Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-25 07:02Z
2024-04-03
2024-04-03 17:15Z
HIGH

CVE-2024-26736 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: afs: Increase buffer size

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-26736

In the Linux kernel, the following vulnerability has been resolved: afs: Increase buffer size in afs_update_volume_status() The max length of volume->vid value is 20 characters. So increase idbuf[] size up to 24 to avoid overflow. Found by Linux Verification Center (linuxtesting.org) with SVACE. [DH: Actually, it's 20 + NUL, so increase it to 24 and use snprintf()] CVSSv3.1 8.1 (HIGH) · EPSS 18th percentile

CWECWE 787TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2024-04-03
2024-04-03 15:15Z
HIGH

CVE-2024-26692 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: smb: Fix regression in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-26692

In the Linux kernel, the following vulnerability has been resolved: smb: Fix regression in writes when non-standard maximum write size negotiated The conversion to netfs in the 6.3 kernel caused a regression when maximum write size is set by the server to an unexpected value which is not a multiple of 4096 (similarly if the user overrides the maximum write size by setting mount parm "wsize", but sets it to a value that is not a multiple of 4096). When negotiated write size CVSSv3.1 8.3 (HIGH) · EPSS 15th percentile

CWECWE 787TYPVulnerability
8.3
CVSS v3.1
92
Edit Score
2024-04-03
2024-04-03 15:15Z
HIGH

CVE-2024-26689 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: ceph: prevent use-after-free in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-26689

In the Linux kernel, the following vulnerability has been resolved: ceph: prevent use-after-free in encode_cap_msg() In fs/ceph/caps.c, in encode_cap_msg(), "use after free" error was caught by KASAN at this line - 'ceph_buffer_get(arg->xattr_buf);'. This implies before the refcount could be increment here, it was freed. In same file, in "handle_cap_grant()" refcount is decremented by this line - 'ceph_buffer_put(ci->i_xattrs.blob);'. It appears that a race occurred and re CVSSv3.1 8.8 (HIGH) · EPSS 16th percentile

CWECWE 416TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-04-03
2024-04-03 12:15Z
HIGH

CVE-2024-29477 — Dolibarr Dolibarr_erp\/crm: Lack of sanitization during Installation Process in Dolibarr ERP CRM up to version 19.0.0

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-29477

Lack of sanitization during Installation Process in Dolibarr ERP CRM up to version 19.0.0 allows an attacker with adjacent access to the network to execute arbitrary code via a specifically crafted input. CVSSv3.1 8.8 (HIGH) · EPSS 52th percentile

CWECWE 94VNDDolibarrVNDLackTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-04-03
2024-04-03 12:15Z
CRIT

CVE-2024-27972 — Control: Improper Control of Generation of Code ('Code Injection') vulnerability in Jack Arturo WP Fusion

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-27972

Improper Control of Generation of Code ('Code Injection') vulnerability in Jack Arturo WP Fusion Lite wp-fusion-lite.This issue affects WP Fusion Lite: from n/a through <= 3.41.24. CVSSv3.1 9.9 (CRITICAL) · EPSS 95th percentile

CWECWE 94TYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2024-04-03
2024-04-03 12:15Z
HIGH

CVE-2024-27191 — Control: Improper Control of Generation of Code ('Code Injection') vulnerability in inpersttion Slivery Extender slivery-extender

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-27191

Improper Control of Generation of Code ('Code Injection') vulnerability in inpersttion Slivery Extender slivery-extender allows Remote Code Inclusion.This issue affects Slivery Extender: from n/a through <= 1.0.2. CVSSv3.1 8.5 (HIGH) · EPSS 47th percentile

CWECWE 94TYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2024-04-03
2024-04-03 12:15Z
CRIT

CVE-2024-25918 — Instawp Instawp_connect: Improper Control of Generation of Code ('Code Injection') vulnerability in InstaWP InstaWP Connect instawp-connect.This

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-25918

Improper Control of Generation of Code ('Code Injection') vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through <= 0.1.0.8. CVSSv3.1 9.9 (CRITICAL) · EPSS 73th percentile

CWECWE 94VNDInstawpTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
728 × 90 / responsive · programmatic ad slot
2024-04-03
2024-04-03 03:15Z
CRIT

CVE-2024-30166 — Trustedfirmware Mbed_tls: In Mbed TLS 3.3.0 through 3.5.2 before 3.6.0, a malicious client can cause information

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-30166

In Mbed TLS 3.3.0 through 3.5.2 before 3.6.0, a malicious client can cause information disclosure or a denial of service because of a stack buffer over-read (of less than 256 bytes) in a TLS 1.3 server via a TLS 3.1 ClientHello. CVSSv3.1 9.1 (CRITICAL) · EPSS 58th percentile

CWECWE 121VNDMbedVNDTrustedfirmwareTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2024-04-02
2024-04-02 07:15Z
CRIT

CVE-2024-26665 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: tunnels: fix out of

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-26665

In the Linux kernel, the following vulnerability has been resolved: tunnels: fix out of bounds access when building IPv6 PMTU error If the ICMPv6 error is built from a non-linear skb we get the following splat, BUG: KASAN: slab-out-of-bounds in do_csum+0x220/0x240 Read of size 4 at addr ffff88811d402c80 by task netperf/820 CPU: 0 PID: 820 Comm: netperf Not tainted 6.8.0-rc1+ #543 ... kasan_report+0xd8/0x110 do_csum+0x220/0x240 csum_partial+0xc/0x20 skb_ CVSSv3.1 9.1 (CRITICAL) · EPSS 15th percentile

CWECWE 125TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2024-04-02
2024-04-02 07:15Z
HIGH

CVE-2023-52636 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: libceph: just wait for

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-52636

In the Linux kernel, the following vulnerability has been resolved: libceph: just wait for more data to be available on the socket A short read may occur while reading the message footer from the socket. Later, when the socket is ready for another read, the messenger invokes all read_partial_*() handlers, including read_partial_sparse_msg_data(). The expectation is that read_partial_sparse_msg_data() would bail, allowing the messenger to invoke read_partial() for the foot CVSSv3.1 8.2 (HIGH) · EPSS 13th percentile

TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2024-03-31
2024-03-31 18:15Z
HIGH

CVE-2024-31094 — Filter: A vulnerability in websupporter Filter Custom Fields & Taxonomies Light filter-custom-fields-taxonomies-light.This issue affects Filter

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-31094

A vulnerability in websupporter Filter Custom Fields & Taxonomies Light filter-custom-fields-taxonomies-light.This issue affects Filter Custom Fields & Taxonomies Light: from n/a through <= 1.05. CVSSv3.1 8.5 (HIGH) · EPSS 63th percentile

CWECWE 502VNDFilterTYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2024-03-30
2024-03-30 12:15Z
HIGH

CVE-2024-3018 — Wpdeveloper Essential_addons_for_elementor: The Essential Addons for Elementor plugin for WordPress is vulnerable to PHP Object Injection

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-3018

The Essential Addons for Elementor plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.9.13 via deserialization of untrusted input from the 'error_resetpassword' attribute of the "Login | Register Form" widget (disabled by default). This makes it possible for authenticated attackers, with author-level access and above, to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target syst CVSSv3.1 8.8 (HIGH) · EPSS 78th percentile

CWECWE 502VNDWpdeveloperVNDEssentialTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-03-30
2024-03-30 05:15Z
CRIT

CVE-2024-2086 — Integrate: The Integrate Google Drive – Browse, Upload, Download, Embed, Play, Share, Gallery, and Manage

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-2086

The Integrate Google Drive – Browse, Upload, Download, Embed, Play, Share, Gallery, and Manage Your Google Drive Files Into Your WordPress Site plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missing capability check on multiple AJAX in all versions up to, and including, 1.3.8. This makes it possible for authenticated attackers to modify plugin settings as well as allowing full read/write/delete access to the CVSSv3.1 10.0 (CRITICAL) · EPSS 79th percentile

CWECWE 862VNDIntegrateTYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2024-03-30
2024-03-30 05:15Z
HIGH

CVE-2024-2047 — Wpmet Elements_kit_elementor_addons: The ElementsKit Elementor addons plugin for WordPress is vulnerable to Local File Inclusion in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-2047

The ElementsKit Elementor addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.6 via the render_raw function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where image CVSSv3.1 8.8 (HIGH) · EPSS 82th percentile

CWECWE 98VNDWpmetVNDElementskitTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-03-29
2024-03-29 17:15Z
CRIT

CVE-2024-29640 — An issue in aliyundrive-webdav v.2.3.3 and before allows a remote attacker to execute arbitrary

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-29640

An issue in aliyundrive-webdav v.2.3.3 and before allows a remote attacker to execute arbitrary code via a crafted payload to the sid parameter in the action_query_qrcode component. CVSSv3.1 9.8 (CRITICAL) · EPSS 70th percentile

CWECWE 78TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-03-29
2024-03-29 14:15Z
HIGH

CVE-2024-30488 — Katieseaborn Zotpress: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-30488

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Katie Zotpress zotpress.This issue affects Zotpress: from n/a through <= 7.3.7. CVSSv3.1 8.5 (HIGH)

CWECWE 89VNDKatieseabornTYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2024-03-29
2024-03-29 12:15Z
CRIT

CVE-2023-6191 — Webpdks Webpdks: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-6191

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Egehan Security WebPDKS allows SQL Injection. This issue affects WebPDKS: through 20240329. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. CVSSv3.1 9.8 (CRITICAL) · EPSS 30th percentile

CWECWE 89VNDWebpdksTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-03-29
2024-03-29 10:15Z
HIGH

CVE-2023-52629 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: sh: push-switch: Reorder cleanup

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-52629

In the Linux kernel, the following vulnerability has been resolved: sh: push-switch: Reorder cleanup operations to avoid use-after-free bug The original code puts flush_work() before timer_shutdown_sync() in switch_drv_remove(). Although we use flush_work() to stop the worker, it could be rescheduled in switch_timer(). As a result, a use-after-free bug can occur. The details are shown below: (cpu 0) | (cpu 1) switch_drv_remove() | CVSSv3.1 8.4 (HIGH) · EPSS 14th percentile

CWECWE 416TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2024-03-29
2024-03-29 09:15Z
CRIT

CVE-2024-2411 — Stylemixthemes Masterstudy_lms: The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-2411

The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the 'modal' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and inclu CVSSv3.1 9.8 (CRITICAL) · EPSS 87th percentile

CWECWE 98VNDStylemixthemesVNDMasterstudyTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2024-03-29
2024-03-29 09:15Z
CRIT

CVE-2024-2409 — Stylemixthemes Masterstudy_lms: The MasterStudy LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-2409

The MasterStudy LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.1. This is due to insufficient validation checks within the _register_user() function called by the 'wp_ajax_nopriv_stm_lms_register' AJAX action. This makes it possible for unauthenticated attackers to register a user with administrator-level privileges when MasterStudy LMS Pro is installed and the LMS Forms Editor add-on is enabled. CVSSv3.1 9.8 (CRITICAL) · EPSS 48th percentile

CWECWE 266VNDStylemixthemesVNDMasterstudyTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-03-29
2024-03-29 07:15Z
HIGH

CVE-2024-1872 — Button: The Button plugin for WordPress is vulnerable to PHP Object Injection in all versions

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-1872

The Button plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.27 via deserialization of untrusted input in the button_shortcode function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker CVSSv3.1 8.8 (HIGH) · EPSS 79th percentile

CWECWE 502VNDButtonTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-03-29
2024-03-29 06:15Z
HIGH

CVE-2024-28960 — Arm Mbed_crypto: An issue was discovered in Mbed TLS 2.18.0 through 2.28.x before 2.28.8 and 3.x

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-28960

An issue was discovered in Mbed TLS 2.18.0 through 2.28.x before 2.28.8 and 3.x before 3.6.0, and Mbed Crypto. The PSA Crypto API mishandles shared memory. CVSSv3.1 8.2 (HIGH) · EPSS 35th percentile

CWECWE 284VNDFedoraprojectVNDArmVNDTrustedfirmwareTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2024-03-29
2024-03-29 00:00Z
HIGH

In-the-Wild Windows LPE 0-days: Insights & Detection Strategies

Elastic Security Labs·elastic.coCVE-2022-24521CVE-2023-2825CVE-2023-36033CVE-2022-41073CVE-2022-37969in the wild0day

Elastic Security Labs published a comprehensive analysis of in-the-wild Windows LPE 0-days, focusing on three major attack vectors: CLFS driver exploitation, DWM core library vulnerabilities, and Windows Activation Context abuse. The article provides detection strategies using EQL queries, KQL hunts, and YARA rules, along with behavioral indicators for privilege escalation primitives including token swapping, PreviousMode abuse, and cross-process injection.

SRFOsTACTA0004OSWindowsVNDMicrosoftVNDElasticTYPResearchSTGPrivescTECT1134
82
Edit Score
2024-03-28
2024-03-28 23:15Z
HIGH

CVE-2024-28714 — Crmeb Crmeb_java: SQL Injection vulnerability in CRMEB_Java e-commerce system v.1.3.4 allows an attacker to execute arbitrary

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-28714

SQL Injection vulnerability in CRMEB_Java e-commerce system v.1.3.4 allows an attacker to execute arbitrary code via the groupid parameter. CVSSv3.1 8.1 (HIGH) · EPSS 53th percentile

CWECWE 89VNDCrmebTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2024-03-28
2024-03-28 19:15Z
CRIT

CVE-2024-28713 — Mtons Mblog: An issue in Mblog Blog system v.3.5.0 allows an attacker to execute arbitrary code

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-28713

An issue in Mblog Blog system v.3.5.0 allows an attacker to execute arbitrary code via a crafted file to the theme management feature. CVSSv3.1 9.8 (CRITICAL) · EPSS 72th percentile

CWECWE 434VNDMtonsVNDMblogTYPVulnerability
9.8
CVSS v3.1
99
Edit Score