PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

Every cached source, newest first. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

18,867 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  1. NVD

    CVE-2026-110777 — A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically r…

    Medium · CVSS 3.1 5.7 · Assessor: [email protected]

    A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved. There are no file path restrictions or checks to verify whether the attachment originally came from the server or was added locally. This allows an attacker with access to a shared CalDAV calendar to exfiltrate arbitrary files the user has access to when interacting with malicious…

    CVE-2026-110777
    Read original (opens in a new tab)
  2. NVD

    CVE-2026-109527 — The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp vers…

    High · CVSS 3.1 7.5 · Assessor: [email protected]

    The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP request bodies without enforcing a maximum size. An unauthenticated remote client able to reach an affected endpoint can send a large declared or streamed request body that consumes multiple times the body size in process memo…

    CVE-2026-109527
    Read original (opens in a new tab)
  3. NVD

    CVE-2026-108484 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Best Pay…

    High · CVSS 3.1 7.1 · Assessor: [email protected]

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Best Payments Plugin for WP wp-payment-form allows Stored XSS.This issue affects Best Payments Plugin for WP: from n/a through 4.6.27.

    CVE-2026-108484
    Read original (opens in a new tab)
  4. NVD

    CVE-2026-108483 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hippooo Hippoo Mobile…

    High · CVSS 3.1 7.1 · Assessor: [email protected]

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hippooo Hippoo Mobile App for WooCommerce hippoo allows Reflected XSS.This issue affects Hippoo Mobile App for WooCommerce: from n/a through 1.12.0.

    CVE-2026-108483
    Read original (opens in a new tab)
  6. NVD

    CVE-2026-108395 — The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.…

    High · CVSS 3.1 7.5 · Assessor: [email protected]

    The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in io.modelcontextprotocol.sdk:mcp-core, and from mcp-core 2.0.0-M1 through 2.0.0, the Servlet-based SSE, Streamable HTTP, and Stateless server transports read an HTTP request body into memory without enforcing a maximum size. An unauthenticated remote client able to reach an…

    CVE-2026-108395
    Read original (opens in a new tab)
  7. NVD

    CVE-2026-108390 — Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, upda…

    Critical · CVSS 3.1 9.9 · Assessor: [email protected]

    Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, update_object_value() in func/main.sh does not escape single quotes when writing a custom document-root value to a user's web.conf file, allowing a low-privileged authenticated panel user with a web domain to inject an additional PATH field. When the user invokes the ordinary Search feature, the root-privileged v-search-user-object script loads the forged field through parse_object_kv_list_non_ev…

    CVE-2026-108390
    Read original (opens in a new tab)
  9. NVD

    CVE-2026-107350 — Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed…

    High · CVSS 3.1 8.8 · Assessor: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

    Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user.

    CVE-2026-107350
    Read original (opens in a new tab)
  10. NVD

    CVE-2026-107349 — An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service.…

    High · CVSS 3.1 7.5 · Assessor: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

    An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignore_startup_parameters list lookup loop forever. Because PgBouncer serves all clients from a single process, this saturates a CPU core and makes PgBouncer unresponsive to all clients until the process is restarted.

    CVE-2026-107349
    Read original (opens in a new tab)
  11. NVD

    CVE-2026-107348 — Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer 1.21.0 through 1.26.0 allows a remote atta…

    Medium · CVSS 3.1 5.9 · Assessor: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

    Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer 1.21.0 through 1.26.0 allows a remote attacker to cause a denial of service when max_packet_size is configured above 2147483648. A packet header declaring a length above 2^31 makes the buffer size computation overflow, leaving the growth loop unable to terminate. Because PgBouncer serves all clients from a single process, this saturates a CPU core and stalls every pooled connection until the process is restarted. Since 1.23.0 the ove…

    CVE-2026-107348
    Read original (opens in a new tab)
  12. NVD

    CVE-2026-106465 — In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603, the NetX Secure DTLS server never compares the cookie a clien…

    Medium · CVSS 4.0 6.9 · Assessor: [email protected]

    In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603, the NetX Secure DTLS server never compares the cookie a client returns with the one it issued, and treats any non-empty cookie as verified. A remote attacker can make the server send its full handshake flight, several kilobytes, to a forged source address, using it to reflect amplified traffic at a third party.

    CVE-2026-106465
    Read original (opens in a new tab)
  13. NVD

    CVE-2026-106464 — In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the NetX Secure X.509 parser accepts a certificate wh…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the NetX Secure X.509 parser accepts a certificate whose signature is an empty BIT STRING and records a signature length of 0xFFFFFFFF. A remote peer can present such a certificate during the TLS handshake, before authentication, and make the device read far outside the certificate buffer during signature verification, which is expected to fault.

    CVE-2026-106464
    Read original (opens in a new tab)
  14. NVD

    CVE-2026-105066 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SimplyRETS SimplyRETS…

    High · CVSS 3.1 7.1 · Assessor: [email protected]

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SimplyRETS SimplyRETS Real Estate IDX simply-rets allows Reflected XSS.This issue affects SimplyRETS Real Estate IDX: from n/a through 3.2.9.

    CVE-2026-105066
    Read original (opens in a new tab)
  15. NVD

    CVE-2026-104103 — Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models. Prior to 0.17.8, ludwig.datas…

    High · CVSS 3.1 8.1 · Assessor: [email protected]

    Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models. Prior to 0.17.8, ludwig.datasets.archives.extract_archive() validated tar member names before calling TarFile.extractall() but did not validate symlink members or hard-link members. A crafted archive could create a link that escaped the extraction directory and then write a later member through that link, placing attacker-controlled content at an arbitrary filesystem path with the extracting process's privileges. The sam…

    CVE-2026-104103
    Read original (opens in a new tab)
  16. NVD

    CVE-2026-103975 — Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to…

    Medium · CVSS 3.1 6.5 · Assessor: [email protected]

    Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 7.2.6, @appium/support ZIP extraction accepts an archive entry that creates a symbolic link to a location outside the extraction directory and then accepts a later regular-file entry whose legitimate name resolves through that link. The lexical containment check examines entry names without validating the symlink target or the real destination, so an attacker-controlled archive can write file…

    CVE-2026-103975
    Read original (opens in a new tab)
  17. NVD

    CVE-2026-103415 — When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without check…

    Critical · CVSS 4.0 9.3 · Assessor: [email protected]

    When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checking that the cookie fits in the outgoing packet. Both the length and the contents of that cookie come from the peer, and the write happens before certificate authentication completes, so a malicious or compromised server can overwrite memory past the caller supplied TLS packet buffer without presenting a certificate. Only the client path is affected.

    CVE-2026-103415
    Read original (opens in a new tab)
  18. NVD

    CVE-2026-103414 — The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resource f…

    High · CVSS 4.0 8.4 · Assessor: [email protected]

    The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because `gx_page_header_data_size` is never validated against the glyph data a page actually contains, the two passes can read different page headers for the same font page, derive different glyph counts, and reserve less than the load pass writes. The excess is written past the end of the arena, with content taken verbatim from the file. The overflowed…

    CVE-2026-103414
    Read original (opens in a new tab)
  20. NVD

    CVE-2026-102476 — In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL contex…

    Critical · CVSS 4.0 9.1 · Assessor: [email protected]

    In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiency purpose, the key of this cache should reflect entirely the SSL semantics of the desired SSL properties. It is possible for a client to ask for an SSL context and obtain an SSL context with weaker properties, for instance a context with hostname validation and obtain a context ignoring hostname validation. The impacted component is io.vertx:vertx-core.

    CVE-2026-102476
    Read original (opens in a new tab)
  21. NVD

    CVE-2026-102077 — An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Netwo…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series with SPC3 allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). On MX Series with SPC3 line-card and source NAT configuration, when a specific malformed IPv6 packet is received, it is not dropped but instead a session is created and NAT resources are allocated. Continued receipt of such packets will eventually lead to session or resour…

    CVE-2026-102077
    Read original (opens in a new tab)
  22. NVD

    CVE-2026-101983 — A Stack-based Buffer Overflow vulnerability in the httpd process of Juniper Networks Junos OS and Junos OS Evolved allows an…

    Critical · CVSS 4.0 9.3 · Assessor: [email protected]

    A Stack-based Buffer Overflow vulnerability in the httpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to cause remote code execution and denial of service via a J-Web virtual-domain configured.

    CVE-2026-101983
    Read original (opens in a new tab)
  23. NVD

    CVE-2026-101982 — A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS E…

    Critical · CVSS 4.0 9.3 · Assessor: [email protected]

    A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP/EVPN peer to cause root code execution on Junos OS or an rpd crash on Junos OS Evolved via protocol-valid route advertisements for an EVPN-VPWS service.

    CVE-2026-101982
    Read original (opens in a new tab)
  24. NVD

    CVE-2026-101981 — A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS E…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent LDP peer to cause an rpd crash or execute arbitrary code via a malformed LDP Label Mapping message.

    CVE-2026-101981
    Read original (opens in a new tab)
  25. NVD

    CVE-2026-101979 — A Stack-based Buffer Overflow vulnerability in the authd Juniper Networks Junos OS and Junos OS Evolved allows a network att…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    A Stack-based Buffer Overflow vulnerability in the authd Juniper Networks Junos OS and Junos OS Evolved allows a network attacker with SNMP read access to execute code with root privileges or cause a denial of service via a specific SNMP packet, when SNMP and AAA are enabled.

    CVE-2026-101979
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.