THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
Every cached source, newest first. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,279 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates · Some delayed
- NVDUpdates delayed · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUpdates delayed · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-113708 — Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-…
Critical · CVSS 3.1 9.9 · Assessor: [email protected]
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Kustomize passes ref or version query values from remote resource, base, or component URLs to git fetch without an end-of-options separator. A leading-hyphen value can be parsed as --upload-pack and execute a command inside argocd-repo-server when the remote uses a local transport such as file://. Git does not run the supplied command for an https:// remote. The local transport does not…
CVE-2026-113708Read original ↗ (opens in a new tab) - NVD
CVE-2026-113643 — A vulnerability was found in EspoCRM up to 9.3.10/10.0.10. This affects the function ImageSourceProvider::get of the file ap…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
A vulnerability was found in EspoCRM up to 9.3.10/10.0.10. This affects the function ImageSourceProvider::get of the file application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php of the component PDF Rendering Pipeline. Performing a manipulation of the argument ID results in authorization bypass. The attack may be initiated remotely. The patch is named 91a9edbcedb9c7aa8e3d3ac81d8a7acccb99bca2. It is suggested to install a patch to address this issue.
CVE-2026-113643Read original ↗ (opens in a new tab) - NVD
CVE-2026-111767 — MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to bef…
High · CVSS 3.1 8.6 · Assessor: [email protected]
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. This issue has been patched in version 1.32.0.
CVE-2026-111767Read original ↗ (opens in a new tab) - NVD
CVE-2026-111088 — A Stored Cross-Site Scripting vulnerability exists in the SNS VPN log monitoring screen.
Medium · CVSS 3.1 6.5 · Assessor: [email protected]
A Stored Cross-Site Scripting vulnerability exists in the SNS VPN log monitoring screen.
CVE-2026-111088Read original ↗ (opens in a new tab) - NVD
CVE-2026-100134 — Acrobat for Edge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the co…
High · CVSS 3.1 8.8 · Assessor: [email protected]
Acrobat for Edge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-100134Read original ↗ (opens in a new tab) - NVD
CVE-2026-100132 — Acrobat for Edge is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An at…
Medium · CVSS 3.1 4.3 · Assessor: [email protected]
Acrobat for Edge is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.
CVE-2026-100132Read original ↗ (opens in a new tab) - NVD
CVE-2026-113802 — Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command injection vulnerability in the sub_23B54 functi…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command injection vulnerability in the sub_23B54 function of the ioos binary, which passes the unsanitized file_id parameter of /protocol.csp?opt=ovpn_file requests with type=del to popen(). A remote unauthenticated attacker can send a forged IP-FROM: 127.0.0.1 header to bypass login and execute arbitrary commands as root.
CVE-2026-113802Read original ↗ (opens in a new tab) - NVD
CVE-2026-113711 — ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 3.7.0 of the import-…
High · CVSS 3.1 7.5 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 3.7.0 of the import-export module, import routes invoke bigUploadMiddleware without an early authorize callback, allowing unauthenticated requests to perform upload initialization, chunk storage, temporary processing, and attacker-declared cleanup work before the later user check rejects the import. This issue is fixed in ApostropheCMS 4.33.0 and import-export 3.7.0.
CVE-2026-113711Read original ↗ (opens in a new tab) - NVD
CVE-2026-113710 — ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the self-service password-change endpoin…
Medium · CVSS 3.1 5.9 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the self-service password-change endpoint verifies the current password but does not use the login module’s failed-attempt counter, throttle, delay, or lockout mechanism. An attacker with a valid authenticated session can submit repeated guesses for the current password without receiving a lockout or throttle response. This issue is fixed in version 4.33.0.
CVE-2026-113710Read original ↗ (opens in a new tab) - NVD
CVE-2026-113672 — Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 0.9.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-…
Critical · CVSS 3.1 9.9 · Assessor: [email protected]
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 0.9.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the repo-server evaluates .jsonnet files with an importer that does not confine import, importstr, or importbin to the repository root. Absolute paths, parent-directory traversal, and repository symlinks can open any file readable by the repo-server, including /proc/self/environ, projected service-account tokens, mounted private keys, and repository credentials. Although generated Secret…
CVE-2026-113672Read original ↗ (opens in a new tab) - NVD
CVE-2026-113671 — ApostropheCMS is an open-source Node.js content management system. From 1.0.0-beta.10 until 1.0.0-beta.13 of the AI helper,…
Medium · CVSS 3.1 4.3 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system. From 1.0.0-beta.10 until 1.0.0-beta.13 of the AI helper, an editor with image-generation capability can create a base64-generated image record without a stored provider URL and invoke image acceptance on a deployment using local relative storage with no trusted global base URL. The server resolves the fixed uploads path against a request-controlled Host-derived origin, enabling bounded server-side requests to an attacker-selected host, port, and HT…
CVE-2026-113671Read original ↗ (opens in a new tab) - NVD
CVE-2026-113670 — ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the core page REST API reads full page d…
Medium · CVSS 3.1 5.3 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the core page REST API reads full page documents with .permission(false) in getOne and in the all=1 tree dump, bypassing page-type viewRole, visibility: private, and visibility: loginRequired checks. Unauthenticated visitors and low-privilege contributors can read admin-only and non-public page content by _id/slug. This issue is fixed in version 4.33.0.
CVE-2026-113670Read original ↗ (opens in a new tab) - NVD
CVE-2026-113669 — ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passport-br…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passport-bridge, cross-host or cross-locale session migration places a single-use bearer session token in a redirect URL. A client that obtains and redeems a still-valid, unconsumed token before its first use can adopt the associated session, including through the passport-bridge cross-locale flow. This issue is fixed in ApostropheCMS 4.33.0 and passport-bridge 1.6.1.
CVE-2026-113669Read original ↗ (opens in a new tab) - NVD
CVE-2026-113668 — ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the REST route GET /api/v1//:_id/locales…
Medium · CVSS 3.1 5.3 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the REST route GET /api/v1//:_id/locales (and the equivalent page route) does not apply the publicApiCheckAsync gate that ApostropheCMS's other read routes enforce. An unauthenticated caller can therefore query this route for any document _id and learn whether the document exists and which locales it is published in — a document-existence and locale-metadata disclosure that the read-API is otherwise supposed to gate. This issue is…
CVE-2026-113668Read original ↗ (opens in a new tab) - NVD
CVE-2026-113667 — ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptc…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha, these three CAPTCHA integrations interpolate an unencoded user-supplied response token into the provider verification request. Crafted tokens can smuggle request parameters and disrupt CAPTCHA verification and CAPTCHA-gated form or login flows; automated bypass probing is possible, but a successful CAPTCHA bypass or secret disclosure is not established. This i…
CVE-2026-113667Read original ↗ (opens in a new tab) - NVD
CVE-2026-113666 — ApostropheCMS is an open-source Node.js content management system. Prior to 1.1.0 of db-connect and 4.33.0 of ApostropheCMS,…
High · CVSS 3.1 7.1 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system. Prior to 1.1.0 of db-connect and 4.33.0 of ApostropheCMS, an account with view-draft access can submit a projection exclusion path that traverses through a constructor prototype chain to a shared prototype member when a consumer uses a SQLite, PostgreSQL, or multipostgres adapter and has a matching document. Every editing role has view-draft access, while guestApiAccess broadens this prerequisite to any logged-in account. The unsetNestedField helpe…
CVE-2026-113666Read original ↗ (opens in a new tab) - NVD
CVE-2026-113665 — ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH an…
Low · CVSS 3.1 3.7 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification. As a result, an unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user's notification. This issue is fixed in version 4.33.0.
CVE-2026-113665Read original ↗ (opens in a new tab) - NVD
CVE-2026-113664 — ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authentica…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a tar entry whose normalized destination targets a directory while bypassing the literal parent-path substring guard. Opening that directory as a write stream emits an unhandled filesystem error that can terminate the Node.js process; the source establishes this static primitive but not an end-to-end exploit or controlled arbitrary file read or write. This issue is fix…
CVE-2026-113664Read original ↗ (opens in a new tab) - NVD
CVE-2026-113662 — ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authentica…
Medium · CVSS 3.1 5.4 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated user with import access to a target type can supply an object or operator as an update-key value, causing the import query to match an unidentified existing document that the user has generic edit permission to modify. The normal findForEditing permission filter still limits the candidate documents, so the issue does not permit permission-free overwrite of arbitrary protected content. Thi…
CVE-2026-113662Read original ↗ (opens in a new tab) - NVD
CVE-2026-113661 — ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a…
Medium · CVSS 3.1 5.4 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default configuration that allows meta refresh elements and their http-equiv and content attributes can retain unsafe script or redirect destinations embedded in the refresh content value. This issue is fixed in sanitize-html 2.18.0.
CVE-2026-113661Read original ↗ (opens in a new tab) - NVD
CVE-2026-113660 — ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, ApostropheCMS’s exist-in-locale API allo…
Medium · CVSS 3.1 4.3 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorization criteria. This issue is fixed in version 4.33.0.
CVE-2026-113660Read original ↗ (opens in a new tab) - NVD
CVE-2026-113659 — ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an unauthenticated attacker can send a c…
Medium · CVSS 3.1 6.1 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an unauthenticated attacker can send a crafted link whose query string is automatically parsed by apos.http.parseQuery when an authenticated victim loads a page with the admin bundle. The parser accepts the special __proto__, constructor, and prototype path keys, allowing browser prototype mutation that can reach an unsafe DOM sink and execute script in the victim's session; anonymous visitors do not load the affected admin context…
CVE-2026-113659Read original ↗ (opens in a new tab) - NVD
CVE-2026-113507 — A vulnerability was found in aaPanel up to 8.25.0. The impacted element is the function GetClientIp of the file class/public…
Medium · CVSS 4.0 5.5 · Assessor: [email protected]
A vulnerability was found in aaPanel up to 8.25.0. The impacted element is the function GetClientIp of the file class/public/common.py. The manipulation of the argument X-Real-Ip results in improper access controls. The attack may be performed from remote. The exploit has been made public and could be used. The vendor confirms: "The reported X-Real-Ip IP-bypass vulnerability has already been fixed".
CVE-2026-113507Read original ↗ (opens in a new tab) - NVD
CVE-2026-113506 — A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class/pub…
High · CVSS 4.0 8.6 · Assessor: [email protected]
A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class/public/common.py of the component File Manager. The manipulation of the argument sfile/dfile/access/user leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: "The reported RCE and LFI vulnerabilities require authentication."
CVE-2026-113506Read original ↗ (opens in a new tab) - NVD
CVE-2026-112861 — Authorization Bypass Through User-Controlled Key vulnerability in xnau webdesign Participants Database participants-database…
Medium · CVSS 3.1 6.3 · Assessor: [email protected]
Authorization Bypass Through User-Controlled Key vulnerability in xnau webdesign Participants Database participants-database allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Participants Database: from n/a through 2.7.8.5.
CVE-2026-112861Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.