Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-09-17 13:27Z
2w ago
2026-08-27 17:20Z
CRIT

CVE-2026-81098 — Telnyx: The Telnyx MCP server exposed its HTTP transport on every interface and did not

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-81098

The Telnyx MCP server exposed its HTTP transport on every interface and did not require a caller credential. packages/mcp-server/src/http.ts served MCP on the root path with a listener bound to all interfaces and parsed the caller's authentication headers in a mode that did not fail when they were absent, so a request without any credential completed initialisation and dispatched tools. Dispatch forwarded the server's own stored credentials, the Telnyx API key and client secr CVSSv3.1 9.1 (CRITICAL)

CWECWE 306VNDTelnyxTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2w ago
2026-08-27 17:20Z
HIGH

CVE-2026-81097 — Version 1.6.1 restricts the requires the sandbox permits to a data-only list and blocks

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-81097

The execute_ruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together with replacements for the process-spawning methods on Kernel. The pseudo-terminal library's spawn entry points are neither in the denylist nor replaced, so a normal tool call could reach them and start a shell, executing commands as the account running the server and outside the guarded methods. The denylist was introduced with the tool in 1.4.0 and never covered tho CVSSv3.1 8.4 (HIGH)

CWECWE 78TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2w ago
2026-08-27 17:20Z
CRIT

CVE-2026-81096 — ToolUniverse: A per-call argument also let the caller widen the import allow-list before the inspection

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-81096

ToolUniverse ran caller-supplied Python inside a sandbox that could be escaped, on a server that required no authentication. The executor behind the python_code_executor tool, in python_executor_tool.py, inspected the submitted source for a denied list of attribute names and calls but left the attribute-lookup builtins available and did not stop a dunder attribute reached through a string lookup or through a module already permitted, so a caller could walk from a literal's cl CVSSv3.1 10.0 (CRITICAL)

CWECWE 94VNDTooluniverseTYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2w ago
2026-08-27 17:20Z
CRIT

CVE-2026-81094 — CLI: The mcp-router CLI served its MCP aggregator on every interface and enforced authentication only

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-81094

The mcp-router CLI served its MCP aggregator on every interface and enforced authentication only when the operator asked for it. The serve command in apps/cli/src/commands/serve.ts defaulted its host to the all-interfaces address on a fixed port, and required a token only when the corresponding flag was supplied, so a default invocation exposed the aggregator, and every MCP server it fronted, to anyone able to reach the port. Release 0.6.3 defaults the host to the loopback ad CVSSv3.1 9.1 (CRITICAL)

CWECWE 306VNDCliTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2w ago
2026-08-27 17:20Z
HIGH

CVE-2026-81093 — The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-81093

The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax. The handler in src/tools/common/get_html_skeleton.ts validated the url argument with isValidHttpUrl from src/utils/generic.ts, which confirmed the string began with an http or https scheme and parsed as a URL and inspected neither the host name nor the address it resolves to. Loopback, link-local and private ranges therefore passed, including the address cloud providers use to serve i CVSSv3.1 8.6 (HIGH)

CWECWE 918TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2w ago
2026-08-27 17:20Z
HIGH

CVE-2026-81091 — The proxy middleware in mcp-use's inspector forwards requests to a destination the caller names.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-81091

The proxy middleware in mcp-use's inspector forwards requests to a destination the caller names. mountMcpProxy in libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts read the target from the X-Target-URL header or the __mcp_target parameter and proxied to it without inspecting the host, so loopback, link-local and private addresses were all accepted, as were names that resolve to them, and the validation was not reapplied to a redirect the destination return CVSSv3.1 8.6 (HIGH)

CWECWE 918TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2w ago
2026-08-27 17:20Z
HIGH

CVE-2026-80208 — APITable: through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in InternalUserController with requiredLogin = false.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80208

APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in InternalUserController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxies every /api request to the backend server, so both endpoints are reachable by any unauthenticated client that can reach the gateway. An attacker can POST to /api/v1/internal/getUser CVSSv3.1 8.2 (HIGH)

CWECWE 306VNDApitableTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
728 × 90 / responsive · programmatic ad slot
2w ago
2026-08-27 17:20Z
HIGH

CVE-2026-75871 — GitLab: has remediated a vulnerability in the GitLab AI Gateway component affecting all versions

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-75871

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.10 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2 that could have allowed an authenticated user with Duo Agent Platform access to redirect outbound model requests to an externally-controlled endpoint via a crafted inline flow configuration that overrides the HTTP Host header, resulting in disclosure of Google Cloud Vertex cloud service credentials and priv CVSSv3.1 8.2 (HIGH)

CWECWE 918VNDGitlabTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2w ago
2026-08-27 17:19Z
CRIT

CVE-2026-75357 — Bilibili: An issue in Bilibili Desktop v.1.17.9 allows a remote attacker to execute arbitrary code

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-75357

An issue in Bilibili Desktop v.1.17.9 allows a remote attacker to execute arbitrary code via the bili-inject.js and bili-bridge.js components. CVSSv3.1 9.8 (CRITICAL) · EPSS 17th percentile

CWECWE 94VNDBilibiliTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2w ago
2026-08-27 17:18Z
CRIT

CVE-2026-57499 — Liman: Prior to 2.2.2 - 1103, an OS command injection vulnerability in the log rotation

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-57499

Liman is open source server management software. Prior to 2.2.2 - 1103, an OS command injection vulnerability in the log rotation configuration endpoint allows an authenticated administrator to execute arbitrary operating system commands on the Liman server. The `ip_address` parameter is embedded directly into a shell command without sanitization, enabling shell escape via single-quote injection. This is fixed in 2.2.2 - 1103. CVSSv3.1 9.1 (CRITICAL)

CWECWE 20CWECWE 78VNDLimanTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2w ago
2026-08-27 17:17Z
HIGH

CVE-2026-26899 — The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-26899

An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR #15 (< 2026-01-17). The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter CVSSv3.1 8.8 (HIGH) · EPSS 7th percentile

CWECWE 78TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2w ago
2026-08-27 17:17Z
CRIT

CVE-2026-26897 — EcoOnline: An issue in EcoOnline EHS (com.airsweb.v10) application for Android, version 0.2.499 allows a remote

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-26897

An issue in EcoOnline EHS (com.airsweb.v10) application for Android, version 0.2.499 allows a remote attacker to obtain sensitive information and execute arbitrary code via the AndroidManifest.xml component CVSSv3.1 9.8 (CRITICAL) · EPSS 23th percentile

CWECWE 200VNDEcoonlineTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2w ago
2026-08-27 17:17Z
HIGH

CVE-2026-19889 — GitLab: has remediated a vulnerability in the GitLab AI Gateway component affecting all versions

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-19889

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.9.0 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2 that could have allowed an authenticated user with Duo Agent Platform access to redirect model requests to an externally-controlled endpoint via crafted model metadata, resulting in the disclosure of Google Vertex AI or AWS Bedrock cloud service credentials. CVSSv3.1 8.2 (HIGH)

CWECWE 918VNDGitlabTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2w ago
2026-08-27 17:17Z
CRIT

CVE-2026-16279 — Authorization: An Improper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Release

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-16279

An Improper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could allow an attacker to gain access to some user accounts. CVSSv3.1 9.3 (CRITICAL)

CWECWE 285TYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2w ago
2026-08-27 16:00Z
HIGH

Cleartext Credential Recovery in ServiceNow

SpecterOps·specterops.io

SpecterOps researcher Matt Creel disclosed a technique for extracting cleartext credentials stored in ServiceNow discovery_credentials and LDAP configuration tables by modifying server-side script includes to return decrypted secrets via AJAX responses. The attack requires discovery_admin or script_include_admin roles and affects all credential types stored in ServiceNow, including SSH keys, Azure service principal secrets, and AWS keys.

SRFApplicationTACTA0006SRFCloudVNDServicenowTYPResearchSTGDiscoverySTGCred AccessTECT1110
78
Edit Score
2w ago
2026-08-27 13:51Z
HIGH

Identity-as-a-Service: Uncovering Dark Web Marketplaces Trading Executive SSNs

Rapid7 Research·rapid7.com

Rapid7 researchers analyzed three major dark web SSN marketplaces (Xilo, Bankomat, PeopleFinder) trading stolen Social Security numbers of corporate executives. Since early 2026, Rapid7 telemetry identified 476 compromised SSN records across 395 unique individuals, with 73% targeting senior leadership (44.6% C-suite, 28.6% Presidents) primarily in Financial (25%) and Industrial (17%) sectors. The marketplaces operate as searchable clearinghouses with pricing ranging from $0.25–$4 per record, sourced from mega-breaches and infostealer malware, enabling downstream identity fraud, synthetic identity creation, and executive impersonation attacks.

TACTA0006SRFIdentityVNDRapid7TYPResearchTYPThreat IntelSTGCred AccessSTGCollectionTECT1589
78
Edit Score
3w ago
2026-08-27 13:18Z
CRIT

CVE-2026-74233 — Zbtlink: WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74233

Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1101, and WRC1 firmware 20.0622 contain an unauthenticated command injection in the infosrvd service (UDP/9992). A remote unauthenticated attacker can send a crafted UDP packet to execute arbitrary commands as root. The s CVSSv3.1 9.8 (CRITICAL)

CWECWE 78CWECWE 321VNDZbtlinkTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
3w ago
2026-08-27 13:18Z
CRIT

CVE-2026-74232 — Zbtlink: L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74232

Zbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621 firmware 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, and MQAP-7628 firmware 1.0.0.2.000, AP522 firmware 1.0.0.2.014, AP7628 and HC5661A firmware 3.0.0.4.380, APG721B firmware 19.0809, HK300 firmware 1.0.0.2.032, and MAP-N10 firmware 1.0.0.2.044 ship a backdoor command-and-control implant (yunmgrd) reachable over an unauth CVSSv3.1 9.8 (CRITICAL)

CWECWE 506CWECWE 300VNDZbtlinkTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
3w ago
2026-08-27 10:16Z
HIGH

CVE-2026-81625 — A remote attacker with user privileges may use a malicious or compromised NASL vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-81625

A remote attacker with user privileges may use a malicious or compromised NASL vulnerability test (VT) on the affected products to trigger a stack buffer overflow and gain full access on the compromised system. CVSSv3.1 8.8 (HIGH)

CWECWE 787TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
3w ago
2026-08-27 10:16Z
HIGH

CVE-2026-81581 — This usually results in a denial of service, yet we cannot rule out the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-81581

Improper validation of memory boundaries in WibuKey64.sys of WibuKey up to 6.70 for Windows can be exploited by an attacker by setting the pointers outside the scope of the program. This usually results in a denial of service, yet we cannot rule out the possibility of exploits that can cause Remote Code Execution and Privilege Escalation (since the driver runs with system privileges). CVSSv3.1 8.8 (HIGH)

CWECWE 119TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
3w ago
2026-08-27 10:16Z
HIGH

CVE-2026-81579 — WibuKey: In WibuKey for Windows before version 6.71, an untrusted pointer dereference in the WibuKey2_64.sys

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-81579

In WibuKey for Windows before version 6.71, an untrusted pointer dereference in the WibuKey2_64.sys kernel driver for 64-bit Windows allows an attacker to exploit a write-what-where primitive, enabling local privilege escalation. This can be leveraged to execute arbitrary code, run an administrator shell, or gain full control over the system. CVSSv3.1 8.8 (HIGH)

CWECWE 123VNDWibukeyTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
3w ago
2026-08-27 10:16Z
HIGH

CVE-2026-81574 — CodeMeter: In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-81574

In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, allowing an attacker to inject printf-style format specifiers. This can be used to reliably crash CodeMeter and disclose sensitive information such as process memory and stack canaries. The attack works locally, for example by using cmu --set-proxy to set the proxy value, and remotely when combined with CVE-2026-81573 by setting General.ProxyServer and then trigge CVSSv3.1 8.2 (HIGH)

CWECWE 134VNDCodemeterTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
3w ago
2026-08-27 10:16Z
HIGH

CVE-2026-81573 — CodeMeter: If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-81573

If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network- origin restrictions. Commands intended only for local or same-network clients can therefore be executed by arbitrary remote peers. An attacker can read potentially sensitive configuration data and overwrite selected values in Server.ini. This does include the hash of the credentials for the CodeMeter WebAdmin, enabling WebAdmin takeover. CVSSv3.1 8.6 (HIGH)

CWECWE 284VNDCodemeterTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
3w ago
2026-08-27 10:16Z
HIGH

CVE-2026-81277 — Contributor: SQL Injection in Suggestion Engine for WooCommerce <= 2.0.11 versions.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-81277

Contributor SQL Injection in Suggestion Engine for WooCommerce <= 2.0.11 versions. CVSSv3.1 8.5 (HIGH)

CWECWE 89VNDContributorTYPVulnerability
8.5
CVSS v3.1
93
Edit Score
3w ago
2026-08-27 10:16Z
HIGH

CVE-2026-81273 — Site: Unauthenticated Cross Site Request Forgery (CSRF) in FluentBooking Pro <= 2.2.4 versions.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-81273

Unauthenticated Cross Site Request Forgery (CSRF) in FluentBooking Pro <= 2.2.4 versions. CVSSv3.1 8.1 (HIGH)

CWECWE 352TYPVulnerability
8.1
CVSS v3.1
91
Edit Score