PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

The complete recent NVD stream, including unscored entries. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

16,848 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  4. NVD

    CVE-2026-77460 — EspoCRM is an open source customer relationship management application. Prior to 10.0.3, a user with email-template edit acc…

    Medium · CVSS 3.1 6.5 · Assessor: [email protected]

    EspoCRM is an open source customer relationship management application. Prior to 10.0.3, a user with email-template edit access and mass-email sending access can reference restricted record fields in a template because the renderer stops filtering those fields when per-user ACL application is disabled. The same behavior affects group email auto-replies when a regular user can edit the selected template, even though an administrator controls the group email. Rendered messages can disclose restricted user fields. Th…

    CVE-2026-77460
    Read original (opens in a new tab)
  5. NVD

    CVE-2026-63130 — EspoCRM is an open source customer relationship management application. Prior to 9.3.10, an authenticated administrator can…

    Medium · CVSS 3.1 5.5 · Assessor: [email protected]

    EspoCRM is an open source customer relationship management application. Prior to 9.3.10, an authenticated administrator can provide crafted input to the administrative Label Manager. Insufficient path validation allows traversal outside the intended directory and permits reading, modifying, creating, or deleting JSON files accessible to the application, subject to filesystem permissions and server configuration. This issue is fixed in version 9.3.10.

    CVE-2026-63130
    Read original (opens in a new tab)
  6. NVD

    CVE-2026-59994 — EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an unauthenticated remote attacker c…

    Medium · CVSS 3.1 4.3 · Assessor: [email protected]

    EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an unauthenticated remote attacker can send an email to a monitored group or IMAP address, including an email-to-Case address, and place arbitrary HTML in its plain-text body. EspoCRM stores that body and renders it without escaping in Email Received stream notification emails sent to users following the related record, allowing HTML injection and, in mail clients that execute it, JavaScript execution. Earlier sanitization for…

    CVE-2026-59994
    Read original (opens in a new tab)
  7. NVD

    CVE-2026-55184 — EspoCRM is an open source customer relationship management application. Prior to 9.3.9, a user with Email Template or PDF Te…

    Low · CVSS 3.1 3.5 · Assessor: [email protected]

    EspoCRM is an open source customer relationship management application. Prior to 9.3.9, a user with Email Template or PDF Template edit permission can store crafted HTML that bypasses moderateSanitizeHtml(). When another user opens the template in edit mode and clientCspDisabled is true, the stored payload executes and can hijack the user's session. This issue is fixed in version 9.3.9.

    CVE-2026-55184
    Read original (opens in a new tab)
  8. NVD

    CVE-2026-55154 — EspoCRM is an open source customer relationship management application. Prior to 9.3.9, application/Espo/Tools/Export/Format…

    Medium · CVSS 3.1 5.4 · Assessor: [email protected]

    EspoCRM is an open source customer relationship management application. Prior to 9.3.9, application/Espo/Tools/Export/Format/Csv/Processor.php, application/Espo/Tools/Export/Format/Xlsx/OpenSpoutProcessor.php, and application/Espo/Tools/Export/Format/Xlsx/PhpSpreadsheetProcessor.php inspect only the first byte in sanitizeCellValue(). An authenticated low-privileged user can store a free-text value whose formula trigger is preceded by whitespace or a control character, causing CSV or XLSX export to omit the leading…

    CVE-2026-55154
    Read original (opens in a new tab)
  9. NVD

    CVE-2026-53575 — EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an authenticated administrator can p…

    Low · CVSS 3.1 2.7 · Assessor: [email protected]

    EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an authenticated administrator can place crafted content in the applicationName setting through CSP nonce injection. The persistent injection is inserted into the main application page without escaping, allowing attacker-controlled JavaScript to run in users' sessions and leak page data, including unsaved user input. This issue is fixed in version 9.3.9.

    CVE-2026-53575
    Read original (opens in a new tab)
  10. NVD

    CVE-2026-53574 — EspoCRM is an open source customer relationship management application. From 8.1.0 until 9.3.8, an authenticated non-adminis…

    High · CVSS 3.1 7.6 · Assessor: [email protected]

    EspoCRM is an open source customer relationship management application. From 8.1.0 until 9.3.8, an authenticated non-administrator can submit a crafted where parameter to the GET entity streamAttachments endpoint because that query path permits complex expressions. Boolean-based blind SQL injection can extract arbitrary database information, including active administrator session tokens, and can enable full privilege escalation. This issue is fixed in version 9.3.8.

    CVE-2026-53574
    Read original (opens in a new tab)
  11. NVD

    CVE-2026-47168 — EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can s…

    Critical · CVSS 3.1 9.1 · Assessor: [email protected]

    EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object data that is stored in background MassAction or Export parameters and later deserialized by the application. The deserialization paths do not restrict allowed classes, allowing attacker-controlled object instantiation and arbitrary code execution on the server. This issue is fixed in version 9.3.7.

    CVE-2026-47168
    Read original (opens in a new tab)
  12. NVD

    CVE-2026-46708 — EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a low-privileged user who can access…

    Medium · CVSS 3.1 4.3 · Assessor: [email protected]

    EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a low-privileged user who can access a shared TargetList can invoke opt-out or cancel-opt-out actions for a protected Contact or Lead that the user cannot read or edit. The service validates access to the target list but retrieves the target record without the required record authorization, allowing unauthorized changes to its opted_out relationship state. This issue is fixed in version 9.3.7.

    CVE-2026-46708
    Read original (opens in a new tab)
  13. NVD

    CVE-2026-46694 — EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a portal user with stream access to…

    Medium · CVSS 3.1 6.5 · Assessor: [email protected]

    EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a portal user with stream access to a parent record can directly fetch a Note through the portal Note API and read an internal stream note when the note identifier is known. Stream list responses correctly hide notes whose isInternal field is true, but the direct single-Note access check does not enforce that restriction, exposing internal agent content. This issue is fixed in version 9.3.7.

    CVE-2026-46694
    Read original (opens in a new tab)
  14. NVD

    CVE-2026-46691 — EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated user with Import sc…

    Medium · CVSS 3.1 6.5 · Assessor: [email protected]

    EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated user with Import scope access can send POST /api/v1/Import/{id}/exportErrors with another user's import identifier and retrieve an attachment identifier for a CSV containing rows from that import. The endpoint performs a scope-level check but omits the entity-level ownership check enforced by the Import AccessChecker and sibling Import endpoints. This issue is fixed in version 9.3.7.

    CVE-2026-46691
    Read original (opens in a new tab)
  15. NVD

    CVE-2026-110957 — A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. The affected element is the function sub_12580…

    Critical · CVSS 4.0 9.3 · Assessor: [email protected]

    A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. The affected element is the function sub_12580 of the file api.cgi of the component Login Processing. The manipulation of the argument REMOTE_ADDR leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2026-09-24-841a51c6d5_tclinux.bin is sufficient to fix this issue. You should upgrade the affected component. The vendor confirms: "…

    CVE-2026-110957
    Read original (opens in a new tab)
  16. NVD

    CVE-2026-110936 — A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dyn…

    High · CVSS 4.0 8.4 · Assessor: [email protected]

    A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.

    CVE-2026-110936
    Read original (opens in a new tab)
  17. NVD

    CVE-2026-110746 — A local privilege escalation vulnerability in TotalAV allows an unprivileged local user to forge the gRPC IPC authentication…

    High · CVSS 3.1 7.8 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    A local privilege escalation vulnerability in TotalAV allows an unprivileged local user to forge the gRPC IPC authentication token, through loading IPC.dll and abuse the SYSTEM service's within TotalAV to execute arbitrary code as NT AUTHORITY\SYSTEM.

    CVE-2026-110746
    Read original (opens in a new tab)
  18. NVD

    CVE-2026-109413 — In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure() recursed through lexI…

    High · CVSS 4.0 8.7 · Assessor: 596c5446-0ce5-4ba2-aa66-48b3b757a647

    In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence() for every { and [ of an inline collection, without entering the nesting level that the rest of the parser bounds with maxNestingLevel. A document made of deeply nested inline collections, such as [[[[...]]]], exhausted the stack while it was being lexed: depending on the PHP version and its stack settings, the process crashed or the request ended with a…

    CVE-2026-109413
    Read original (opens in a new tab)
  19. NVD

    CVE-2026-108116 — In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could…

    High · CVSS 3.1 7.5 · Assessor: [email protected]

    In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection.

    CVE-2026-108116
    Read original (opens in a new tab)
  20. NVD

    CVE-2026-108082 — Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54,…

    High · CVSS 4.0 8.7 · Assessor: 596c5446-0ce5-4ba2-aa66-48b3b757a647

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, followed by a (?

    CVE-2026-108082
    Read original (opens in a new tab)
  21. NVD

    CVE-2026-106153 — In Progress® Kendo® UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month content templates r…

    Medium · CVSS 3.1 5.4 · Assessor: [email protected]

    In Progress® Kendo® UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month content templates render data.url and data.title without proper URL sanitization and HTML attribute encoding. An attacker with low privileges who can control the URL option or culture-derived title values can supply a JavaScript URL or inject event-handler attributes. When a user interacts with an affected calendar, JavaScript can execute in the user's browser context and compromise the confidentiality and inte…

    CVE-2026-106153
    Read original (opens in a new tab)
  22. NVD

    CVE-2026-106151 — In Progress® Kendo® UI for jQuery versions starting with 2012.2.710 and prior to 2026.3.1015, the Validator decodes validati…

    Medium · CVSS 3.1 5.4 · Assessor: [email protected]

    In Progress® Kendo® UI for jQuery versions starting with 2012.2.710 and prior to 2026.3.1015, the Validator decodes validation messages from data-msg-* attributes and parses the resulting text as HTML. An attacker who can modify a validation message can cause HTML that was correctly escaped in the page attribute to become active markup, including event handlers, when the user triggers validation. Successful exploitation can execute JavaScript in a user's browser and compromise the confidentiality and integrity of…

    CVE-2026-106151
    Read original (opens in a new tab)
  23. NVD

    CVE-2026-106150 — In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the Splitter and Window components starting with version 2011.2.804…

    Medium · CVSS 3.1 5.4 · Assessor: [email protected]

    In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the Splitter and Window components starting with version 2011.2.804 and the Tooltip component starting with version 2013.1.319 construct iframe markup without properly sanitizing URL values or encoding the Window iframe title. An attacker with low privileges who can control these values can inject HTML attributes, including JavaScript event handlers, through an apostrophe in an iframe URL or a crafted title. When a user interacts with the affected component,…

    CVE-2026-106150
    Read original (opens in a new tab)
  24. NVD

    CVE-2026-106149 — In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource…

    Medium · CVSS 3.1 5.4 · Assessor: [email protected]

    In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation without proper neutralization. An attacker with low privileges who can control these fields can inject JavaScript event-handler attributes that execute when a user interacts with the affected Menu, compromising the confidentiality and integrity of data accessible in the user's browser context.

    CVE-2026-106149
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.