THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
Every cached source, newest first. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,288 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates · Some delayed
- NVDUpdates delayed · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUpdates delayed · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-86409 — Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A…
CVSS unscored / not supplied
Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL isset next, leaking state information.
CVE-2026-86409Read original ↗ (opens in a new tab) - NVD
CVE-2026-113869 — When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting…
Medium · CVSS 3.1 5.4 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a use-after-free and a potentially exploitable crash. This vulnerability was fixed in Thunderbird 158.0.1.
CVE-2026-113869Read original ↗ (opens in a new tab) - NVD
CVE-2026-113868 — When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's challenge was valid…
Medium · CVSS 3.1 5.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's challenge was valid base64. A malicious server could send a challenge that caused Thunderbird to include uninitialized heap memory in its NTLM response, disclosing that memory to the server. A challenge consisting only of base64 padding also caused an out-of-bounds read, crashing Thunderbird. This affected accounts configured to use NTLM or GSSAPI authentication. The uninitialized memory disclosure only affected…
CVE-2026-113868Read original ↗ (opens in a new tab) - NVD
CVE-2026-113867 — Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests we…
CVSS unscored / not supplied
Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to inject arbitrary stanzas into the user's connection, which the server would then process as if sent by the user. This could be used to send messages or change contact and subscription settings on behalf of the user, without any interaction. This bug only affects Thunderbird's chat f…
CVE-2026-113867Read original ↗ (opens in a new tab) - NVD
CVE-2026-113866 — When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over p…
Medium · CVSS 3.1 5.9 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.
CVE-2026-113866Read original ↗ (opens in a new tab) - NVD
CVE-2026-113725 — virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, the bash activate script escapes t…
High · CVSS 3.1 7.8 · Assessor: [email protected]
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, the bash activate script escapes the environment name for only one of the two passes bash makes over PS1, so a backslash in the name undoes the escaping and a name containing \$(...) runs as commands in the user's shell each time bash draws the prompt. This issue is fixed in version 21.14.7.
CVE-2026-113725Read original ↗ (opens in a new tab) - NVD
CVE-2026-113724 — virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the safe_delete() deletion error h…
Medium · CVSS 3.1 4.5 · Assessor: [email protected]
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the safe_delete() deletion error handler responds to a failed removal by reading mode bits with os.lstat(path) and applying owner-write permission with os.chmod(path, ...), which follows a symlink. A planted link inside a read-only directory can therefore cause a victim-owned target outside the destination that is initially not writable by the invoking user to become broadly writable before the retry fails, provided that user…
CVE-2026-113724Read original ↗ (opens in a new tab) - NVD
CVE-2026-113723 — virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can be…
High · CVSS 4.0 7.1 · Assessor: [email protected]
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. This vulnerability is fixed in 21.14.9.
CVE-2026-113723Read original ↗ (opens in a new tab) - NVD
CVE-2026-113722 — virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, virtualenv's ScriptMakerCustom and…
High · CVSS 3.1 7.8 · Assessor: [email protected]
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, virtualenv's ScriptMakerCustom and pip pass an incompletely quoted interpreter path to distlib ScriptMaker when generating POSIX console scripts. When the path contains a space or produces a shebang longer than 127 bytes, distlib emits a /bin/sh wrapper whose double-quoted interpreter path still expands command substitutions and backticks. An attacker who influences the environment destination can therefore execute commands w…
CVE-2026-113722Read original ↗ (opens in a new tab) - NVD
CVE-2026-113721 — virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator._generate() r…
Medium · CVSS 3.1 4.5 · Assessor: [email protected]
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator._generate() removes an existing output only when Path.exists() is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write() opens pyvenv.cfg without first replacing an existing symbolic or hard link. Another local account that prepares final entries inside the destination can therefore cause environment creation to create or overwrite files outside the…
CVE-2026-113721Read original ↗ (opens in a new tab) - NVD
CVE-2026-113720 — virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses shut…
Medium · CVSS 4.0 4.4 · Assessor: [email protected]
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses shutil.copy() to copy cached package files into later environments, causing cached source modes to override the current run's umask. A cache populated under a permissive umask can therefore produce files writable by another local account in a later traversable environment, allowing package code such as pip/__init__.py to be modified and executed by the environment owner. The attacker cannot force…
CVE-2026-113720Read original ↗ (opens in a new tab) - NVD
CVE-2026-113719 — virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall._uninstall_previous_ver…
Medium · CVSS 3.1 4.5 · Assessor: [email protected]
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall._uninstall_previous_version() accepts existing seed-package metadata and _uninstall_dist() joins entries from top_level.txt and RECORD to site-packages without checking containment. When a reused destination contains distribution metadata influenced by another account, relative traversal, absolute entries, or linked parents can cause app-data reseeding to delete files outside the environment or the environment root…
CVE-2026-113719Read original ↗ (opens in a new tab) - NVD
CVE-2026-113718 — virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh activation quote() use…
High · CVSS 4.0 7.1 · Assessor: [email protected]
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh activation quote() uses repr() to write printable non-ASCII prompt or destination data into UTF-8 activate.xsh, while xonsh can read that script using $XONSH_ENCODING. Under a legacy multibyte codec such as GBK or Big5, a UTF-8 trail byte can consume the backslash before an adjacent quote, allowing the literal to close and attacker-influenced statements to execute when the user sources the generated script. This i…
CVE-2026-113718Read original ↗ (opens in a new tab) - NVD
CVE-2026-113717 — virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInvoke.get_pip_install_cmd() ha…
Low · CVSS 4.0 2.3 · Assessor: [email protected]
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInvoke.get_pip_install_cmd() handles --seeder pip --download by calling get_wheel(download=False) and then allowing pip to consult the configured index, bypassing virtualenv's download_wheel() and verify_wheel_digest() path. When virtualenv's default-index PyPI digest comparison remains enabled, an index candidate matching the bundled package and version can therefore be selected without comparison to PyPI SHA-256 metadata…
CVE-2026-113717Read original ↗ (opens in a new tab) - NVD
CVE-2026-113716 — virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the builtin creator calls ensure_d…
Medium · CVSS 3.1 4.5 · Assessor: [email protected]
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the builtin creator calls ensure_dir() for executable, library, and package directories, and ensure_dir() accepts an existing symlink to a directory because exists() follows it. Interpreter creation, seed installation, and activation generation then write through the linked parent outside the requested destination when another local account prepared the tree and the invoking user can access the target. The --clear option remo…
CVE-2026-113716Read original ↗ (opens in a new tab) - NVD
CVE-2026-113715 — virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads gene…
Low · CVSS 4.0 2.0 · Assessor: [email protected]
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads generated pyvenv.cfg with str.splitlines() and merges parsed keys over virtualenv's selected configuration. An untrusted caller who influences the destination pathname can include a line-boundary character such as U+2028 to inject keys including home and include-system-site-packages, causing path data to change configuration structure before final output. Setting include-system-site-packages to t…
CVE-2026-113715Read original ↗ (opens in a new tab) - NVD
CVE-2026-112380 — Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-c…
Critical · CVSS 4.0 9.0 · Assessor: ff89ba41-3aa1-4d27-914a-91399e9639e5
Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control the operator's other agent sessions and execute arbitrary commands on the host running Kiro Crew via messages sent to the group. To remediate this issue, users should upgrade to version 0.7.2.
CVE-2026-112380Read original ↗ (opens in a new tab) - NVD
CVE-2026-107692 — The War Thunder game client transmits its authentication bearer token (auth_jwt) in the very first data packet after the TCP…
Medium · CVSS 3.1 4.8 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
The War Thunder game client transmits its authentication bearer token (auth_jwt) in the very first data packet after the TCP handshake, using only LZ4 compression rather than encryption. An attacker positioned on the network path can passively intercept and decompress this packet to reveal the plaintext JSON payload. This vulnerability allows for temporary authenticated impersonation, enabling an attacker to access game services and certain user data (such as email address and displayed phone number) as the affect…
CVE-2026-107692Read original ↗ (opens in a new tab) - NVD
CVE-2026-97406 — XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token crea…
CVSS unscored / not supplied
XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent successor credentials.
CVE-2026-97406Read original ↗ (opens in a new tab) - NVD
CVE-2026-113810 — A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can…
High · CVSS 3.1 7.0 · Assessor: [email protected]
A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS when requesting certificate creation for user. The stored XSS can only be triggered during validation by the administrator.
CVE-2026-113810Read original ↗ (opens in a new tab) - NVD
CVE-2026-113808 — A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can…
High · CVSS 3.1 7.1 · Assessor: [email protected]
A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS when requesting user creation. The stored XSS can only be triggered during validation by the administrator.
CVE-2026-113808Read original ↗ (opens in a new tab) - NVD
CVE-2026-113714 — virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, download_wheel() writes package-in…
Low · CVSS 4.0 2.3 · Assessor: [email protected]
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, download_wheel() writes package-index downloads directly into the reusable wheel/house cache before selecting a verification target from pip's textual Saved output. With default-index digest comparison enabled, a controlled package index can inject a misleading Saved line through a discarded link's data-requires-python attribute; this forged-line variant also requires knowledge of an absolute path to the genuine bundled wheel…
CVE-2026-113714Read original ↗ (opens in a new tab) - NVD
CVE-2026-113713 — virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can…
Medium · CVSS 4.0 4.4 · Assessor: [email protected]
virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlink_app_data can enable this state even though the command-line flag is disabled for temporary app-data. The resulting environment depends on a cache pathname that its owner no longer controls. This issue is fixed in version 21.14…
CVE-2026-113713Read original ↗ (opens in a new tab) - NVD
CVE-2026-113712 — Cachet is an open-source status page system. Versions 2.4.1 and earlier have a stored Cross-Site Scripting (XSS) vulnerabili…
Medium · CVSS 4.0 4.8 · Assessor: [email protected]
Cachet is an open-source status page system. Versions 2.4.1 and earlier have a stored Cross-Site Scripting (XSS) vulnerability in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that executes in the browser of any user who views the status page, potentially leading to session token theft and account takeover. Commits 57b44a8bac0b250b0d5751e93e0349070d14606e and 23adbb88ffa819f92be4a905ff1d812670d980a2 in `cachethq/core` patch the issue.
CVE-2026-113712Read original ↗ (opens in a new tab) - NVD
CVE-2026-113709 — Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-…
Critical · CVSS 3.1 9.9 · Assessor: [email protected]
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, when an operator has enabled --enable-helm for kustomize build, helmGlobals.configHome can point Helm's config and data directories at a repository-controlled location. Helm automatically loads a downloader plugin from `/.data/plugins` without a separate plugin-install step and executes its program inside argocd-repo-server when a helmCharts repository URL uses the plugin's protocol. The…
CVE-2026-113709Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.