Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-25 14:36Z
2024-01-11
2024-01-11 09:15Z
HIGH

CVE-2023-6220 — Piotnet Piotnet_forms: The Piotnet Forms plugin for WordPress is vulnerable to arbitrary file uploads due to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-6220

The Piotnet Forms plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'piotnetforms_ajax_form_builder' function in versions up to, and including, 1.0.28. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. CVSSv3.1 8.1 (HIGH) · EPSS 91th percentile

CWECWE 434VNDPiotnetTYPVulnerability
8.1
CVSS v3.1
92
Edit Score
2024-01-11
2024-01-11 09:15Z
HIGH

CVE-2023-5504 — Inpsyde Backwpup: The BackWPup plugin for WordPress is vulnerable to Directory Traversal in versions up to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-5504

The BackWPup plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.0.1 via the Log File Folder. This allows authenticated attackers to store backups in arbitrary folders on the server provided they can be written to by the server. Additionally, default settings will place an index.php and a .htaccess file into the chosen directory (unless already present) when the first backup job is run that are intended to prevent directory listing an CVSSv3.1 8.7 (HIGH) · EPSS 71th percentile

CWECWE 22VNDInpsydeVNDBackwpupTYPVulnerability
8.7
CVSS v3.1
94
Edit Score
2024-01-11
2024-01-11 07:15Z
CRIT

CVE-2023-6699 — Wpcompress Wp_compress: The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to Directory

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-6699

The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.10.33 via the css parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. CVSSv3.1 9.1 (CRITICAL) · EPSS 89th percentile

CWECWE 22CWECWE 24VNDWpcompressVNDCompressTYPVulnerability
9.1
CVSS v3.1
97
Edit Score
2024-01-11
2024-01-11 04:15Z
HIGH

CVE-2023-5448 — Aviplugins Wp_register_profile_with_shortcode: The WP Register Profile With Shortcode plugin for WordPress is vulnerable to Cross-Site Request

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-5448

The WP Register Profile With Shortcode plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.9. This is due to missing or incorrect nonce validation on the update_password_validate function. This makes it possible for unauthenticated attackers to reset a user's password via a forged request granted they can trick the user into performing an action such as clicking on a link. CVSSv3.1 8.8 (HIGH) · EPSS 45th percentile

CWECWE 352VNDAvipluginsVNDRegisterTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-01-09
2024-01-09 02:15Z
CRIT

CVE-2023-26999 — Netscout Ngeniusone: An issue found in NetScout nGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-26999

An issue found in NetScout nGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted file. CVSSv3.1 9.8 (CRITICAL) · EPSS 69th percentile

CWECWE 611VNDNetscoutTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-01-09
2024-01-09 01:15Z
CRIT

CVE-2023-50643 — Evernote Evernote: An issue in Evernote Evernote for MacOS v.10.68.2 allows a remote attacker to execute

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-50643

An issue in Evernote Evernote for MacOS v.10.68.2 allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments components. CVSSv3.1 9.8 (CRITICAL) · EPSS 80th percentile

VNDEvernoteTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2024-01-09
2024-01-09 00:00Z
HIGH

Doubling Down: Detecting In-Memory Threats with Kernel ETW Call Stacks

Elastic Security Labs·elastic.co

Elastic Security Labs released Elastic Defend 8.11 with enhanced kernel ETW call stack-based detections targeting in-memory threats on Windows. The update adds visibility into sensitive APIs (VirtualAlloc, VirtualProtect, MapViewOfFile, WriteProcessMemory, etc.) with behavioral enrichment flags and 20+ new detection rules covering direct syscalls, shellcode injection, AMSI/ETW patching, and module hollowing techniques.

SRFOsTACTA0005TACTA0002OSWindowsSWElastic SecurityVNDElasticTYPResearchSTGDefense Evasion
72
Edit Score
728 × 90 / responsive · programmatic ad slot
2024-01-08
2024-01-08 20:15Z
HIGH

CVE-2023-47890 — Pyload Pyload: 0.5.0 is vulnerable to Unrestricted File Upload.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-47890

pyLoad 0.5.0 is vulnerable to Unrestricted File Upload. CVSSv3.1 8.8 (HIGH) · EPSS 61th percentile

CWECWE 22VNDPyloadTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-01-08
2024-01-08 18:15Z
MED

CVE-2022-2586 — Linux Linux_kernel: It was discovered that a nft object or expression could reference a nft set

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-2586in the wild

It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted. CVSSv3.1 5.3 (MEDIUM) · EPSS 95th percentile

CWECWE 416VNDCanonicalTYPVulnerabilitySTAitw exploited
5.3
CVSS v3.1
80
Edit Score
2024-01-04
2024-01-04 21:15Z
CRIT

CVE-2024-22051 — Github Cmark-gfm: CommonMarker versions prior to 0.23.4 are at risk of an integer overflow vulnerability.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-22051

CommonMarker versions prior to 0.23.4 are at risk of an integer overflow vulnerability. This vulnerability can result in possibly unauthenticated remote attackers to cause heap memory corruption, potentially leading to an information leak or remote code execution, via parsing tables with marker rows that contain more than UINT16_MAX columns. CVSSv3.1 9.8 (CRITICAL) · EPSS 70th percentile

CWECWE 190VNDGithubVNDGjtorikianTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-01-03
2024-01-03 16:15Z
HIGH

CVE-2024-21907 — Newtonsoft Json.net: Crafted data that is passed to the JsonConvert.DeserializeObject method may trigger a StackOverflow exception

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-21907

Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the JsonConvert.DeserializeObject method may trigger a StackOverflow exception resulting in denial of service. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition. CVSSv3.1 7.5 (HIGH) · EPSS 98th percentile

CWECWE 755VNDNewtonsoftTYPVulnerability
7.5
CVSS v3.1
97
Edit Score
2024-01-03
2024-01-03 15:15Z
HIGH

CVE-2023-45559 — Linecorp Line: An issue in Tamaki_hamanoki Line v.13.6.1 allows attackers to send crafted notifications via leakage

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-45559

An issue in Tamaki_hamanoki Line v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token. CVSSv3.1 8.2 (HIGH) · EPSS 39th percentile

VNDLinecorpVNDTamaki HamanokiTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2024-01-03
2024-01-03 06:15Z
HIGH

CVE-2023-6600 — Daan Omgf: plugin for WordPress is vulnerable to unauthorized modification of data and Stored Cross-Site Scripting

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-6600

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to unauthorized modification of data and Stored Cross-Site Scripting due to a missing capability check on the update_settings() function hooked via admin_init in all versions up to, and including, 5.7.9. This makes it possible for unauthenticated attackers to update the plugin's settings which can be used to inject Cross-Site Scripting payloads and delete entire directories. PLease CVSSv3.1 8.6 (HIGH) · EPSS 40th percentile

CWECWE 862CWECWE 79VNDDaanVNDOmgfTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2024-01-02
2024-01-02 21:15Z
CRIT

CVE-2023-47458 — Bladex Springblade: An issue in SpringBlade v.3.7.0 and before allows a remote attacker to escalate privileges

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-47458

An issue in SpringBlade v.3.7.0 and before allows a remote attacker to escalate privileges via the lack of permissions control framework. CVSSv3.1 9.8 (CRITICAL) · EPSS 51th percentile

CWECWE 862VNDBladexVNDSpringbladeTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-01-02
2024-01-02 13:15Z
CRIT

CVE-2023-6436 — Ekolbilisim Web_sablonu_yazilimi: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-6436

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ekol Informatics Website Template allows SQL Injection. This issue affects Website Template: through 20231215. CVSSv3.1 9.8 (CRITICAL)

CWECWE 89VNDEkolbilisimTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2023-12-30
2023-12-30 17:15Z
CRIT

CVE-2023-50651 — Totolink X6000r_firmware: X6000R v9.4.0cu.852_B20230719 was discovered to contain a remote command execution (RCE) vulnerability via

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-50651

TOTOLINK X6000R v9.4.0cu.852_B20230719 was discovered to contain a remote command execution (RCE) vulnerability via the component /cgi-bin/cstecgi.cgi. CVSSv3.1 9.8 (CRITICAL) · EPSS 74th percentile

CWECWE 78VNDTotolinkTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2023-12-29
2023-12-29 15:15Z
CRIT

CVE-2023-4675 — Gmbilisim Multi-disciplinary_design_optimization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-4675

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GM Information Technologies MDO allows SQL Injection. This issue affects MDO: through 20231229.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way. CVSSv3.1 9.8 (CRITICAL) · EPSS 25th percentile

CWECWE 89VNDGmbilisimTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2023-12-29
2023-12-29 15:15Z
CRIT

CVE-2023-4541 — Ween Management_panel: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-4541

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ween Software Admin Panel allows SQL Injection. This issue affects Admin Panel: through 20231229.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way. CVSSv3.1 9.8 (CRITICAL) · EPSS 34th percentile

CWECWE 89VNDWeenTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2023-12-28
2023-12-28 15:15Z
HIGH

CVE-2023-46987 — Seacms Seacms: v12.9 was discovered to contain a remote code execution (RCE) vulnerability via the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-46987

SeaCMS v12.9 was discovered to contain a remote code execution (RCE) vulnerability via the component /augap/adminip.php. CVSSv3.1 8.8 (HIGH) · EPSS 72th percentile

CWECWE 94VNDSeacmsTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2023-12-28
2023-12-28 10:15Z
CRIT

CVE-2023-4671 — Talentyazilim Ecop: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-4671

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Talent Software ECOP allows Command Line Execution through SQL Injection. This issue affects ECOP: before 32255. CVSSv3.1 9.8 (CRITICAL) · EPSS 21th percentile

CWECWE 89VNDTalentyazilimTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2023-12-27
2023-12-27 23:15Z
CRIT

CVE-2023-6879 — Aomedia Aomedia: Increasing the resolution of video frames, while performing a multi-threaded encode, can result in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-6879

Increasing the resolution of video frames, while performing a multi-threaded encode, can result in a heap overflow in av1_loop_restoration_dealloc(). CVSSv3.1 9.0 (CRITICAL) · EPSS 63th percentile

CWECWE 20CWECWE 787VNDFedoraprojectVNDAomediaTYPVulnerability
9.0
CVSS v3.1
95
Edit Score
2023-12-27
2023-12-27 15:15Z
CRIT

CVE-2023-6190 — Ikcu University_information_management_system: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in İzmir

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-6190

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in İzmir Katip Çelebi University University Information Management System allows Absolute Path Traversal. This issue affects University Information Management System: before 30.11.2023. CVSSv3.1 9.8 (CRITICAL)

CWECWE 22VNDIkcuTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2023-12-24
2023-12-24 21:15Z
CRIT

CVE-2023-51714 — Debian Debian_linux: network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-51714

An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check. CVSSv3.1 9.8 (CRITICAL) · EPSS 61th percentile

CWECWE 190VNDQtTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2023-12-23
2023-12-23 02:15Z
HIGH

CVE-2023-7002 — Backupbliss Backup_migration: The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-7002

The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 1.3.9 via the 'url' parameter. This vulnerability allows authenticated attackers, with administrator-level permissions and above, to execute arbitrary commands on the host operating system. CVSSv3.1 7.2 (HIGH) · EPSS 96th percentile

CWECWE 78VNDBackupblissVNDBackupTYPVulnerability
7.2
CVSS v3.1
93
Edit Score
2023-12-23
2023-12-23 02:15Z
CRIT

CVE-2023-6972 — Backupbliss Backup_migration: The Backup Migration plugin for WordPress is vulnerable to Path Traversal in all versions

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-6972

The Backup Migration plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.9 via the 'content-backups' and 'content-name', 'content-manifest', or 'content-bmitmp' and 'content-identy' HTTP headers. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible. CVSSv3.1 9.8 (CRITICAL) · EPSS 95th percentile

CWECWE 22VNDBackupblissVNDBackupTYPVulnerability
9.8
CVSS v3.1
100
Edit Score