THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
Every cached source, newest first. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,176 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates · Some delayed
- NVDUpdates delayed · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUpdates delayed · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-113611 — Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted administrators to keep receivi…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted administrators to keep receiving document contents because UserDeletedProcessor never disables their WebhookSubscription rows. Former admins who registered webhooks before deletion continue receiving full document bodies, including Markdown and Yjs data, via DeliverWebhookTask for every matching workspace event.
CVE-2026-113611Read original ↗ (opens in a new tab) - NVD
CVE-2026-113610 — Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows l…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary target user id. Attackers can delete the preferences.otp TOTP secret to disable two-factor authentication, corrupt it to block logins, or overwrite stored xsCredentials and sshKeys.
CVE-2026-113610Read original ↗ (opens in a new tab) - NVD
CVE-2026-113609 — Bandisoft Bandizip before 7.47 fails to propagate Mark-of-the-Web to extracted .ps1 and .psm1 files, allowing attackers to b…
Medium · CVSS 4.0 4.8 · Assessor: [email protected]
Bandisoft Bandizip before 7.47 fails to propagate Mark-of-the-Web to extracted .ps1 and .psm1 files, allowing attackers to bypass zone-based execution protections. Attackers can deliver unsigned PowerShell scripts or modules in downloaded archives that run under the RemoteSigned policy when the user invokes them.
CVE-2026-113609Read original ↗ (opens in a new tab) - NVD
CVE-2026-113608 — Configurable Reports block for Moodle (moodle-block_configurablereports) before 5.3.1 contains an sql injection vulnerabilit…
Medium · CVSS 4.0 6.0 · Assessor: [email protected]
Configurable Reports block for Moodle (moodle-block_configurablereports) before 5.3.1 contains an sql injection vulnerability in report_sql::prepare_sql() via the filter_var request parameter of viewreport.php. Low-privileged users permitted to view reports using the %%FILTER_VAR%% placeholder can inject subqueries or UNION SELECT to read arbitrary database tables, including user password hashes.
CVE-2026-113608Read original ↗ (opens in a new tab) - NVD
CVE-2026-113607 — Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated…
High · CVSS 4.0 7.1 · Assessor: [email protected]
Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read restricted reports through the block_configurable_reports_get_report_data web service. When check_permissions fails, the function only adds a warning and still returns the full report table, letting any logged-in user supply arbitrary report ids to read SQL reports over user and grade data.
CVE-2026-113607Read original ↗ (opens in a new tab) - NVD
CVE-2026-113606 — Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to access ot…
High · CVSS 4.0 7.1 · Assessor: [email protected]
Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to access other users' stored files by pointing a processing folder at the server storage directory. Attackers can create a folder via POST /api/v1/processing-folders targeting storage/, list files, and run pipelines to read, modify, or destroy victims' files.
CVE-2026-113606Read original ↗ (opens in a new tab) - NVD
CVE-2026-113605 — Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that allows a…
High · CVSS 4.0 8.6 · Assessor: [email protected]
Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that allows administrators to bypass H2 import restrictions using CREATE OR REPLACE ALIAS. Authenticated administrators can upload a crafted SQL backup to the import-database endpoint, where RUNSCRIPT defines H2 Java function aliases and restores Java-method execution.
CVE-2026-113605Read original ↗ (opens in a new tab) - NVD
CVE-2026-113604 — Ghidra 10.2 through 12.1.4 contains a denial of service vulnerability in the ELF loader's ElfHeader class that allocates arr…
Medium · CVSS 4.0 6.8 · Assessor: [email protected]
Ghidra 10.2 through 12.1.4 contains a denial of service vulnerability in the ELF loader's ElfHeader class that allocates arrays sized by unvalidated extended section and program header counts. Attackers can supply a crafted 128-byte ELF file that triggers an OutOfMemoryError during load-spec discovery at import or in headless analysis pipelines.
CVE-2026-113604Read original ↗ (opens in a new tab) - NVD
CVE-2026-113603 — The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28.0, x402 PyPI 2.11.0 through 2.25.0, and Go module 2.16…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28.0, x402 PyPI 2.11.0 through 2.25.0, and Go module 2.16.0 through 2.28.0 contains an authorization bypass vulnerability that allows paying clients to unlock unpaid routes by supplying a mismatched PaymentPayload.resource URL. Attackers can pay for the cheapest SIWX-protected route while setting resource.url to an expensive route, then repeatedly access it using only a SIGN-IN-WITH-X header without further payment.
CVE-2026-113603Read original ↗ (opens in a new tab) - NVD
CVE-2026-113602 — json-smart through 2.6.0 contains an input validation bypass vulnerability that allows attackers to evade strict-mode traili…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
json-smart through 2.6.0 contains an input validation bypass vulnerability that allows attackers to evade strict-mode trailing-data checks by inserting a literal 0x1A character. Attackers can append 0x1A and malformed content to pass JSONValue.parseStrict or isValidJsonStrict validation, creating parser differentials with downstream parsers like Jackson or Gson.
CVE-2026-113602Read original ↗ (opens in a new tab) - NVD
CVE-2026-113601 — Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivities and GetActivity API…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivities and GetActivity API methods that allows authenticated users to view all users' activity records. Low-privileged attackers can enumerate sequential activity IDs to obtain creator IDs, timestamps, and memo-comment references, including activity on other users' private memos.
CVE-2026-113601Read original ↗ (opens in a new tab) - NVD
CVE-2026-113600 — Fat Free CRM before 0.26.0 contains an insecure direct object reference vulnerability that allows authenticated users to mod…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Fat Free CRM before 0.26.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify or delete other users' comments because CommentsController#update and #destroy use an unscoped Comment.find without authorization checks. Attackers can send PUT or DELETE requests to /comments/:id with enumerable sequential IDs to edit or delete comments on contacts, accounts, leads, and opportunities owned by others.
CVE-2026-113600Read original ↗ (opens in a new tab) - NVD
CVE-2026-113599 — Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create au…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create auto-reply messages for arbitrary mailboxes by supplying another user's mbox value. Attackers can POST to /api/v2/armessages/ to inject attacker-controlled auto-reply subject and content into victims' settings or break their auto-reply management via MultipleObjectsReturned errors.
CVE-2026-113599Read original ↗ (opens in a new tab) - NVD
CVE-2026-113598 — Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete al…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete alarms of other domains via the POST /api/v2/alarms/bulk_delete/ action. Attackers can enumerate sequential alarm IDs to delete DNS, MX and blocklist monitoring alarms server-wide, hiding problems from responsible administrators.
CVE-2026-113598Read original ↗ (opens in a new tab) - NVD
CVE-2026-113597 — Blinko through 1.8.8 contains an insecure direct object reference vulnerability in the tag tRPC router that allows authentic…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Blinko through 1.8.8 contains an insecure direct object reference vulnerability in the tag tRPC router that allows authenticated users to read and modify other users' tags by supplying arbitrary tag IDs. Attackers can enumerate sequential IDs via fullTagNameById, updateTagIcon, and updateTagOrder to reveal private note topics and tamper with tag icons and ordering.
CVE-2026-113597Read original ↗ (opens in a new tab) - NVD
CVE-2026-113596 — Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users'…
Low · CVSS 4.0 2.3 · Assessor: [email protected]
Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users' project data via the publishedBuilds and findManyByIds tRPC procedures. Attackers who know another user's project UUID can query the /trpc handler to retrieve publish history, titles, domains, preview images, and latest builds.
CVE-2026-113596Read original ↗ (opens in a new tab) - NVD
CVE-2026-113595 — Sharkord before 0.0.26 contains a missing authorization vulnerability in the others.changeLogo tRPC mutation that allows any…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Sharkord before 0.0.26 contains a missing authorization vulnerability in the others.changeLogo tRPC mutation that allows any authenticated member to modify the server logo without the MANAGE_SETTINGS permission. Attackers can remove the current logo and replace it with an uploaded image that is published to every connected client.
CVE-2026-113595Read original ↗ (opens in a new tab) - NVD
CVE-2026-113594 — Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-w…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-wide settings by calling the others.updateSettings tRPC mutation without the MANAGE_SETTINGS permission. Attackers can set a join password, disable registration, zero upload limits, or toggle plugin loading to deny service to other members.
CVE-2026-113594Read original ↗ (opens in a new tab) - NVD
CVE-2026-113359 — Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other workspaces via the unique_row_values API endpoint. Attackers can enumerate sequential field IDs to retrieve up to 100 distinct cell values per field from tables in workspaces they do not belong to.
CVE-2026-113359Read original ↗ (opens in a new tab) - NVD
CVE-2026-112956 — ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, duplicate-imp…
Medium · CVSS 3.1 6.5 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, duplicate-import continuation accepts client-controlled replacement choices without binding them to a user-owned server-side analysis or authorizing the canonical target. On an import-enabled localized type, a contributor with draft editing authority can cross the publication boundary by selecting a published document for replacement, although the current assessment is based on remediation review rather t…
CVE-2026-112956Read original ↗ (opens in a new tab) - NVD
CVE-2026-112955 — ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authentica…
Medium · CVSS 3.1 6.5 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authenticated importer can submit archives whose decompressed bytes, entry count, and entry sizes are not bounded before document-type authorization, and extraction or parsing failures can leave staging and extracted artifacts without unconditional cleanup. The already-hardened pre-authentication and write-error paths are separate, and current end-to-end denial-of-service impact from this residual path…
CVE-2026-112955Read original ↗ (opens in a new tab) - NVD
CVE-2026-112954 — ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicA…
Medium · CVSS 3.1 5.3 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicApiProjection can expose excluded searchable or sortable field information through search membership and sort ordering oracles. Returned fields remain filtered by the projection, so the issue permits targeted inference about hidden values rather than an unrestricted field dump. This issue is fixed in version 4.34.0.
CVE-2026-112954Read original ↗ (opens in a new tab) - NVD
CVE-2026-112953 — ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, predictable e…
Medium · CVSS 4.0 6.0 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, predictable export archive filenames allow an unauthenticated requester to download another user's export from publicly readable export storage before the archive expires or is removed. A user with export permission must first create the archive, and sites with exports disabled, private upload storage, or authenticated upload delivery are not exposed through this network-download path. This issue is fixed…
CVE-2026-112953Read original ↗ (opens in a new tab) - NVD
CVE-2026-112952 — ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, 'POST /api/v1/@apostrophecms/doc/slugTak…
Medium · CVSS 3.1 4.3 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, 'POST /api/v1/@apostrophecms/doc/slugTaken' with body { "slug": "target-slug" } returns a boolean indicating whether a slug is in use across all document types and visibility levels, with no permission or type filter. Any logged-in user (including editors) can enumerate the slug space of private pages, drafts, and archived content. This issue is fixed in version 4.34.0.
CVE-2026-112952Read original ↗ (opens in a new tab) - NVD
CVE-2026-112951 — ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the color field accepts trailing content…
Medium · CVSS 3.1 5.4 · Assessor: [email protected]
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the color field accepts trailing content after a valid rgb() or hsl() prefix because its TinyColor validation does not require the entire value to match a color. An authenticated user with edit rights can store arbitrary HTML after a valid color prefix. When the stored value is rendered, the payload executes, resulting in stored XSS. This issue is fixed in version 4.34.0.
CVE-2026-112951Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.