PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

Every cached source, newest first. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

15,967 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates · Some delayed

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  2. NVD

    CVE-2026-113468 — The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider…

    Medium · CVSS 4.0 6.9 · Assessor: f4fb688c-4412-4426-b4b8-421ecf27b14a

    The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider. Any site visitor can overwrite the stored payment notification of an order that is still awaiting payment with arbitrary content. This requires a page that contains the shop's order plugin. Orders that are already paid are not affected.

    CVE-2026-113468
    Read original (opens in a new tab)
  3. NVD

    CVE-2026-113459 — In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor…

    High · CVSS 4.0 7.1 · Assessor: f4fb688c-4412-4426-b4b8-421ecf27b14a

    In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expense of the site operator. This only applies if an API key has been configured.

    CVE-2026-113459
    Read original (opens in a new tab)
  5. NVD

    CVE-2026-113381 — A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the function Item::findUserItems of…

    Medium · CVSS 4.0 5.5 · Assessor: [email protected]

    A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the function Item::findUserItems of the file oc-includes/osclass/model/Item.php of the component Item Model Handler. This manipulation of the argument sPattern causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

    CVE-2026-113381
    Read original (opens in a new tab)
  6. NVD

    CVE-2026-113378 — A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4.0. Affected is an unknown function of the file src/ind…

    Low · CVSS 4.0 1.9 · Assessor: [email protected]

    A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4.0. Affected is an unknown function of the file src/index.ts of the component Advanced Search Tool. The manipulation of the argument fileType results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The real existence of this vulnerability is still doubted at the moment. The code's own escapeShellArg on sibling arguments (skipped only for fileType) indicates th…

    CVE-2026-113378
    Read original (opens in a new tab)
  7. NVD

    CVE-2026-112240 — The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request…

    Medium · CVSS 4.0 6.3 · Assessor: f4fb688c-4412-4426-b4b8-421ecf27b14a

    The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not verified in a way that resisted guessing. An unauthenticated attacker could use this to access files uploaded by other visitors. In addition, the token was shown in plain text in the text version of the notification email.

    CVE-2026-112240
    Read original (opens in a new tab)
  8. NVD

    CVE-2026-112239 — The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. I…

    High · CVSS 4.0 7.2 · Assessor: f4fb688c-4412-4426-b4b8-421ecf27b14a

    The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its access permissions and configuration, outside the scope granted to them.

    CVE-2026-112239
    Read original (opens in a new tab)
  9. NVD

    CVE-2026-112238 — The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildc…

    High · CVSS 4.0 8.7 · Assessor: f4fb688c-4412-4426-b4b8-421ecf27b14a

    The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore leave the intended string value and change the database query. This allows an attacker to read data from the database. The issue affects every searched field.

    CVE-2026-112238
    Read original (opens in a new tab)
  10. NVD

    CVE-2026-112237 — The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one HTTP request method, the…

    Medium · CVSS 4.0 6.9 · Assessor: f4fb688c-4412-4426-b4b8-421ecf27b14a

    The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one HTTP request method, the endpoint does not apply the authorization check that protects the other methods, so the URL it fetches is fully controlled by the requester. An unauthenticated attacker can make the server send requests to arbitrary internal or external hosts. The attacker receives the status code and selected response headers, which allows probing of internal hosts and ports. Response bodies are not disclos…

    CVE-2026-112237
    Read original (opens in a new tab)
  11. NVD

    CVE-2026-112071 — The order cancellation function accepts an order identifier from the request and acts on that order without checking that th…

    Medium · CVSS 4.0 6.9 · Assessor: f4fb688c-4412-4426-b4b8-421ecf27b14a

    The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to "canceled". This requires a page that contains the shop's order plugin. Orders that are already paid are not affected.

    CVE-2026-112071
    Read original (opens in a new tab)
  12. NVD

    CVE-2026-112070 — The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. A…

    Medium · CVSS 4.0 5.3 · Assessor: f4fb688c-4412-4426-b4b8-421ecf27b14a

    The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to.

    CVE-2026-112070
    Read original (opens in a new tab)
  13. NVD

    CVE-2026-112069 — The extension no longer applied its access protection to files in file storages that use a non-default relative base path. T…

    Medium · CVSS 4.0 6.3 · Assessor: f4fb688c-4412-4426-b4b8-421ecf27b14a

    The extension no longer applied its access protection to files in file storages that use a non-default relative base path. These files were served directly by the web server, without any authentication or permission check. The issue is only exploitable when the extension is used on a website running TYPO3 14.3.

    CVE-2026-112069
    Read original (opens in a new tab)
  15. NVD

    CVE-2026-112067 — The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself. Anyone who can request a…

    Medium · CVSS 4.0 6.9 · Assessor: f4fb688c-4412-4426-b4b8-421ecf27b14a

    The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself. Anyone who can request a CAPTCHA image can read the answer from it and submit it, so automated clients can pass the challenge. This applies to the default configuration, because the audio feature that causes the answer to be embedded is enabled by default. Forms that rely on the CAPTCHA as their only protection against automated submissions are exposed to abuse by bots.

    CVE-2026-112067
    Read original (opens in a new tab)
  16. NVD

    CVE-2026-112066 — The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users…

    High · CVSS 4.0 7.1 · Assessor: f4fb688c-4412-4426-b4b8-421ecf27b14a

    The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website.

    CVE-2026-112066
    Read original (opens in a new tab)
  17. NVD

    CVE-2026-112065 — The routes that provide consent history and statistics data did not check whether the backend user had access to the module…

    Medium · CVSS 4.0 5.3 · Assessor: f4fb688c-4412-4426-b4b8-421ecf27b14a

    The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the requested page. Any authenticated backend user, regardless of permissions, could therefore retrieve consent data of any site in the installation.

    CVE-2026-112065
    Read original (opens in a new tab)
  18. NVD

    CVE-2026-112064 — The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used…

    High · CVSS 4.0 7.1 · Assessor: f4fb688c-4412-4426-b4b8-421ecf27b14a

    The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the filter conditions of that query were bound as parameters. A backend user with access to the history or statistics functions could use this to read arbitrary data from the database, including password hashes of backend and frontend users.

    CVE-2026-112064
    Read original (opens in a new tab)
  20. NVD

    CVE-2026-92287 — Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects…

    CVSS unscored / not supplied

    Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects users who read Parquet files and configure Parquet decryption properties with a KmsClient implementation. On the reader side, the KMS URL can be application-controlled (specified in the KmsConnectionConfig) or file-controlled. If the user does not leverage application control for this parameter, a file-controlled KMS URL is forwarded to a pluggable KmsClient implementation. If the KMS implem…

    CVE-2026-92287
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.