THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
Every cached source, newest first. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,265 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates · Some delayed
- NVDUpdates delayed · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUpdates delayed · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-111756 — follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to bef…
High · CVSS 4.0 8.2 · Assessor: [email protected]
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller's headers container with for...in and matches header names against a filter. This assumes th…
CVE-2026-111756Read original ↗ (opens in a new tab) - NVD
CVE-2026-105772 — Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScript (@google/adk) versions 0.4.0 before 0.6.0 allows a r…
Critical · CVSS 4.0 9.1 · Assessor: [email protected]
Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScript (@google/adk) versions 0.4.0 before 0.6.0 allows a remote unauthenticated attacker to read files matching the artifact directory layout or write files (when an agent tool invokes saveArtifact) outside the intended artifact storage root via crafted relative or percent-encoded path traversal sequences (such as ../ or ..%2F) in the userId or sessionId parameters when the ADK API server is exposed with the non-default FileArtifactService enabled.…
CVE-2026-105772Read original ↗ (opens in a new tab) - NVD
CVE-2026-92539 — A service account with user-management permissions in one organization can read, modify, disable or delete users belonging t…
Medium · CVSS 3.1 6.7 · Assessor: [email protected]
A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.
CVE-2026-92539Read original ↗ (opens in a new tab) - NVD
CVE-2026-28331 — SolarWinds Patch Manager exposes sensitive information accessible to local users, which could be used to gain elevated privi…
Medium · CVSS 3.1 4.4 · Assessor: [email protected]
SolarWinds Patch Manager exposes sensitive information accessible to local users, which could be used to gain elevated privileges.
CVE-2026-28331Read original ↗ (opens in a new tab) - NVD
CVE-2026-28330 — SolarWinds Observability Self-Hosted was found to be affected by a stored Cross-Site Scripting (XSS) vulnerability that allo…
Medium · CVSS 3.1 4.6 · Assessor: [email protected]
SolarWinds Observability Self-Hosted was found to be affected by a stored Cross-Site Scripting (XSS) vulnerability that allows authenticated attackers to inject malicious content or JavaScript, which is displayed or executed in the browsers of other authenticated users who access the affected pages.
CVE-2026-28330Read original ↗ (opens in a new tab) - NVD
CVE-2026-28329 — SolarWinds Observability Self-Hosted was found to be affected by a Server-Side Request Forgery (SSRF) vulnerability that all…
Medium · CVSS 3.1 6.4 · Assessor: [email protected]
SolarWinds Observability Self-Hosted was found to be affected by a Server-Side Request Forgery (SSRF) vulnerability that allows authenticated attackers to cause the application server to send requests to attacker-controlled or internal destinations.
CVE-2026-28329Read original ↗ (opens in a new tab) - NVD
CVE-2026-28328 — SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged…
High · CVSS 3.1 8.8 · Assessor: [email protected]
SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access and modify information beyond their assigned permissions.
CVE-2026-28328Read original ↗ (opens in a new tab) - NVD
CVE-2026-113658 — ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conver…
High · CVSS 3.1 7.5 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conversion route writes a multipart upload to the system temporary directory before checking its extension and does not remove the staged file when that validation rejects it. Repeated large rejected uploads, using the normal public CSRF cookie, can persistently consume temporary-disk capacity and may disrupt ApostropheCMS and other services that depend on the same partition. This issue is fixed in…
CVE-2026-113658Read original ↗ (opens in a new tab) - NVD
CVE-2026-113657 — ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a…
Low · CVSS 3.1 3.7 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From sanitize-html 2.17.7 until 2.18.0, an application configuration that permits namespace-prefixed SVG animation elements and the relevant URL-targeting attributes can bypass the SMIL URL protection because prefixed tag names do not match the unprefixed animation-element check. The bypass can rewrite a link destination to an unsafe URI after the sanitized SVG is rendered, with s…
CVE-2026-113657Read original ↗ (opens in a new tab) - NVD
CVE-2026-113656 — ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its form…
Medium · CVSS 3.1 5.3 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its form submission route stages unbounded multipart uploads before form validation or authentication and lacks upload size, count, and rate limits. Repeated unauthenticated submissions can consume temporary disk storage and disrupt form handling or other host services. This issue is fixed in ApostropheCMS Form 1.5.5.
CVE-2026-113656Read original ↗ (opens in a new tab) - NVD
CVE-2026-113655 — ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an authenticated editor with legitimate…
Medium · CVSS 3.1 4.3 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an authenticated editor with legitimate edit rights on a pre-existing ordinary page nested under a restricted parent can use the same-parent page move operation to change sibling ranks without create authorization on that parent. The non-default nesting must already exist, and the bypass is limited to sibling ordering rather than arbitrary content modification, confidentiality loss, or creation of the restricted nesting. This issue…
CVE-2026-113655Read original ↗ (opens in a new tab) - NVD
CVE-2026-113654 — ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default nonTextTags configuration that includes noscript can end its discard region early when htmlparser2 emits an implied ancestor close inside noscript. Because scripting-enabled browsers treat noscript content as raw text while the parser does not model that mode, content intended to remain inert can survive sanitization and render; the iss…
CVE-2026-113654Read original ↗ (opens in a new tab) - NVD
CVE-2026-113653 — ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, viewRole is not applied to anonymous vis…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, viewRole is not applied to anonymous visitors when a developer exposes user objects through a publicly rendered relationship or expressly enabled public API. Inadequately limited templates, including serialization of an entire related user object, can conditionally disclose user fields, but relationships do not automatically publish full user objects and password hashes are stored separately and are not affected. This issue is fixe…
CVE-2026-113653Read original ↗ (opens in a new tab) - NVD
CVE-2026-113652 — ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leaks ac…
Medium · CVSS 3.1 5.6 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leaks account-level SAS token into every public attachment URL. When uploadfs is configured with the Azure backend and sas: true, createContainer() builds the BlobServiceClient from a URL that embeds the full SAS query string, and Azure SDK v12 derived clients inherit that query string. This issue is fixed in version 1.28.0.
CVE-2026-113652Read original ↗ (opens in a new tab) - NVD
CVE-2026-113651 — ApostropheCMS is an open-source Node.js content management system, and uploadfs is its file storage library. Prior to upload…
Low · CVSS 3.1 3.3 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system, and uploadfs is its file storage library. Prior to uploadfs 1.28.0, attacker-controlled paths that reach the local backend can contain parent-directory segments that escape the configured upload directory and affect file reads, writes, and deletion on the host filesystem. Exploitability depends on an application exposing the relevant uploadfs operations to untrusted path. This issue is fixed in uploadfs 1.28.0.
CVE-2026-113651Read original ↗ (opens in a new tab) - NVD
CVE-2026-113650 — ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an is not allowed and disal…
Medium · CVSS 3.1 5.3 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an is not allowed and disallowedTagsMode is 'discard' (the defaults), its raw-text content is re-sanitized by a recursive call to sanitizeHtml(text, options). The recursion has no bound and starts each nested call with a fresh state. This vulnerability is fixed in 2.18.1.
CVE-2026-113650Read original ↗ (opens in a new tab) - NVD
CVE-2026-113649 — ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module and 4.34.0 of…
Medium · CVSS 3.1 6.5 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module and 4.34.0 of core ApostropheCMS, an editor who can import an enabled content type but lacks its stronger publication role can cause import write helpers to create, replace, or remove published variants without the normal publish permission and lifecycle checks. This issue is fixed in import-export 3.7.1 and ApostropheCMS 4.34.0.
CVE-2026-113649Read original ↗ (opens in a new tab) - NVD
CVE-2026-113648 — ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpo…
Low · CVSS 3.1 3.1 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticated anonymous users who have obtained the standard CSRF cookie from visiting the site—can directly invoke this route and trigger the underlying self.cleanExport(req) method. This issue is fixed in version 3.7.1.
CVE-2026-113648Read original ↗ (opens in a new tab) - NVD
CVE-2026-113505 — A flaw has been found in aaPanel up to 8.25.0. Impacted is the function send_file of the file BTPanel/routes/v2.py of the co…
Low · CVSS 4.0 2.1 · Assessor: [email protected]
A flaw has been found in aaPanel up to 8.25.0. Impacted is the function send_file of the file BTPanel/routes/v2.py of the component Download Endpoint. Executing a manipulation of the argument filename can lead to path traversal. The attack can be executed remotely. The exploit has been published and may be used. The vendor confirms: "The reported RCE and LFI vulnerabilities require authentication."
CVE-2026-113505Read original ↗ (opens in a new tab) - NVD
CVE-2026-112958 — ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a project-defined free-form widget style…
Medium · CVSS 3.1 5.4 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a project-defined free-form widget style field can carry an editor-controlled quote into an inline style attribute because the wrapper serializer does not apply HTML-attribute encoding. The quote can terminate the style attribute and inject executable attributes when published content, or an affected draft viewed by a higher-privileged user, is rendered. This issue is fixed in version 4.34.0.
CVE-2026-112958Read original ↗ (opens in a new tab) - NVD
CVE-2026-112957 — ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the getOne REST endpoint for pages does…
Medium · CVSS 3.1 4.3 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a document _id can read the full content of admin-only pages and their privileged fields, while the getAll endpoint correctly enforces both restrictions. This issue is fixed in version 4.34.0.
CVE-2026-112957Read original ↗ (opens in a new tab) - NVD
CVE-2026-95109 — The Cortex-A7 MMU Modules port validates a caller-supplied buffer by translating **one address** — the first byte. The commo…
High · CVSS 4.0 8.5 · Assessor: [email protected]
The Cortex-A7 MMU Modules port validates a caller-supplied buffer by translating **one address** — the first byte. The common Module Manager hands its range check the module instance, the start address and the complete byte size; the Cortex-A7 implementation discarded the instance and the size and asked the MMU a single question about the start. A memory-protected module therefore passed any range whose first byte was user-readable, however far the rest of it reached. Privileged dispatch code then read or wrote th…
CVE-2026-95109Read original ↗ (opens in a new tab) - NVD
CVE-2026-95108 — One logical thread of a user-mode ThreadX module costs the Module Manager's shared object pool two allocations, not one. The…
Medium · CVSS 4.0 6.8 · Assessor: [email protected]
One logical thread of a user-mode ThreadX module costs the Module Manager's shared object pool two allocations, not one. The module asks for a `TX_THREAD` control block through `txm_module_object_allocate`; `_txm_module_manager_thread_create` then takes a second allocation of `TXM_MODULE_KERNEL_STACK_SIZE` bytes for the privileged kernel stack that thread's system calls run on, and records it in the control block. Both come from `_txm_module_manager_object_pool` and both are linked onto the module's allocation lis…
CVE-2026-95108Read original ↗ (opens in a new tab) - NVD
CVE-2026-95107 — A ThreadX module chooses `object_size` when it calls `txm_module_object_allocate`. The Module Manager adds its own 16-byte p…
High · CVSS 4.0 7.0 · Assessor: [email protected]
A ThreadX module chooses `object_size` when it calls `txm_module_object_allocate`. The Module Manager adds its own 16-byte private header to that size and asked the object pool for the result **without checking the addition**. A size near the top of a `ULONG` wrapped, the pool served a block far smaller than the header, and the manager then wrote the header past the end of it and into the neighbouring byte-pool block.
CVE-2026-95107Read original ↗ (opens in a new tab) - NVD
CVE-2026-94202 — The Module Manager's block-pool create dispatcher proved that two `ALIGN_TYPE` words of the extra-parameter array a memory-p…
Medium · CVSS 4.0 4.8 · Assessor: [email protected]
The Module Manager's block-pool create dispatcher proved that two `ALIGN_TYPE` words of the extra-parameter array a memory-protected module supplies lay inside the module's data, and then used indices 0 through 3 of that array. One of the two unproved words is read by the dispatcher's own buffer check, which takes index 1 as the pool start and index 2 as the length to range-check it over. So the out-of-bounds read is performed by the validation code itself, before the kernel service is reached, and the size the ca…
CVE-2026-94202Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.