A user directly assigned both a component write privilege and user-config-readonly can therefore be treated as lacking the read-only restriction, and MVC APIs protected by throwReadOnly() can persist configuration changes for that component. Group privileges are not affecte…
CVE-2026-71490Read original ↗ (opens in a new tab) - NVD
CVE-2026-63442 — OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login userna…
High · CVSS 3.1 8.1 · Assessor: [email protected]
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernamefld accepts carriage-return and line-feed characters that survive LOG_AUTH processing through syslog-ng-lockout.conf into the syslog-ng program destination feeding lockout_handler. The consumer's readline() processing treats an injected fragment as a separate authentication event and selects the first syntactically valid IP address from the forged line. An attacker with network access to th…
CVE-2026-63442Read original ↗ (opens in a new tab) - NVD
CVE-2026-58395 — OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the safe-delete path reached through Ap…
Medium · CVSS 3.1 4.3 · Assessor: [email protected]
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the safe-delete path reached through ApiMutableModelControllerBase::delBase() interpolates an unvalidated safe-delete token from the request URL into an XPath expression over config.xml before confirming that the token is a valid identifier. A user holding any one affected module privilege can send a crafted token to one of 21 affected delete endpoints covering Traffic Shaper, DHCP relay, Dnsmasq, Firewall Category, or Kea DHCP, c…
CVE-2026-58395Read original ↗ (opens in a new tab) - NVD
CVE-2026-58394 — OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/system_advanced_admin.php reads…
Medium · CVSS 3.1 5.2 · Assessor: [email protected]
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/system_advanced_admin.php reads certificate records into $a_cert but omits that array from legacy_html_escape_form_data() before rendering each certificate descr value in the SSL Certificate selector. The certificate description accepts HTML metacharacters, allowing a user with the page-system-certmanager privilege to store markup that executes when another user opens System Settings Administration. This issue is fixed in…
CVE-2026-58394Read original ↗ (opens in a new tab) - NVD
CVE-2026-58393 — OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN Client Specific Override co…
Medium · CVSS 3.1 5.9 · Assessor: [email protected]
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN Client Specific Override common_name field accepts path traversal sequences and openvpn_csc_conf_write() concatenates the value into /var/etc/openvpn-csc// without normalization or a basename check. The affected event handlers are client_connect.php and user_pass_verify.php. An authenticated user with Client Specific Override privileges can store the traversal value, and a matching OpenVPN client-connect or authenticat…
CVE-2026-58393Read original ↗ (opens in a new tab) - NVD
CVE-2026-58392 — OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the NTP GPS page stores the operator-su…
Medium · CVSS 3.1 5.4 · Assessor: [email protected]
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the NTP GPS page stores the operator-supplied initcmd value in base64 form, applies legacy_html_escape_form_data() to the encoded string, and then uses base64_decode() to decode the value directly into the GPS initialization-command textarea in src/www/services_ntpd_gps.php. Because decoding occurs after escaping, stored HTML remains unescaped at the output sink. A user with page-services-ntp-gps privilege can store a value that c…
CVE-2026-58392Read original ↗ (opens in a new tab) - NVD
CVE-2026-58391 — OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, Firewall Rules and NAT views place stor…
Medium · CVSS 3.1 5.4 · Assessor: [email protected]
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, Firewall Rules and NAT views place stored category names and alias descriptions into HTML title attributes in filter_rule.volt and nat_rule.volt without quote-safe encoding. The response layer uses ENT_NOQUOTES, so a double quote survives and closes the attribute, allowing an event-handler attribute to be added to the existing span. A user with Firewall Categories or Firewall Alias Edit privileges can store a category name or alia…
CVE-2026-58391Read original ↗ (opens in a new tab) - NVD
CVE-2026-58390 — OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard…
High · CVSS 3.1 8.0 · Assessor: [email protected]
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view place a client common_name into data-common-name attributes without quote-safe encoding. Exploitation requires an OpenVPN server configured with username-as-common-name and RADIUS or LDAP authentication, plus the ability to provision or self-register a valid backend username containing a double quote; depl…
CVE-2026-58390Read original ↗ (opens in a new tab) - NVD
CVE-2026-57155 — OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's pro…
Critical · CVSS 3.1 9.9 · Assessor: [email protected]
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV country_code value to construct output filenames below /usr/local/share/GeoIP/alias. A user with Firewall Alias Edit privilege can configure an attacker-controlled GeoIP source URL and supply an archive whose country code traverses into another existing directory, causing attacker-cont…
CVE-2026-57155Read original ↗ (opens in a new tab) - NVD
CVE-2026-53582 — OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-contro…
High · CVSS 3.1 7.1 · Assessor: [email protected]
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate authority and certificate refid values and interpolates them into XPath expressions in src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CAsField.php and src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CertificatesField.php. A user with CA Manager or Certificate Manager privileges can submit a crafted refid and repeatedly retrieve the object to obtain a boolean refc…
CVE-2026-53582Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.