Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-07-30 20:38Z
2d ago
2026-07-28 10:16Z
HIGH

CVE-2026-14328 — Eazy: The Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plugin for WordPress

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-14328

The Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.4.1. This is due to insufficient authorization on the `wp_ajax_pos_get_option` AJAX handler, which verifies only a nonce that is localized to every logged-in admin-area user via `admin_enqueue_scripts` — without any capability check — before returning the value of any arbitrary WordPress option via `get_ CVSSv3.1 8.8 (HIGH)

CWECWE 269VNDEazyTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2d ago
2026-07-28 10:16Z
CRIT

CVE-2026-11841 — Additionally, exposure of the custom application directory may allow execution of arbitrary Lua code

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-11841

An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access without authentication. This includes device parameter files, enabling an attacker to read and modify application settings, including customer-defined passwords. Additionally, exposure of CVSSv3.1 9.4 (CRITICAL)

CWECWE 552TYPVulnerability
9.4
CVSS v3.1
97
Edit Score
2d ago
2026-07-28 09:16Z
HIGH

CVE-2026-14169 — Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-14169

Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted input and overwrites existing user passwords which could result in complete administrative unavailability of the device. CVSSv3.1 8.1 (HIGH)

CWECWE 696TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2d ago
2026-07-28 09:16Z
HIGH

CVE-2026-14168 — A low privileged remote attacker can gain administrator privileges due to missing authorization at

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-14168

A low privileged remote attacker can gain administrator privileges due to missing authorization at the insert path of the configuration table resulting in gaining full system access. CVSSv3.1 8.8 (HIGH)

CWECWE 862TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2d ago
2026-07-28 09:16Z
HIGH

CVE-2026-14167 — A low privileged remote attacker can perform privileged configuration changes reserved for the administrator

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-14167

A low privileged remote attacker can perform privileged configuration changes reserved for the administrator level including permission management due to incorrect authorization. CVSSv3.1 8.8 (HIGH)

CWECWE 863TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2d ago
2026-07-28 08:17Z
CRIT

CVE-2026-15014 — SMS: The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-15014

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 3.9.7 via the `billing_phone` parameter. This is due to the `processRegistration()` function using a phone-unbound `$_SESSION['sa_mobile_verified']` boolean flag as the sole gate before issuing an authentication cookie — the flag is set to `true` after any successf CVSSv3.1 9.8 (CRITICAL)

CWECWE 288VNDSmsTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2d ago
2026-07-28 08:17Z
CRIT

CVE-2026-11756 — Deserialization: A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-11756

A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could lead to an unauthenticated remote code execution. CVSSv3.1 10.0 (CRITICAL)

CWECWE 502TYPVulnerability
10.0
CVSS v3.1
100
Edit Score
728 × 90 / responsive · programmatic ad slot
2d ago
2026-07-28 08:00Z
HIGH

Mirage Kitten targets Middle East and Africa region with new malware

Kaspersky Securelist·securelist.comin the wild

Kaspersky researchers documented a previously undisclosed malware toolkit attributed to Mirage Kitten (UNC1549/Smoke Sandstorm/Nimbus Manticore) targeting aerospace, aviation, defense, and telecom sectors across the Middle East and Africa. The toolkit comprises NightLedger (a Windows backdoor using DLL search-order hijacking), BridgeHead, and ArcBridge (two custom WebSocket-based SOCKS5 tunnelers with per-target username validation and enterprise proxy traversal logic). Victims span Egypt, Jordan, Tanzania, Pakistan, Ethiopia, and Burkina Faso, with initial access via spear-phishing using recruitment-themed lures and lookalike videoconferencing pages.

SRFOsTACTA0004TACTA0001TACTA0002SRFNetworkTACTA0003TACTA0008TACTA0011
78
Edit Score
2d ago
2026-07-28 07:16Z
CRIT

CVE-2026-14545 — TrueBooker: The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-14545

The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site. CVSSv3.1 9.8 (CRITICAL)

CWECWE 269VNDTruebookerTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2d ago
2026-07-28 00:00Z
HIGH

Chaos in Teams vishing

Sophos X-Ops·news.sophos.comin the wild

Sophos X-Ops tracked STAC4749, a financially motivated threat group conducting Microsoft Teams vishing campaigns (February–June 2026) targeting North American organizations across services, manufacturing, energy, and construction sectors. The group deployed a custom modular malware chain (Python backdoor, Golang implants, reverse SOCKS proxy) for persistence and lateral movement, ultimately facilitating Chaos ransomware deployment in at least three incidents with sub-17-hour dwell times. The campaign demonstrated rapid tactical iteration—switching from Quick Assist to RemSupp RMM, rotating malware filenames, and evolving registry persistence mechanisms—indicating operational maturity and financial motivation.

SRFApplicationTACTA0005TACTA0001TACTA0003SRFCloudTACTA0011SWChaosSWMicrosoft Teams
78
Edit Score
2d ago
2026-07-27 22:16Z
CRIT

CVE-2021-32088 — Quest: An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-32088

An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. Certain API endpoints contain a rate-limiting feature to minimize a brute-force attack. This protection can be bypassed by removing the kboxid cookie. CVSSv3.1 9.8 (CRITICAL)

CWECWE 384VNDQuestTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2d ago
2026-07-27 22:16Z
HIGH

CVE-2021-32087 — Quest: This allows remote attackers to trivially gain privileged access to the FTP service interface

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-32087

An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs with default user credentials. The kbftp account has a password of getbxf, which is publicly known and documented. This allows remote attackers to trivially gain privileged access to the FTP service interface, which contains MySQL backups. Sensitive information is stored in the database, such as privileged credentials for other systems. CVSSv3.1 8.8 (HIGH)

CWECWE 798VNDQuestTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2d ago
2026-07-27 22:16Z
CRIT

CVE-2021-32086 — Quest: An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-32086

An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It uses a hardcoded symmetric encryption key to encrypt secrets in the MySQL databases. (This key is not unique for each installation.) An attacker that gains access to the MySQL server or a backup files can decrypt the secrets. Often, the decrypted secrets can be used to escalate privileges within KACE, or gain privileged access to unrelated systems or services. CVSSv3.1 9.8 (CRITICAL)

CWECWE 321VNDQuestTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2d ago
2026-07-27 22:16Z
HIGH

CVE-2021-32085 — Quest: This allows remote attackers to trivially gain privileged access to the MySQL databases.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-32085

An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs with default user credentials. The report and R1 MySQL accounts have a password of box747, which is publicly known and documented. This allows remote attackers to trivially gain privileged access to the MySQL databases. Sensitive information is stored in the database, such as privileged credentials for other systems. CVSSv3.1 8.8 (HIGH)

CWECWE 798VNDQuestTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2d ago
2026-07-27 22:16Z
CRIT

CVE-2021-32084 — Quest: An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-32084

An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. If a customer restricts access to the web console by IP address or subnets, the API endpoints are not restricted. If credentials/API keys are known to an attacker, the appliance can still be accessed via the API, leading to a potential compromise of the entire environment that is configured for KACE. CVSSv3.1 9.8 (CRITICAL)

CWECWE 284VNDQuestTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2d ago
2026-07-27 21:17Z
HIGH

CVE-2026-64783 — A use-after-free issue was addressed with improved memory management.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64783

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected Safari crash. CVSSv3.1 8.8 (HIGH)

CWECWE 416TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2d ago
2026-07-27 21:17Z
CRIT

CVE-2026-64775 — A memory initialization issue was addressed with improved memory handling.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64775

A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination. CVSSv3.1 9.8 (CRITICAL)

CWECWE 665TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2d ago
2026-07-27 21:17Z
CRIT

CVE-2026-64774 — An integer overflow was addressed with improved input validation.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64774

An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote attacker may be able to cause unexpected application termination or heap corruption. CVSSv3.1 9.8 (CRITICAL)

CWECWE 190TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2d ago
2026-07-27 21:17Z
CRIT

CVE-2026-64772 — An out-of-bounds write issue was addressed with improved input validation.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64772

An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote attacker may be able to cause unexpected application termination or heap corruption. CVSSv3.1 9.8 (CRITICAL)

CWECWE 787TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2d ago
2026-07-27 21:17Z
CRIT

CVE-2026-64771 — A buffer overflow was addressed with improved bounds checking.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64771

A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote attacker may be able to cause unexpected application termination or heap corruption. CVSSv3.1 9.8 (CRITICAL)

CWECWE 119TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2d ago
2026-07-27 21:17Z
CRIT

CVE-2026-64770 — An out-of-bounds write issue was addressed with improved bounds checking.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64770

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote attacker may be able to cause unexpected application termination or heap corruption. CVSSv3.1 9.8 (CRITICAL)

CWECWE 787TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2d ago
2026-07-27 21:17Z
CRIT

CVE-2026-64769 — An out-of-bounds write issue was addressed with improved bounds checking.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64769

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote attacker may be able to cause unexpected application termination or heap corruption. CVSSv3.1 9.8 (CRITICAL)

CWECWE 787TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2d ago
2026-07-27 21:17Z
HIGH

CVE-2026-64768 — An out-of-bounds read issue was addressed with improved input validation.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64768

An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote attacker may cause an unexpected app termination. CVSSv3.1 8.1 (HIGH)

CWECWE 125TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2d ago
2026-07-27 21:17Z
CRIT

CVE-2026-64767 — A buffer overflow was addressed with improved bounds checking.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64767

A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A remote attacker may be able to cause unexpected system termination or corrupt kernel memory. CVSSv3.1 9.8 (CRITICAL)

CWECWE 120TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2d ago
2026-07-27 21:17Z
CRIT

CVE-2026-64762 — An out-of-bounds read was addressed with improved bounds checking.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64762

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause unexpected system termination. CVSSv3.1 9.8 (CRITICAL)

CWECWE 125TYPVulnerability
9.8
CVSS v3.1
99
Edit Score