THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
Every cached source, newest first. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,226 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates · Some delayed
- NVDUpdates delayed · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUpdates delayed · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-94192 — A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask for t…
High · CVSS 4.0 8.5 · Assessor: [email protected]
A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask for that memory back by address with `txm_module_object_deallocate`. The manager released it whatever was in it, including a control block the kernel was still using. Deallocation is not deletion: the object stays on the created list for its type, a thread stays wherever it was on the ready or suspension lists and stays schedulable, and an active timer stays on the timer list. The byte pool is mea…
CVE-2026-94192Read original ↗ (opens in a new tab) - NVD
CVE-2026-94024 — The Module Manager's object lookup validated one byte of a memory-protected module's search name and then walked as much of…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
The Module Manager's object lookup validated one byte of a memory-protected module's search name and then walked as much of it as the module declared, in privileged mode, with the kernel's preemption count raised. Both lookup dispatchers are affected: the recommended `txm_module_object_pointer_get_extended` is handed a length and does not use it to bound the buffer, and the deprecated `txm_module_object_pointer_get` supplies the largest value a `UINT` can hold, so it removes the bound rather than lacking one. A mo…
CVE-2026-94024Read original ↗ (opens in a new tab) - NVD
CVE-2026-94023 — A ThreadX module reaches a kernel object's delete service through the Module Manager's dispatch layer, which asked one quest…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
A ThreadX module reaches a kernel object's delete service through the Module Manager's dispatch layer, which asked one question about the pointer: does the object lie outside the module's own code and data. That is the policy for *using* an object, and using an object a module does not own is supported and intended — `txm_module_object_pointer_get_extended` searches the system's created objects by name and hands back objects the application created and objects other modules created, so that a module can send to a…
CVE-2026-94023Read original ↗ (opens in a new tab) - NVD
CVE-2026-94018 — The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a `Content-Length` underflow…
High · CVSS 4.0 8.8 · Assessor: [email protected]
The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a `Content-Length` underflow while processing a `PUT` request. The condition is reachable by an unauthenticated remote client with a single malformed request.
CVE-2026-94018Read original ↗ (opens in a new tab) - NVD
CVE-2026-93475 — The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into f…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for the `NX_CRYPTO_MAX_RSA_MODULUS_SIZE` default of 4096 bits. A certificate carrying a larger modulus drives an out-of-bounds write past a file-scope static during ordinary certificate-chain verification. It is reachable pre-authentication. The issuer used for the crypto operation is looked up in the remote, peer-supplied store before the trusted store, so the a…
CVE-2026-93475Read original ↗ (opens in a new tab) - NVD
CVE-2026-93003 — The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the head…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request body is therefore reported to the server as though it were a header, which lets a client control request framing decisions it should not be able to reach.
CVE-2026-93003Read original ↗ (opens in a new tab) - NVD
CVE-2026-92853 — The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first est…
High · CVSS 4.0 8.7 · Assessor: [email protected]
The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero-length Certificate message therefore wraps the unsigned length to `0xFFFFFFFF`, which makes the bounds check that follows vacuous and sends the parser reading past the session packet buffer. The trigger is a four-byte handshake header and requires no cryptographic validity. It is reachable pre-authentication.
CVE-2026-92853Read original ↗ (opens in a new tab) - NVD
CVE-2026-92843 — A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an u…
High · CVSS 4.0 8.7 · Assessor: [email protected]
A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reachable pre-authentication, during the normal handshake, before certificate verification completes.
CVE-2026-92843Read original ↗ (opens in a new tab) - NVD
CVE-2026-91057 — `_gx_multi_line_text_view_display_info_get()` reads one byte past the end of the application's text buffer when the string i…
Medium · CVSS 4.0 4.6 · Assessor: [email protected]
`_gx_multi_line_text_view_display_info_get()` reads one byte past the end of the application's text buffer when the string it is given ends with a carriage return (`\r`). The over-read can also cause callers to advance their index past the end of the string, producing a second over-read in `_gx_multi_line_text_view_string_total_rows_compute()` and a row of text that is not in the source.
CVE-2026-91057Read original ↗ (opens in a new tab) - NVD
CVE-2026-90800 — Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the ful…
High · CVSS 4.0 8.1 · Assessor: [email protected]
Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _replicator database via an unauthorised API endpoint. The use of prefixed system databases is very rare. Users are recommended to upgrade to version 3.5.3, which fixes this issue.
CVE-2026-90800Read original ↗ (opens in a new tab) - NVD
CVE-2026-90799 — Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to c…
Low · CVSS 4.0 1.3 · Assessor: [email protected]
Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue.
CVE-2026-90799Read original ↗ (opens in a new tab) - NVD
CVE-2026-90798 — A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replica…
Low · CVSS 4.0 0.6 · Assessor: [email protected]
A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop. Users are recommended to upgrade to version 3.5.3, which fixes this issue.
CVE-2026-90798Read original ↗ (opens in a new tab) - NVD
CVE-2026-90797 — An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote clien…
High · CVSS 4.0 7.7 · Assessor: [email protected]
An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue.
CVE-2026-90797Read original ↗ (opens in a new tab) - NVD
CVE-2026-86471 — An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user. Users are recommended to upgrade to version 3.5.3, which fixes this issue.
CVE-2026-86471Read original ↗ (opens in a new tab) - NVD
CVE-2026-113703 — SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where enforc…
Critical · CVSS 4.0 9.1 · Assessor: [email protected]
SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where enforce_authentication() in api_service/auth/middleware.py trusts the client-controlled request.remote_addr value, which is derived from the spoofable X-Forwarded-For header due to ProxyFix(x_for=1) configuration in api_service/app.py. Attackers can send a request with X-Forwarded-For set to a trusted CIDR address such as 127.0.0.1 to be granted an unauthenticated admin session via _load_bypass_use…
CVE-2026-113703Read original ↗ (opens in a new tab) - NVD
CVE-2026-113683 — VPL (Virtual Programming Lab) for Moodle before 5.0.0 contains a reflected cross-site scripting vulnerability that allows re…
Medium · CVSS 4.0 5.1 · Assessor: [email protected]
VPL (Virtual Programming Lab) for Moodle before 5.0.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject script via unencoded filename1/filename2 parameters in similarity/diff.php. Attackers can craft a diff.php link with a JavaScript payload that runs when a user holding mod/vpl:similarity opens it, performing actions or disclosing data under their session.
CVE-2026-113683Read original ↗ (opens in a new tab) - NVD
CVE-2026-113682 — Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicAuthHandler that allows u…
Critical · CVSS 4.0 9.1 · Assessor: [email protected]
Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicAuthHandler that allows unauthenticated attackers to log in as LDAP/AD-delegated users. Attackers can send a Basic Authorization header with a known username and empty password, triggering an unauthenticated LDAP bind that is accepted as successful authentication.
CVE-2026-113682Read original ↗ (opens in a new tab) - NVD
CVE-2026-113681 — OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::C…
Medium · CVSS 4.0 6.8 · Assessor: [email protected]
OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read. Attackers can supply a crafted Cineon file with a huge declared width that wraps the size calculation to zero, so UnPackPacked reads past a 4-byte buffer and crashes the application.
CVE-2026-113681Read original ↗ (opens in a new tab) - NVD
CVE-2026-113680 — HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper…
Medium · CVSS 4.0 6.8 · Assessor: [email protected]
HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffer_set_contents, face_create, and font_set_coords. Attackers can supply a crafted font whose embedded wasm module passes out-of-range addresses with non-zero lengths, crashing any application that shapes text with the font.
CVE-2026-113680Read original ↗ (opens in a new tab) - NVD
CVE-2026-113679 — HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because t…
High · CVSS 4.0 7.3 · Assessor: [email protected]
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt applications.
CVE-2026-113679Read original ↗ (opens in a new tab) - NVD
CVE-2026-113678 — Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authentica…
Critical · CVSS 4.0 9.4 · Assessor: [email protected]
Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of arbitrary host directories by abusing the root-run traffic cron. Attackers can replace the goaccess statistics directory in their document root with a symlink, causing chown -R to hand root-owned trees to them and enabling root escalation.
CVE-2026-113678Read original ↗ (opens in a new tab) - NVD
CVE-2026-113677 — Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability in the SubDomains.delete API command that a…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability in the SubDomains.delete API command that allows authenticated customers to delete reseller-provisioned main domains by supplying a main domain id. Attackers can bypass the web UI restriction to remove domains, orphan vhost, DNS and subdomain records, and drive subdomains_used below zero to gain extra subdomain allowance.
CVE-2026-113677Read original ↗ (opens in a new tab) - NVD
CVE-2026-113676 — Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows r…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists, resource limits, notes, and login history.
CVE-2026-113676Read original ↗ (opens in a new tab) - NVD
CVE-2026-113613 — FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write…
Critical · CVSS 4.0 9.2 · Assessor: [email protected]
FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write arbitrary files by supplying malicious archive member paths. Attackers can deliver zip or rar archives with ../ sequences or absolute paths through a feed, writing Python files into the plugins directory for code execution.
CVE-2026-113613Read original ↗ (opens in a new tab) - NVD
CVE-2026-113612 — SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other u…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from public food read endpoints to delete serving and nutrition variants of publicly shared foods, destroying victims' data.
CVE-2026-113612Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.