PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

Every cached source, newest first. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

18,867 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  1. NVD

    CVE-2026-92159 — F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications.…

    Medium · CVSS 3.1 6.5 · Assessor: [email protected]

    F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::TlmPacketizer TlmRecv_handler fixed-slot copy TlmRecv_handler copies val.getSize bytes into entry.channelSize storage without confirming that the runtime value fits. When a telemetry update for a configured channel carries a serialized value larger than that channel fixed slot, the copy overwrites adjacent channel fields and causes corrupted packetized telemetry to be em…

    CVE-2026-92159
    Read original (opens in a new tab)
  2. NVD

    CVE-2026-92158 — F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications.…

    High · CVSS 3.1 7.2 · Assessor: [email protected]

    F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FpySequencer STORE directive stack write validation the bounds check adds attacker-controlled offset and size before memcpy, allowing integer wraparound to make an out-of-range destination appear valid. When a sequence-controlled STORE directive supplies a stack offset and size whose U32 sum wraps, memcpy can write outside the sequencer stack, causing memory corruption,…

    CVE-2026-92158
    Read original (opens in a new tab)
  3. NVD

    CVE-2026-92157 — F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications.…

    Medium · CVSS 3.1 6.5 · Assessor: [email protected]

    F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because unchecked startOffset plus length arithmetic bypasses the range check and stores a wrapped m_endOffset that is inconsistent with m_byteOffset. When an existing source file is larger than a valid startOffset and a SendPartial command supplies a length whose U32 sum with that offset wraps below the file size,…

    CVE-2026-92157
    Read original (opens in a new tab)
  4. NVD

    CVE-2026-92156 — F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications.…

    Medium · CVSS 3.1 6.5 · Assessor: [email protected]

    F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::EventManager loqQueue_internalInterfaceHandler packetization is vulnerable because EventManager accepts up to the framework LogBuffer maximum, but packet descriptor, event identifier, and time-tag metadata consume part of the larger ComBuffer and leave a smaller remaining budget for log arguments; serialization failure then reaches an assertion. When a deployment bridges…

    CVE-2026-92156
    Read original (opens in a new tab)
  5. NVD

    CVE-2026-92155 — F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications.…

    High · CVSS 3.1 7.5 · Assessor: [email protected]

    F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Fw::FilePacket deserialization used by Svc::FileUplink is vulnerable because Header deserialization casts the byte to the Type enum without validating its range and FilePacket::fromSerialBuffer reaches a default FW_ASSERT. When a network file packet contains an unknown file-packet type byte, the assertion aborts or resets the default Ref application process, causing denial of…

    CVE-2026-92155
    Read original (opens in a new tab)
  6. NVD

    CVE-2026-92154 — F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications.…

    High · CVSS 3.1 8.1 · Assessor: [email protected]

    F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FileUplink handleDataPacket offset and size validation is vulnerable because the component checks byteOffset plus dataSize with wrapping U32 arithmetic and then seeks to the large attacker-controlled offset before writing. When a file-uplink DATA packet supplies a byteOffset and dataSize whose unsigned sum wraps below the declared file size, data can be written beyond th…

    CVE-2026-92154
    Read original (opens in a new tab)
  7. NVD

    CVE-2026-92152 — F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications.…

    Critical · CVSS 4.0 9.3 · Assessor: [email protected]

    F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. From 4.1.0 until 4.2.0, Svc::GenericHub output-port dispatch is vulnerable because the deserialized port field is passed to serialOut_out, bufferOut_out, eventOut_out, or tlmOut_out without an explicit range check. When a remote hub packet supplies a port index outside the configured output-port array, assert-enabled builds abort, while builds without assertions can access an output-port arr…

    CVE-2026-92152
    Read original (opens in a new tab)
  8. NVD

    CVE-2026-92150 — F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications.…

    High · CVSS 3.1 7.5 · Assessor: [email protected]

    F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::GenericHub fromBufferDriver_handler deserialization is vulnerable because the receive handler uses FW_ASSERT for externally influenced deserialization status and type validation and permits a command payload size subtraction to underflow. When an unauthenticated inter-processor hub peer sends a truncated buffer, an invalid HubType, or a header-only command-dispatch paylo…

    CVE-2026-92150
    Read original (opens in a new tab)
  15. NVD

    CVE-2026-86845 — A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path…

    Medium · CVSS 3.1 6.5 · Assessor: [email protected]

    A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to use-after-free or type confusion in the host vhost-crypto backend.

    CVE-2026-86845
    Read original (opens in a new tab)
  18. NVD

    CVE-2026-86461 — The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, an…

    High · CVSS 3.1 8.8 · Assessor: [email protected]

    The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 7.5.54.7212 via the check_mimetype function. This is due to incomplete file type validation in the check_mimetype function — while some extension checking is present, it can be bypassed, allowing attacker-supplied remote file content to be written with insufficient extension enforcement and no MIME check or WordPress upload helper. This makes it possible for authenticated attacke…

    CVE-2026-86461
    Read original (opens in a new tab)
  19. NVD

    CVE-2026-79957 — ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts a us…

    High · CVSS 3.1 8.1 · Assessor: [email protected]

    ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the requested account (CWE-639). Any authenticated user can iterate the ID parameter to retrieve the full profile record of every other user, including passwords stored in cleartext (CWE-256), enabling account takeover and credential-stuffing attacks.

    CVE-2026-79957
    Read original (opens in a new tab)
  20. NVD

    CVE-2026-77371 — Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's _connect() path…

    Critical · CVSS 4.0 9.3 · Assessor: [email protected]

    Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's _connect() path in redash/query_runner/duckdb.py created connections with enable_external_access left at its default value of true. A user with query access to an administrator-created DuckDB data source could use native file-reading functions to retrieve files readable by the Redash process or use COPY TO to write files with that process's privileges. Reading application secrets such as REDASH_COOKIE_SECRET…

    CVE-2026-77371
    Read original (opens in a new tab)
  21. NVD

    CVE-2026-76083 — Redash is a package for data visualization and sharing. From 10.0.0 until 26.9.0, the JSON data source query runner in redas…

    Medium · CVSS 4.0 4.9 · Assessor: [email protected]

    Redash is a package for data visualization and sharing. From 10.0.0 until 26.9.0, the JSON data source query runner in redash/query_runner/json_ds.py used _get_all_results() to combine its configured base_url with a user-supplied query URL by using urljoin. An absolute query URL replaced the configured base URL instead of remaining under it, allowing a user with execute_query permission to direct a server-side request to an arbitrary external origin. When HTTP Basic Auth was configured for the data source, the req…

    CVE-2026-76083
    Read original (opens in a new tab)
  22. NVD

    CVE-2026-55573 — e107 is a content management system (CMS). Prior to 2.3.7, install.php decodes the attacker-controlled previous_steps POST p…

    Critical · CVSS 3.1 9.8 · Assessor: [email protected]

    e107 is a content management system (CMS). Prior to 2.3.7, install.php decodes the attacker-controlled previous_steps POST parameter and passes it to unserialize() at file scope and again in the e_install constructor without restricting allowed classes. The installer remains accessible after a normal installation, and a crafted object graph using the bundled GuzzleHttp\Psr7\PumpStream class can flow through paths.hash into site_path, where string coercion invokes an attacker-controlled callable. An unauthenticated…

    CVE-2026-55573
    Read original (opens in a new tab)
  23. NVD

    CVE-2026-55572 — e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin's otherdb and e107db authentication b…

    Critical · CVSS 3.1 10.0 · Assessor: [email protected]

    e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107_plugins/alt_auth/otherdb_auth.php and e107_plugins/alt_auth/e107db_auth.php. The login() methods execute those strings with PDO::query() before effective sanitization, so an unauthenticated user can inject SQL when alt_auth is installed and either backend is configured with a live external database connection. The inje…

    CVE-2026-55572
    Read original (opens in a new tab)
  24. NVD

    CVE-2026-54554 — FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adI…

    High · CVSS 3.1 7.5 · Assessor: [email protected]

    FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo() endpoint in packages/web/lib/fog/fogpage.class.php was reported to return the FOG_AD_DEFAULT_PASSWORD value in its domainpass JSON field and to be dispatchable through node=ipxe without an authenticated session. The response was also consumed by host and group Active Directory configuration interfaces. This could disclose the default domain-join credential to a remote unauthenticated re…

    CVE-2026-54554
    Read original (opens in a new tab)
  25. NVD

    CVE-2026-42093 — Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query runn…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/query_runner/query_results.py accepts param_query_N_{key=value} parameters and passed attacker-controlled values to replace_query_parameters() for raw substitution into a referenced query's SQL. This path bypassed the ParameterizedQuery schema validation used by normal query execution and omitted the is_safe permission check. An authenticated user with at least view-only access t…

    CVE-2026-42093
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.