PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

Every cached source, newest first. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

15,917 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates · Some delayed

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  1. NVD

    CVE-2026-112148 — A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting (XSS)…

    Medium · CVSS 4.0 5.1 · Assessor: [email protected]

    A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting (XSS) flaw allows an attacker to execute arbitrary JavaScript in the origin of an affected LIFF application's endpoint when a user opens a specially crafted URL in an external browser, potentially leading to disclosure of JavaScript-accessible authentication tokens or application data, or unauthorized actions using the user's session.

    CVE-2026-112148
    Read original (opens in a new tab)
  2. NVD

    CVE-2026-110725 — fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3…

    Low · CVSS 3.1 3.7 · Assessor: ce714d77-add3-4f53-aff5-83d477b104bb

    fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize(), normalize(), or resolve() are called with the non-default option reference set to suffix on a reference that has no authority, the emitted relative reference can contain a bare colon in its first path segment without escaping it, even though RFC 3986 forbids that because it makes the string reparse as an absolute URI with a scheme. An appl…

    CVE-2026-110725
    Read original (opens in a new tab)
  3. NVD

    CVE-2026-110306 — fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3…

    Medium · CVSS 3.1 6.1 · Assessor: ce714d77-add3-4f53-aff5-83d477b104bb

    fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape() function before validating it, so an input whose decoded scheme is a dangerous token is emitted as a live scheme even though RFC 3986 does not allow percent-encoding in a scheme and no other parser accepts it. An application that screens dangerous schemes on the raw input and th…

    CVE-2026-110306
    Read original (opens in a new tab)
  4. NVD

    CVE-2026-110180 — fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1…

    Medium · CVSS 3.1 4.8 · Assessor: ce714d77-add3-4f53-aff5-83d477b104bb

    fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 through 4.2.2, for HTTP-family schemes the canonicalizeHost() function passes the parsed host to the WHATWG URL parser and adopts its hostname without checking that the parser consumed the entire input as a host, so the authority can be silently rewritten: data before an at-sign is dropped and tab, carriage-return, and line-feed characters are stripped, with n…

    CVE-2026-110180
    Read original (opens in a new tab)
  5. NVD

    CVE-2026-110095 — fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3…

    Low · CVSS 3.1 3.7 · Assessor: ce714d77-add3-4f53-aff5-83d477b104bb

    fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize() and serialize() functions apply RFC 3986 dot-segment removal to the path of a relative-path reference, even though that algorithm is defined only for the merged target path during resolution, so a leading parent-directory segment can be dropped and a document-relative reference can become root-relative. An application that normalizes an atta…

    CVE-2026-110095
    Read original (opens in a new tab)
  7. NVD

    CVE-2026-96903 — The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-ma…

    Medium · CVSS 3.1 4.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead records, including their private activity notes.

    CVE-2026-96903
    Read original (opens in a new tab)
  8. NVD

    CVE-2026-96902 — The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST…

    Medium · CVSS 3.1 5.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact map coordinates.

    CVE-2026-96902
    Read original (opens in a new tab)
  9. NVD

    CVE-2026-93300 — The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versio…

    High · CVSS 3.1 7.5 · Assessor: [email protected]

    The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

    CVE-2026-93300
    Read original (opens in a new tab)
  10. NVD

    CVE-2026-100737 — Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user wh…

    Medium · CVSS 4.0 6.9 · Assessor: [email protected]

    Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may upgrade the affected product to unauthorized firmware.

    CVE-2026-100737
    Read original (opens in a new tab)
  11. NVD

    CVE-2026-113386 — Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attack…

    High · CVSS 3.1 7.1 · Assessor: [email protected]

    Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the _uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands.

    CVE-2026-113386
    Read original (opens in a new tab)
  14. NVD

    CVE-2026-86467 — Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the brow…

    CVSS unscored / not supplied

    Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it. The login handler discards the AuthnRequest ID and the callback validates the assertion without requiring a matching InResponseTo, so an unauthenticated attacker who can cause a victim to load a page can complete a SAML login in the victim's browser using the attacker's own assertion, silently logging the victim into the attacker's Airflow account. Subsequent work the victi…

    CVE-2026-86467
    Read original (opens in a new tab)
  15. NVD

    CVE-2026-12489 — An incorrect authorization vulnerability in the Data Access Layer (DAL) of Zyxel EX3501-T0 firmware versions through 5.44(AC…

    Medium · CVSS 3.1 6.5 · Assessor: [email protected]

    An incorrect authorization vulnerability in the Data Access Layer (DAL) of Zyxel EX3501-T0 firmware versions through 5.44(ACHR.6)C0 could allow an authenticated attacker to escalate privileges by modifying the login_privilege data on an affected device.

    CVE-2026-12489
    Read original (opens in a new tab)
  16. NVD

    CVE-2026-75753 — Missing Authentication for a Critical Function in certain ASUS routers allows an unauthorized nearby user to send specific c…

    Medium · CVSS 4.0 5.3 · Assessor: 54bf65a7-a193-42d2-b1ba-8e150d3c35e1

    Missing Authentication for a Critical Function in certain ASUS routers allows an unauthorized nearby user to send specific commands via HTTP requests, causing the router to return device identification information and switch into a specific mode. As a result, when the router encounters abnormal conditions, it may be unable to perform self-recovery. Refer to the ' Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.

    CVE-2026-75753
    Read original (opens in a new tab)
  17. NVD

    CVE-2026-17518 — Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrupt de…

    High · CVSS 4.0 8.2 · Assessor: 54bf65a7-a193-42d2-b1ba-8e150d3c35e1

    Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrupt device operations and cause a denial of service via an HTTP request with input exceeding the expected length. Refer to the ' Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.

    CVE-2026-17518
    Read original (opens in a new tab)
  18. NVD

    CVE-2026-105299 — Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstream_reque…

    High · CVSS 3.1 8.7 · Assessor: [email protected]

    Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstream_request_filter and wrote it to the upstream without removing the client's Connection header, other hop-by-hop headers, or the headers Connection nominated, although RFC 9110 Section 7.6.1 requires intermediaries to remove them. The HTTP/2 upstream path already removed Connection and related HTTP/1-specific headers. A client could therefore nominate a header that the application adds in upstream_re…

    CVE-2026-105299
    Read original (opens in a new tab)
  19. NVD

    CVE-2026-102438 — An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SY…

    High · CVSS 4.0 8.5 · Assessor: 54bf65a7-a193-42d2-b1ba-8e150d3c35e1

    An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges via replacement of a dynamic-link library (DLL) that is later loaded by a high-privilege process. Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.

    CVE-2026-102438
    Read original (opens in a new tab)
  24. NVD

    CVE-2026-86975 — An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden…

    Medium · CVSS 3.1 4.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted image may lead to unexpected process termination.

    CVE-2026-86975
    Read original (opens in a new tab)
  25. NVD

    CVE-2026-86963 — A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS…

    Medium · CVSS 3.1 5.9 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27. An attacker in a privileged network position may be able to cause a denial-of-service.

    CVE-2026-86963
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.