Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-09-19 21:52Z
4w ago
2026-08-22 16:16Z
CRIT

CVE-2026-74611 — Linux: A TLS peer can trigger this after the receiver enables TLS_RX_EXPECT_NO_PAD.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74611

In the Linux kernel, the following vulnerability has been resolved: tls: rx: restore msg_iter before TLS 1.3 optimistic retry tls_decrypt_sg() advances msg->msg_iter when it maps user pages for the optimistic TLS 1.3 zero-copy path. If the decrypted record turns out not to be unpadded application data, tls_decrypt_sw() retries into a kernel skb, but leaves the iterator advanced. The subsequent copy from the skb then writes decrypted bytes again at a later point in the call CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
4w ago
2026-08-22 16:16Z
CRIT

CVE-2026-74608 — Linux: In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74608

In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free in cifs_try_adding_channels() cifs_try_adding_channels() takes a temporary reference to an interface before dropping iface_lock. If cifs_ses_add_channel() fails, it drops that reference and then increments iface->weight_fulfilled. A concurrent interface list refresh can remove the list reference while channel creation is in progress. In that case, the failure-path kref_put() CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
4w ago
2026-08-22 16:16Z
HIGH

CVE-2026-74607 — Linux: In this case the incorrect VM receives kvm_put_kvm().

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74607

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Serialize accesses to the owner and mirror list with separate lock Interaction between KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM and KVM_CAP_VM_COPY_ENC_CONTEXT_FROM can cause two separate issues: - in sev_migrate_from(), when the destination KVM is a mirror, the mirror entry is moved from the source's list to the owner's mirror_vms list, without holding the owner's lock unlike other writers of the ow CVSSv3.1 8.8 (HIGH) · EPSS 11th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
4w ago
2026-08-22 16:16Z
HIGH

CVE-2026-74604 — Linux: In the Linux kernel, the following vulnerability has been resolved: Revert "thermal/drivers/hwmon: Cleanup coding

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74604

In the Linux kernel, the following vulnerability has been resolved: Revert "thermal/drivers/hwmon: Cleanup coding style a bit" Revert commit 030a48b0f6ce ("thermal/drivers/hwmon: Cleanup coding style a bit") that introduced a use-after-free into the error path of thermal_add_hwmon_sysfs() by removing a valid check from it. CVSSv3.1 8.4 (HIGH)

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
4w ago
2026-08-22 16:16Z
CRIT

CVE-2026-74597 — Linux: In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74597

In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in ip6ip6_err() ip6ip6_err() clones an outer IPv6 ICMP error skb, pulls it to the quoted inner IPv6 packet, and then passes the clone to icmpv6_send(). The clone still carries the outer packet's inet6_skb_parm in skb->cb. If the outer packet had a Home Address Option, IP6CB(skb2)->dsthao remains non-zero after skb_pull(). icmpv6_send() later calls mip6_addr_swap(), which uses t CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
4w ago
2026-08-22 16:16Z
HIGH

CVE-2026-74592 — Linux: In the Linux kernel, the following vulnerability has been resolved: ima: Instantiate file_truncate and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74592

In the Linux kernel, the following vulnerability has been resolved: ima: Instantiate file_truncate and path_truncate hooks Instantiate the file_truncate and path_truncate LSM hooks to reset the action cache flags (IMA_DONE_MASK) as soon as truncation is requested, so the file, based on policy, is re-collected, re-measured, re-audited, and re-appraised on next access. CVSSv3.1 8.1 (HIGH)

TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
4w ago
2026-08-22 16:16Z
CRIT

CVE-2026-74591 — Linux: In the Linux kernel, the following vulnerability has been resolved: mm/filemap: __filemap_add_folio() restore index

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74591

In the Linux kernel, the following vulnerability has been resolved: mm/filemap: __filemap_add_folio() restore index before retrying In __filemap_add_folio()'s split-a-conflict loop, xas_set_order() is applied repeatedly: each application modifies xas.xa_index, rounding it down according to the split_order attempted at that stage: and if all goes as intended, it eventually (or immediately) converges on an xas_try_split() to the required folio_order, with xas.xa_index now the CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
728 × 90 / responsive · programmatic ad slot
4w ago
2026-08-22 16:16Z
HIGH

CVE-2026-74589 — Linux: In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix sk_redir

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74589

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix sk_redir use-after-free in send verdict sk_psock_msg_verdict() takes a socket reference for psock->sk_redir. tcp_bpf_send_verdict() copies that pointer while holding the source socket lock, but does not take a reference for the local copy before dropping the lock around tcp_bpf_sendmsg_redir(). When apply_bytes keeps the cached verdict active, another sendmsg() on the same source socket c CVSSv3.1 8.4 (HIGH)

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
4w ago
2026-08-22 16:16Z
CRIT

CVE-2026-74588 — Linux: KASAN reports a slab-use-after-free read in sctp_check_transmitted(), freed from sctp_assoc_rm_peer().

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74588

In the Linux kernel, the following vulnerability has been resolved: sctp: keep chunk->transport in step with the list it is queued on __sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport's transmitted list without updating chunk->transport: if (chunk->tsn_gap_acked) { list_move_tail(&chunk->transmitted_list, &transport->transmitted); continue; } The chunk then sits on a live transport's list while chunk->transport still names a different CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
4w ago
2026-08-22 16:16Z
CRIT

CVE-2026-74587 — Linux: In the Linux kernel, the following vulnerability has been resolved: sctp: fix use-after-free of

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74587

In the Linux kernel, the following vulnerability has been resolved: sctp: fix use-after-free of cached ASCONF chunk addip_last_asconf caches the outstanding outbound ASCONF chunk. The normal ASCONF-ACK completion path releases the chunk and clears the pointer. However, sctp_asconf_queue_teardown() releases the cached chunk without clearing addip_last_asconf. During peer restart handling, sctp_sf_do_dupcook_a() queues SCTP_CMD_PURGE_ASCONF_QUEUE, which invokes sctp_asconf_q CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
4w ago
2026-08-22 16:16Z
CRIT

CVE-2026-74586 — Linux: With an authenticated peer, the reproducer triggered the same KASAN report in 2 of

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74586

In the Linux kernel, the following vulnerability has been resolved: sctp: clear new_transport when removing a peer sctp_process_asconf_param() stores a newly added peer transport in asoc->new_transport. After all parameters in the ASCONF chunk have been processed, sctp_sf_do_asconf() uses this pointer to send a HEARTBEAT to the new transport. An authenticated ASCONF from a remote SCTP peer can add a transport and remove it again with a wildcard DEL-IP parameter in the same CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
4w ago
2026-08-22 16:16Z
CRIT

CVE-2026-4703 — Form: The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4703

The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.10.80 via deserialization of untrusted input from form submission meta values. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on CVSSv3.1 9.8 (CRITICAL)

CWECWE 502VNDFormTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
4w ago
2026-08-22 14:16Z
CRIT

CVE-2026-75870 — Punk: versions before 0.18 for Perl allow session cookie forgery via an empty default

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-75870

Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret. The session keyword freezes its options onto the application as given: it does not require a secret, warn, or refuse to start when one is absent. The cookie read and the write-back both default that key to the empty string, so a declaration with no secret option, or with an undefined or empty one, signs and verifies with a zero-length HMA CVSSv3.1 9.1 (CRITICAL)

CWECWE 1394VNDPunkTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
4w ago
2026-08-22 14:16Z
CRIT

CVE-2026-75866 — Punk: Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-75866

Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them. Punk::OAuth2::Server::Store registers scopes and grant_types per client and documents both as client registration. token dispatches on the grant_type in the request body, so a client registered for authorization_code alone can ask for client_credentials, and that arm passes the requested scope straight to the m CVSSv3.1 9.1 (CRITICAL)

CWECWE 862VNDPunkTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
4w ago
2026-08-22 14:16Z
HIGH

CVE-2026-71513 — NLTK: before 3.10.3 contains a remote code execution vulnerability in AllowlistUnpickler that validates only

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-71513

NLTK before 3.10.3 contains a remote code execution vulnerability in AllowlistUnpickler that validates only the pickle module string and not the global name, allowing attackers to resolve dotted names by attribute traversal to callables outside the allowlisted namespace. Attackers can craft untrusted transition-parser models that execute arbitrary commands when TransitionParser.parse loads the model through allowlisted_pickle_load. CVSSv3.1 8.8 (HIGH)

CWECWE 502VNDNltkTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
4w ago
2026-08-22 13:16Z
HIGH

CVE-2026-60084 — SiYuan: versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate endpoint

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-60084

SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate endpoint that accepts an unvalidated path parameter passed directly to os.RemoveAll. Authenticated admin attackers can supply absolute filesystem paths to recursively delete any file or directory the kernel process has permission to remove, anywhere on the host filesystem. CVSSv3.1 8.7 (HIGH)

CWECWE 22VNDSiyuanTYPVulnerability
8.7
CVSS v3.1
94
Edit Score
4w ago
2026-08-22 13:16Z
HIGH

CVE-2026-59808 — AVideo: through commit 9c39d8c8 contains an authentication bypass vulnerability where deduplicateByEncoderQueueId() returns video_id_hash credentials

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-59808

AVideo through commit 9c39d8c8 contains an authentication bypass vulnerability where deduplicateByEncoderQueueId() returns video_id_hash credentials for any video by encoder_queue_id without ownership verification, and useVideoHashOrLogin() converts this hash into passwordless login as the video owner. Attackers with upload permission can retrieve an administrator's video_id_hash by omitting the videos_id parameter, then use that hash in an unauthenticated request to gain adm CVSSv3.1 8.8 (HIGH)

CWECWE 306VNDAvideoTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
4w ago
2026-08-22 11:16Z
CRIT

CVE-2026-77946 — TRENDnet: Executing a manipulation of the argument system.ntp.server/system.ntp.enable_server/cameo.time.time_zone/cameo.cameo.syslog_server can lead to stack-based buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-77946

A vulnerability was determined in TRENDnet TEW-821DAP 2.2.01b05. Affected by this vulnerability is the function uci_safe_get of the file /cgi-bin/apply_time.cgi of the component NTP Timezone Configuration Handler. Executing a manipulation of the argument system.ntp.server/system.ntp.enable_server/cameo.time.time_zone/cameo.cameo.syslog_server can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utiliz CVSSv3.1 10.0 (CRITICAL)

CWECWE 121CWECWE 119VNDTrendnetTYPVulnerability
10.0
CVSS v3.1
100
Edit Score
4w ago
2026-08-22 09:16Z
CRIT

CVE-2026-78003 — Mailgun: The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF)

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-78003

The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the add_list() function, which accepts user-controlled array keys from $_POST['addresses'], passes them through sanitize_text_field(). This makes it possible for unauthenticated attackers to make authenticated POST requests to any Mailgun API endpoint using the WordPress sit CVSSv3.1 9.8 (CRITICAL)

CWECWE 918VNDMailgunTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
4w ago
2026-08-22 06:16Z
CRIT

CVE-2026-77002 — SmilePass: The SmilePass Selfie Login WordPress plugin through 1.0.2 does not perform any server-side verification

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-77002

The SmilePass Selfie Login WordPress plugin through 1.0.2 does not perform any server-side verification of the identity it is asked to authenticate, allowing unauthenticated users to log in as any registered account, including administrators. CVSSv3.1 9.8 (CRITICAL) · EPSS 4th percentile

CWECWE 287VNDSmilepassTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
4w ago
2026-08-22 06:16Z
CRIT

CVE-2026-77001 — Social: The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-77001

The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisation or nonce checks in one of its publicly accessible login handlers, allowing unauthenticated attackers to obtain a valid session as any existing user, including administrators. In the default case a session as the site's original administrator account is obtained without needing to know any account details at all. CVSSv3.1 9.8 (CRITICAL) · EPSS 9th percentile

CWECWE 287VNDSocialTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
4w ago
2026-08-22 06:16Z
CRIT

CVE-2026-77000 — Social: The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-77000

The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplying that user's email address. CVSSv3.1 9.8 (CRITICAL) · EPSS 4th percentile

CWECWE 287VNDSocialTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
4w ago
2026-08-22 06:16Z
HIGH

CVE-2026-76793 — Firebase: The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-76793

The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a session, allowing unauthenticated attackers to log in as any user, including administrators. CVSSv3.1 8.1 (HIGH) · EPSS 11th percentile

CWECWE 287VNDFirebaseTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
4w ago
2026-08-22 06:16Z
HIGH

CVE-2026-76789 — Slider: The Slider Hero with Video Background, Animation WordPress plugin before 9.1.3 does not have

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-76789

The Slider Hero with Video Background, Animation WordPress plugin before 9.1.3 does not have authorisation and nonce checks on two of its request handlers, and does not escape a stored setting before outputting it, allowing unauthenticated users to store malicious JavaScript which will be executed in the context of an administrator viewing the Slider Hero with Video Background, Animation WordPress plugin before 9.1.3's admin area, as well as any visitor of a page embedding a CVSSv3.1 8.8 (HIGH) · EPSS 8th percentile

CWECWE 79VNDSliderTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
4w ago
2026-08-22 06:16Z
HIGH

CVE-2026-18052 — ManageWP: The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-18052

The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an already used login link from being replayed, allowing attackers who obtain such a link to gain a session as any user on the site, including an administrator. CVSSv3.1 8.1 (HIGH) · EPSS 4th percentile

CWECWE 287VNDManagewpTYPVulnerability
8.1
CVSS v3.1
91
Edit Score