THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
Every cached source, newest first. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
18,799 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUp to date · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-63158 — Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a us…
Critical · CVSS 4.0 9.1 · Assessor: [email protected]
Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt password hash to authenticate as that user without knowing the actual password, caused by the legacy AGORAP_LOG/AGORAP_PASS cookie mechanism treating the stored hash as a directly replayable bearer credential. Attackers can set the AGORAP_LOG/AGORAP_PASS cookies with a stolen password hash to impersonate any user, including administrators, and gain unauthorized access to th…
CVE-2026-63158Read original ↗ (opens in a new tab) - NVD
CVE-2026-63154 — Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator t…
High · CVSS 4.0 8.7 · Assessor: [email protected]
Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled agoraFields[] names as unvalidated SQL column identifiers during the user import flow. Attackers can inject privileged column names such as generalAdmin or use backtick-injection techniques to set administrative flags and escalate to general administrator privileges.
CVE-2026-63154Read original ↗ (opens in a new tab) - NVD
CVE-2026-63153 — Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations() that allows authe…
High · CVSS 4.0 8.6 · Assessor: [email protected]
Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations() that allows authenticated attackers to insert access-right records for a caller-supplied target space without verifying the caller has rights to that space. Attackers can assign access affectations to spaces outside their own reach, breaking tenant isolation and granting unauthorized access to restricted spaces.
CVE-2026-63153Read original ↗ (opens in a new tab) - NVD
CVE-2026-63152 — Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attacke…
High · CVSS 4.0 8.6 · Assessor: [email protected]
Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject malicious SQL via the _idCategoryFilter parameter, which is persisted into the session and later concatenated into a SQL statement without parameterization. Attackers can store a malicious payload that executes when the filter is subsequently applied in app/Common/MdlCategory.php, leading to unauthorized database access or manipulation.
CVE-2026-63152Read original ↗ (opens in a new tab) - NVD
CVE-2026-63149 — Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that allows attackers to predict tempor…
Critical · CVSS 4.0 9.1 · Assessor: [email protected]
Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that allows attackers to predict temporary or default account passwords generated by Txt::defaultPassword() using PHP's uniqid() function based on server time in microseconds. Attackers who observe or approximate the account creation time can compute the predictable password and take over the account before the legitimate user logs in.
CVE-2026-63149Read original ↗ (opens in a new tab) - NVD
CVE-2026-63148 — Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attack…
Medium · CVSS 4.0 5.1 · Assessor: [email protected]
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject HTML/script markup by uploading a poll-response attachment with a malicious filename that bypasses the paramFilter sanitization applied to $_FILES. Attackers can submit a crafted filename that is stored and later rendered in components such as the dashboard controller (CtrlDashboard), executing arbitrary script in the browsers of users who view the affected page.
CVE-2026-63148Read original ↗ (opens in a new tab) - NVD
CVE-2026-63147 — Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users…
Medium · CVSS 4.0 5.1 · Assessor: [email protected]
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious script by uploading a file with HTML/script markup embedded in its filename, which bypasses the paramFilter since uploaded-file names arrive through $_FILES rather than $_GET/$_POST. Attackers can upload a file with a crafted name such as an SVG onload payload to have the unsanitized filename stored and later rendered to other users, resulting in script execution in their…
CVE-2026-63147Read original ↗ (opens in a new tab) - NVD
CVE-2026-63146 — Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, attacker-controlled values a…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, attacker-controlled values are written into the config.inc.php configuration file during installation through File::updateConfigFile() and DbInstall::dbControl(), combined with an SQL injection issue enabled by PDO::ATTR_EMULATE_PREPARES supporting stacked queries. Attackers can exploit the SQL injection to re-trigger the installer and inject arbitrary PHP code into config.inc.php, achieving unauthenticated remote code…
CVE-2026-63146Read original ↗ (opens in a new tab) - NVD
CVE-2026-56826 — Shopper is a Headless e-commerce Admin Panel. From 2.0.0 until 2.9.2, authenticated users who could reach the Settings pages…
Medium · CVSS 3.1 5.4 · Assessor: [email protected]
Shopper is a Headless e-commerce Admin Panel. From 2.0.0 until 2.9.2, authenticated users who could reach the Settings pages with only access_setting could directly invoke destructive actions through the Livewire endpoint because packages/admin/src/Livewire/Components/Settings/Zones/ZoneShippingOptions.php, packages/admin/src/Livewire/Components/Settings/Zones/Detail.php, packages/admin/src/Livewire/Components/Settings/Taxes/Detail.php, and packages/admin/src/Livewire/Components/Settings/Taxes/TaxRates.php did not…
CVE-2026-56826Read original ↗ (opens in a new tab) - NVD
CVE-2026-55601 — MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX exec…
High · CVSS 3.1 7.3 · Assessor: [email protected]
MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then check_filter_exec() in mt.c passed the constructed command through execute_program() in exec.c to sh -c. Partial escaping left shell metacharacters such as command substitution active, allowing an attacker who could influence monitored input to execute commands as the user runnin…
CVE-2026-55601Read original ↗ (opens in a new tab) - NVD
CVE-2026-48398 — Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this…
Medium · CVSS 3.1 5.4 · Assessor: [email protected]
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
CVE-2026-48398Read original ↗ (opens in a new tab) - NVD
CVE-2026-48383 — Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code executi…
Critical · CVSS 3.1 10.0 · Assessor: [email protected]
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-48383Read original ↗ (opens in a new tab) - NVD
CVE-2026-48382 — Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code executi…
Critical · CVSS 3.1 10.0 · Assessor: [email protected]
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-48382Read original ↗ (opens in a new tab) - NVD
CVE-2026-16753 — Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an a…
High · CVSS 3.1 8.8 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated administrator or developer in one organization to execute a library query belonging to another organization via a crafted request containing the victim library-query identifier.
CVE-2026-16753Read original ↗ (opens in a new tab) - NVD
CVE-2026-110084 — Adobe Experience Manager is affected by an XML Injection (aka Blind XPath Injection) vulnerability that could result in a Se…
High · CVSS 3.1 7.1 · Assessor: [email protected]
Adobe Experience Manager is affected by an XML Injection (aka Blind XPath Injection) vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction.
CVE-2026-110084Read original ↗ (opens in a new tab) - NVD
CVE-2026-110083 — Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injectio…
High · CVSS 3.1 7.1 · Assessor: [email protected]
Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction.
CVE-2026-110083Read original ↗ (opens in a new tab) - NVD
CVE-2026-110082 — Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker i…
Medium · CVSS 3.1 5.4 · Assessor: [email protected]
Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed.
CVE-2026-110082Read original ↗ (opens in a new tab) - NVD
CVE-2026-110081 — Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-priv…
Medium · CVSS 3.1 5.4 · Assessor: [email protected]
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
CVE-2026-110081Read original ↗ (opens in a new tab) - NVD
CVE-2026-110080 — Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this…
Medium · CVSS 3.1 5.4 · Assessor: [email protected]
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
CVE-2026-110080Read original ↗ (opens in a new tab) - NVD
CVE-2026-110079 — Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this…
Medium · CVSS 3.1 5.4 · Assessor: [email protected]
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
CVE-2026-110079Read original ↗ (opens in a new tab) - NVD
CVE-2026-110078 — Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this…
Medium · CVSS 3.1 5.4 · Assessor: [email protected]
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
CVE-2026-110078Read original ↗ (opens in a new tab) - NVD
CVE-2026-110077 — Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this…
Medium · CVSS 3.1 5.4 · Assessor: [email protected]
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
CVE-2026-110077Read original ↗ (opens in a new tab) - NVD
CVE-2026-110076 — Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this…
Medium · CVSS 3.1 5.4 · Assessor: [email protected]
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
CVE-2026-110076Read original ↗ (opens in a new tab) - NVD
CVE-2026-110075 — Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this…
Medium · CVSS 3.1 5.4 · Assessor: [email protected]
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
CVE-2026-110075Read original ↗ (opens in a new tab) - NVD
CVE-2026-110074 — Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this…
Medium · CVSS 3.1 5.4 · Assessor: [email protected]
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
CVE-2026-110074Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.