Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-26 00:44Z
2023-07-27
2023-07-27 07:15Z
CRIT

CVE-2023-3956 — Instawp Instawp_connect: The InstaWP Connect plugin for WordPress is vulnerable to unauthorized access of data, modification

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-3956

The InstaWP Connect plugin for WordPress is vulnerable to unauthorized access of data, modification of data and loss of data due to a missing capability check on the 'events_receiver' function in versions up to, and including, 0.0.9.18. This makes it possible for unauthenticated attackers to add, modify or delete post and taxonomy, install, activate or deactivate plugin, change customizer settings, add or modify or delete user including administrator user. CVSSv3.1 9.8 (CRITICAL) · EPSS 75th percentile

CWECWE 862VNDInstawpTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2023-07-25
2023-07-25 07:15Z
CRIT

CVE-2023-35078 — Ivanti Endpoint_manager_mobile: An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-35078in the wild

An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication. CVSSv3.1 9.8 (CRITICAL) · EPSS 100th percentile

CWECWE 287VNDIvantiTYPVulnerabilitySTAitw exploited
9.8
CVSS v3.1
100
Edit Score
2023-07-25
2023-07-25 07:15Z
CRIT

CVE-2023-35066 — Infodrom E-invoice_approval_system: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-35066

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Infodrom Software E-Invoice Approval System allows SQL Injection.This issue affects E-Invoice Approval System: before v.20230701. CVSSv3.1 9.8 (CRITICAL) · EPSS 24th percentile

CWECWE 89VNDInfodromTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2023-07-25
2023-07-25 06:15Z
CRIT

CVE-2023-3046 — Biltay Scienta: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-3046

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Biltay Technology Scienta allows SQL Injection.This issue affects Scienta: before 20230630.1953. CVSSv3.1 9.8 (CRITICAL) · EPSS 24th percentile

CWECWE 89VNDBiltayTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2023-07-24
2023-07-24 09:15Z
CRIT

Analysis of CVE-2023-3519 in Citrix ADC and NetScaler Gateway (Part 2)

Assetnote·blog.assetnote.ioCVE-2023-3519in the wild

Assetnote published part 2 of their technical analysis of CVE-2023-3519, a critical RCE vulnerability affecting Citrix ADC and NetScaler Gateway. The vulnerability has been exploited in the wild and represents a significant attack surface for organizations running these appliances.

TACTA0001SRFNetwork ApplianceVNDCitrixTYPResearchTYPWriteupSTGInitial AccessEXPRceSTAitw exploited
78
Edit Score
2023-07-22
2023-07-22 03:59Z
CRIT

Chaining our way to Pre-Auth RCE in Metabase (CVE-2023-38646)

Assetnote·blog.assetnote.ioCVE-2023-38646

Assetnote published a detailed writeup of CVE-2023-38646, a pre-authentication RCE vulnerability in Metabase achieved through vulnerability chaining. The exploit allows unauthenticated remote code execution on affected Metabase instances.

SRFApplicationTACTA0001VNDMetabaseTYPWriteupTYPVulnerabilitySTGInitial AccessTECT1190EXPRce
82
Edit Score
2023-07-21
2023-07-21 14:00Z
CRIT

Advisory: Metabase Pre-Auth RCE (CVE-2023-38646)

Assetnote·blog.assetnote.ioCVE-2023-38646

Assetnote disclosed CVE-2023-38646, a pre-authentication remote code execution vulnerability in Metabase. The vulnerability allows unauthenticated attackers to execute arbitrary code on affected instances without requiring valid credentials.

SRFApplicationTACTA0001SRFWebVNDMetabaseTYPVulnerabilityTYPAdvisorySTGInitial AccessTECT1190
82
Edit Score
728 × 90 / responsive · programmatic ad slot
2023-07-20
2023-07-20 03:15Z
CRIT

CVE-2023-38408 — Openbsd Openssh: The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-38408

The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009. CVSSv3.1 9.8 (CRITICAL) · EPSS 100th percentile

CWECWE 428VNDFedoraprojectTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2023-07-19
2023-07-19 18:15Z
CRIT

CVE-2023-3519 — Citrix Netscaler_application_delivery_controller: Unauthenticated remote code execution

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-3519in the wild

Unauthenticated remote code execution CVSSv3.1 9.8 (CRITICAL) · EPSS 100th percentile

CWECWE 94VNDCitrixTYPVulnerabilitySTAitw exploited
9.8
CVSS v3.1
100
Edit Score
2023-07-18
2023-07-18 03:15Z
HIGH

CVE-2023-3713 — Metagauss Profilegrid: The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-3713

The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'profile_magic_check_smtp_connection' function in versions up to, and including, 5.5.1. This makes it possible for authenticated attackers, with subscriber-level permissions or above to update the site options arbitrarily. This can be used by attackers to achieve privilege escalation. CVSSv3.1 8.8 (HIGH) · EPSS 28th percentile

CWECWE 862VNDMetagaussVNDProfilegridTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2023-07-17
2023-07-17 15:15Z
CRIT

CVE-2023-2958 — Orjinyazilim Ats_pro: Authorization Bypass Through User-Controlled Key vulnerability in Origin Software ATS Pro allows Authentication Abuse

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-2958

Authorization Bypass Through User-Controlled Key vulnerability in Origin Software ATS Pro allows Authentication Abuse, Authentication Bypass.This issue affects ATS Pro: before 20230714. CVSSv3.1 9.8 (CRITICAL) · EPSS 6th percentile

CWECWE 639VNDOrjinyazilimTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2023-07-17
2023-07-17 14:15Z
CRIT

CVE-2023-3376 — Dijital Zekiweb: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-3376

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Digital Strategy Zekiweb allows SQL Injection.This issue affects Zekiweb: before 2. CVSSv3.1 9.8 (CRITICAL) · EPSS 29th percentile

CWECWE 89VNDDijitalTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2023-07-17
2023-07-17 14:15Z
CRIT

CVE-2023-2963 — Olivaekspertiz Oliva_ekspertiz: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-2963

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Oliva Expertise Oliva Expertise EKS allows SQL Injection.This issue affects Oliva Expertise EKS: before 1.2. CVSSv3.1 9.8 (CRITICAL) · EPSS 29th percentile

CWECWE 89VNDOlivaekspertizTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2023-07-14
2023-07-14 00:00Z
HIGH

The DPRK strikes using a new variant of RUSTBUCKET

Elastic Security Labs·elastic.coin the wild

Elastic Security Labs disclosed a new variant of RUSTBUCKET malware attributed to North Korean Lazarus Group (BlueNorOff), targeting macOS systems at cryptocurrency service providers. The variant adds previously unseen LaunchAgent persistence, employs multi-stage execution via AppleScript/Swift/Rust binaries, and uses User-Agent string validation and rapid C2 domain rotation to evade detection. At publication, the variant had zero VirusTotal detections and was actively used in intrusions against a US-based cryptocurrency payment services company.

SRFApplicationTACTA0005TACTA0001TACTA0002TACTA0007TACTA0003OSMacosVNDElastic
72
Edit Score
2023-07-13
2023-07-13 14:15Z
CRIT

CVE-2023-35070 — Vegagroup Web_collection: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-35070

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VegaGroup Web Collection allows SQL Injection.This issue affects Web Collection: before 31197. CVSSv3.1 9.8 (CRITICAL) · EPSS 24th percentile

CWECWE 89VNDVegagroupTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2023-07-13
2023-07-13 08:15Z
CRIT

CVE-2023-2957 — Lisayazilim Florist_site: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-2957

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Lisa Software Florist Site allows SQL Injection.This issue affects Florist Site: before 3.0. CVSSv3.1 9.8 (CRITICAL) · EPSS 24th percentile

CWECWE 89VNDLisayazilimTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2023-07-13
2023-07-13 08:15Z
CRIT

CVE-2023-1547 — Elra Parkmatik: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-1547

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Elra Parkmatik allows SQL Injection through SOAP Parameter Tampering, Command Line Execution through SQL Injection. This issue affects Parkmatik: before 02.01-a51. CVSSv3.1 9.8 (CRITICAL) · EPSS 28th percentile

CWECWE 89VNDElraTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2023-07-13
2023-07-13 03:15Z
HIGH

CVE-2023-3343 — Wpeverest User_registration: The User Registration plugin for WordPress is vulnerable to PHP Object Injection in versions

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-3343

The User Registration plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.0.1 via deserialization of untrusted input from the 'profile-pic-url' parameter. This allows authenticated attackers, with subscriber-level permissions and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to del CVSSv3.1 8.8 (HIGH) · EPSS 71th percentile

CWECWE 502VNDWpeverestTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2023-07-13
2023-07-13 03:15Z
CRIT

CVE-2023-3342 — Wpeverest User_registration: The User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-3342

The User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to a hardcoded encryption key and missing file type validation on the 'ur_upload_profile_pic' function in versions up to, and including, 3.0.2. This makes it possible for authenticated attackers with subscriber-level capabilities or above to upload arbitrary files on the affected site's server which may make remote code execution possible. This was partially patched in version 3.0.2 and ful CVSSv3.1 9.9 (CRITICAL) · EPSS 91th percentile

CWECWE 434VNDWpeverestTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2023-07-12
2023-07-12 14:15Z
HIGH

CVE-2023-3600 — Mozilla Firefox: During the worker lifecycle, a use-after-free condition could have occurred, which could have led

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-3600

During the worker lifecycle, a use-after-free condition could have occurred, which could have led to a potentially exploitable crash. This vulnerability affects Firefox < 115.0.2, Firefox ESR < 115.0.2, and Thunderbird < 115.0.1. CVSSv3.1 8.8 (HIGH) · EPSS 49th percentile

CWECWE 416VNDMozillaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2023-07-12
2023-07-12 13:15Z
CRIT

CVE-2023-33668 — Digiexam Digiexam: up to v14.0.2 lacks integrity checks for native modules, allowing attackers to access

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-33668

DigiExam up to v14.0.2 lacks integrity checks for native modules, allowing attackers to access PII and takeover accounts on shared computers. CVSSv3.1 9.8 (CRITICAL) · EPSS 34th percentile

CWECWE 354VNDDigiexamTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2023-07-12
2023-07-12 05:15Z
HIGH

CVE-2023-3105 — Learndash Learndash: The LearnDash LMS plugin for WordPress is vulnerable to Insecure Direct Object References in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-3105

The LearnDash LMS plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 4.6.0. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for attackers with with existing account access at any level, to change user passwords and potentially take over administrator accounts. CVSSv3.1 8.8 (HIGH) · EPSS 18th percentile

CWECWE 639VNDLearndashTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2023-07-11
2023-07-11 19:15Z
HIGH

CVE-2023-36884 — Microsoft Windows_10_1507: Windows Search Remote Code Execution Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-36884in the wild

Windows Search Remote Code Execution Vulnerability CVSSv3.1 7.5 (HIGH) · EPSS 100th percentile

CWECWE 362VNDMicrosoftTYPVulnerabilitySTAitw exploited
7.5
CVSS v3.1
100
Edit Score
2023-07-11
2023-07-11 18:15Z
HIGH

CVE-2023-35311 — Microsoft 365_apps: Outlook Security Feature Bypass Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-35311in the wild

Microsoft Outlook Security Feature Bypass Vulnerability CVSSv3.1 8.8 (HIGH) · EPSS 97th percentile

CWECWE 367VNDMicrosoftTYPVulnerabilitySTAitw exploited
8.8
CVSS v3.1
99
Edit Score
2023-07-11
2023-07-11 18:15Z
CRIT

CVE-2023-33150 — Microsoft 365_apps: Office Security Feature Bypass Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-33150

Microsoft Office Security Feature Bypass Vulnerability CVSSv3.1 9.6 (CRITICAL) · EPSS 42th percentile

CWECWE 693VNDMicrosoftTYPVulnerability
9.6
CVSS v3.1
98
Edit Score