PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

Every cached source, newest first. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

15,928 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates · Some delayed

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  9. NVD

    CVE-2026-11960 — Enumeration of unauthenticated users in FacturaScripts, version 2025.61. The application returns different responses when at…

    Medium · CVSS 4.0 6.9 · Assessor: [email protected]

    Enumeration of unauthenticated users in FacturaScripts, version 2025.61. The application returns different responses when attempting to log in with a valid username compared to an invalid one. An unauthenticated attacker could systematically identify valid usernames by examining variations in the application’s responses, such as changes in response time, discrepancies between error messages or differences in HTTP status codes. A successful exploit allows the attacker to compile a list of valid user accounts. This…

    CVE-2026-11960
    Read original (opens in a new tab)
  10. NVD

    CVE-2026-11959 — Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisatio…

    Medium · CVSS 4.0 6.9 · Assessor: [email protected]

    Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisation of user input in the ‘city’ and ‘province’ fields in the ‘ListAlmacen’ endpoint. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim’s browser (the application user) or to escalate privileges from a normal user to an administrator by executing specially crafted JavaScript code, thereby compromising the system’s confidentia…

    CVE-2026-11959
    Read original (opens in a new tab)
  11. NVD

    CVE-2026-113469 — A failure has been identified in the SNS during dynamic data files signature check. A logic error in the signature verificat…

    High · CVSS 3.1 7.5 · Assessor: [email protected]

    A failure has been identified in the SNS during dynamic data files signature check. A logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine.

    CVE-2026-113469
    Read original (opens in a new tab)
  12. NVD

    CVE-2026-113465 — It is possible to execute a DOM-based Cross-Site Scripting attack against Stormshield’s web administration panel. To exploit…

    Medium · CVSS 3.1 6.6 · Assessor: [email protected]

    It is possible to execute a DOM-based Cross-Site Scripting attack against Stormshield’s web administration panel. To exploit this vulnerability, an attacker would need to craft a URL containing a malicious script payload within a specific parameter and lure an authenticated administrator into visiting that link.

    CVE-2026-113465
    Read original (opens in a new tab)
  19. NVD

    CVE-2026-112177 — A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted du…

    High · CVSS 3.1 7.3 · Assessor: [email protected]

    A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted PostScript file may allow an attacker to bypass -dSAFER restrictions and access files outside the permitted paths or execute commands with the permissions of the Ghostscript process.

    CVE-2026-112177
    Read original (opens in a new tab)
  20. NVD

    CVE-2026-111090 — A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license fil…

    High · CVSS 3.1 7.8 · Assessor: [email protected]

    A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license files.It is necessary to use only the MyStormshield servers to retrieve update files or licenses, or to use automatic verification via SNS.

    CVE-2026-111090
    Read original (opens in a new tab)
  21. NVD

    CVE-2024-2323 — The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validati…

    Medium · CVSS 3.1 4.8 · Assessor: ed10eef1-636d-4fbe-9993-6890dfa878f8

    The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This oversight allows an attacker to repeatedly attempt password guesses for a user account without being adequately restricted. Exploiting this vulnerability enables an attacker to discover a user's password through brute force, leading to account impersonation. The success rate of such an attack is influenced by the complexity of the targeted user's password, with sim…

    CVE-2024-2323
    Read original (opens in a new tab)
  22. NVD

    CVE-2026-93878 — The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via update_license AJAX Action in al…

    Medium · CVSS 3.1 6.4 · Assessor: [email protected]

    The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via update_license AJAX Action in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload executes when an administrator visits the DiviGear > Activation settings page, wh…

    CVE-2026-93878
    Read original (opens in a new tab)
  23. NVD

    CVE-2026-113404 — WebITR developed by Uniong has a Insecure Deserialization vulnerability. Authenticated remote attackers can use the hard-cod…

    High · CVSS 4.0 8.7 · Assessor: [email protected]

    WebITR developed by Uniong has a Insecure Deserialization vulnerability. Authenticated remote attackers can use the hard-coded cryptographic key to craft and submit malicious serialized data, thereby executing arbitrary code on the server.

    CVE-2026-113404
    Read original (opens in a new tab)
  24. NVD

    CVE-2026-113403 — ArmorX Spam developed by ArmorX Global Technology has a Command Injection vulnerability. Authenticated remote attackers can…

    High · CVSS 4.0 7.1 · Assessor: [email protected]

    ArmorX Spam developed by ArmorX Global Technology has a Command Injection vulnerability. Authenticated remote attackers can inject crafted commands into a specific parameter, thereby uploading malicious code to the server.

    CVE-2026-113403
    Read original (opens in a new tab)
  25. NVD

    CVE-2026-113402 — ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability. Authenticated remote attackers c…

    High · CVSS 4.0 7.1 · Assessor: [email protected]

    ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability. Authenticated remote attackers can exploit path traversal to cause the application to include PHP files outside the intended directory.

    CVE-2026-113402
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.