Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-09-14 06:01Z
4d ago
2026-09-09 15:17Z
HIGH

CVE-2026-87823 — zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-87823

zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MIN_VALUE to read unmapped memory, causing JVM termination or extracting arbitrary frame size data from unintended memory locations. CVSSv3.1 8.2 (HIGH)

CWECWE 190TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
4d ago
2026-09-09 14:17Z
HIGH

CVE-2026-86775 — knowns (npm package) versions <= 0.29.1 contain a path traversal vulnerability in the Document

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-86775

knowns (npm package) versions <= 0.29.1 contain a path traversal vulnerability in the Document API. The HTTP handler in internal/server/routes/docs.go normalizes the user-supplied document path with cleanDocPath(), which strips leading/trailing slashes and the .md suffix but does not neutralize ../ traversal sequences, and internal/storage/doc_store.go then builds the target path with filepath.Join(ds.docsDir(), filepath.FromSlash(doc.Path)+".md") without verifying that the r CVSSv3.1 8.6 (HIGH)

CWECWE 22TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
4d ago
2026-09-09 14:17Z
HIGH

CVE-2026-86770 — Snipe: Attackers can exploit the default utf8mb4_unicode_ci database collation to bypass username matching and achieve

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-86770

Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowing attackers to authenticate as different users by registering IdP accounts with accent or case variants of victim usernames. Attackers can exploit the default utf8mb4_unicode_ci database collation to bypass username matching and achieve account takeover through federated login paths including SAML, LDAP, and OAuth. CVSSv3.1 8.1 (HIGH)

CWECWE 178VNDSnipeTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
4d ago
2026-09-09 14:17Z
HIGH

CVE-2026-86762 — Snipe: Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the `api` middleware group

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-86762

Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the `api` middleware group in app/Http/Kernel.php, and deactivating a user does not revoke that user's Passport personal access tokens. As a result, although a deactivated account is correctly refused at web login, its existing API token continues to authenticate and to grant read and write access to the REST API (assets, users, licenses, etc.) at the account's prior permission level until the token e CVSSv3.1 8.1 (HIGH)

CWECWE 862VNDSnipeTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
4d ago
2026-09-09 14:17Z
HIGH

CVE-2026-86751 — Snipe: Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-86751

Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary server files and issue server-side HTTP requests. Attackers can submit markdown image syntax in checkout acceptance notes that survive HTML escaping, are expanded by CommonMark parser, and resolved by laravel-mail-auto-embed via file_get_contents or curl, exfiltrating sensitive files like .env containing APP_KEY. CVSSv3.1 8.5 (HIGH)

CWECWE 73VNDSnipeTYPVulnerability
8.5
CVSS v3.1
93
Edit Score
4d ago
2026-09-09 14:17Z
HIGH

CVE-2026-86741 — Snipe: Attackers with low-privilege permissions can inject markdown image syntax or raw HTML img tags

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-86741

Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in checkout confirmation emails. Attackers with low-privilege permissions can inject markdown image syntax or raw HTML img tags pointing to local files or remote URLs, which the mail auto-embed library resolves server-side and returns as email attachments, exfiltrating sensitive files like .env credentials and enabling SSRF attacks. CVSSv3.1 8.5 (HIGH)

CWECWE 73VNDSnipeTYPVulnerability
8.5
CVSS v3.1
93
Edit Score
4d ago
2026-09-09 14:17Z
HIGH

CVE-2026-86099 — Chainlit: through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-86099

Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by injecting absolute or relative path sequences. Attackers can craft malicious sessionId values that escape the upload directory and recursively delete arbitrary directories accessible to the service process. CVSSv3.1 8.2 (HIGH)

CWECWE 22VNDChainlitTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
728 × 90 / responsive · programmatic ad slot
4d ago
2026-09-09 14:17Z
HIGH

CVE-2026-56711 — VLC: media player computes the size of a picture buffer with 32-bit arithmetic and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-56711

VLC media player computes the size of a picture buffer with 32-bit arithmetic and allocates from the wrapped result. In AllocatePicture in src/misc/picture.c the running total is accumulated as i_bytes += p->i_pitch * p->i_lines, and both plane_t fields are declared int in include/vlc_picture.h, so the multiplication is evaluated at 32 bits and wraps before it is widened to the size_t accumulator. The overflow check that precedes it divides in 64-bit arithmetic and therefore CVSSv3.1 8.8 (HIGH)

CWECWE 787CWECWE 190VNDVlcTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
4d ago
2026-09-09 13:20Z
CRIT

CVE-2026-85103 — A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-85103

A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems. CVSSv3.1 9.8 (CRITICAL)

CWECWE 122TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
4d ago
2026-09-09 13:20Z
CRIT

CVE-2026-85102 — VPN: Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-85102

Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway. CVSSv3.1 9.8 (CRITICAL)

CWECWE 295VNDVpnTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
4d ago
2026-09-09 12:17Z
HIGH

CVE-2026-87817 — GitPython: Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-87817

GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository. CVSSv3.1 8.8 (HIGH)

CWECWE 94VNDGitpythonTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
4d ago
2026-09-09 12:17Z
HIGH

CVE-2026-87815 — SiYuan: versions before v3.8.2 contain a path traversal vulnerability in the /api/riff/removeRiffDeck endpoint that

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-87815

SiYuan versions before v3.8.2 contain a path traversal vulnerability in the /api/riff/removeRiffDeck endpoint that fails to validate the deckID parameter. An authenticated administrator can supply path traversal sequences to delete arbitrary .deck and .cards files outside the workspace directory. CVSSv3.1 8.7 (HIGH)

CWECWE 73VNDSiyuanTYPVulnerability
8.7
CVSS v3.1
94
Edit Score
4d ago
2026-09-09 12:17Z
CRIT

CVE-2026-80172 — Dell: SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80172

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Verification of Data Authenticity vulnerability. An unauthenticated attacker with remote access could exploit this, leading to unauthorized access. This vulnerability is considered critical as an unauthenticated attacker can repeatedly reuse a captured request to generate ADMIN access and refresh tokens. Since there is no nonce validation or CVSSv3.1 9.8 (CRITICAL)

CWECWE 345VNDDellTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
4d ago
2026-09-09 12:00Z
CRIT

Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows

Volexity·volexity.comCVE-2026-85046CVE-2026-87491CVE-2026-85880in the wild0day

Volexity disclosed a coordinated campaign by Chinese threat actors UTA0560 and JungleBamboo exploiting a chained 0-day vulnerability chain affecting Chrome (CVE-2026-85046, CVE-2026-87491) and Windows kernel (CVE-2026-85880). The exploit chain, delivered via spear-phishing with XSS-abused legitimate websites, achieves sandbox escape and privilege escalation to deploy distinct post-exploitation malware (GRIMWEDGE and LONGTALE). The vulnerabilities were patched upstream in Chromium but not yet released in Chrome, creating an effective 0-day window that both threat actors exploited within days of development completion.

SRFOsTACTA0005TACTA0001TACTA0002TACTA0006SRFBrowserSWChromeVNDMicrosoft
95
Edit Score
4d ago
2026-09-09 11:17Z
CRIT

CVE-2026-85978 — An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-85978

An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization discrepancy between the authentication filter and the servlet dispatcher allows a crafted request to bypass authentication and reach an endpoint that evaluates attacker-supplied script code without sandboxing, resulting in arbitrary code execution. Exploitation requires no authentication or user interaction. CVSSv3.1 9.8 (CRITICAL)

CWECWE 94CWECWE 863CWECWE 41TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
4d ago
2026-09-09 11:17Z
HIGH

CVE-2026-73334 — Potential: This package enables users to encrypt Parquet files via an envelope encryption mechanism that

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-73334

Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. This package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps (encrypts) data keys via a Key Management Service (KMS).  On the reader side, the KMS URL can be application-controlled or file-controlled. If the user does not leverage application control for this parameter, a file-controlled KMS URL is forwarded to a plugg CVSSv3.1 8.1 (HIGH)

CWECWE 20VNDPotentialTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
4d ago
2026-09-09 11:17Z
HIGH

CVE-2026-65181 — Data: Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-65181

Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and create a table to execute arbitrary Java code. Users are recommended to upgrade to version 4.5.2, which fixes this issue. CVSSv3.1 8.1 (HIGH)

CWECWE 913TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
4d ago
2026-09-09 11:17Z
HIGH

CVE-2026-57866 — Server: side request forgery in Apache Impala versions 4.4.x and 4.5.x.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-57866

Server side request forgery in Apache Impala versions 4.4.x and 4.5.x.  Authenticated Impala users with permissions to execute the ai_generate_text() function can exfiltrate secrets provided by the credential providers configured in the `hadoop.security.credential.provider.path` property of `core-site.xml`. The secret's key must be known to the user. CVSSv3.1 8.8 (HIGH)

CWECWE 918TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
4d ago
2026-09-09 11:17Z
CRIT

CVE-2026-56207 — Signature: of Bearer token is not verified in last step of SAML2 authentication for

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-56207

Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as another user. This issue affects Apache Impala: >=4.0.0. Users are recommended to upgrade to version 4.5.2, which fixes this issue. CVSSv3.1 9.8 (CRITICAL)

CWECWE 347TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
4d ago
2026-09-09 11:17Z
CRIT

CVE-2026-41871 — Authorization: Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-41871

Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Nutch Server (Nutch REST API). This issue affects Apache Nutch: from 1.10 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. If an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only. Please, also visit the Apache Nutch security advisori CVSSv3.1 9.8 (CRITICAL)

CWECWE 862CWECWE 470TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
4d ago
2026-09-09 11:17Z
HIGH

CVE-2026-41870 — Authorization: Missing Authorization, Improper Control of Generation of Code ('Code Injection'), Improper Control of Dynamically-Managed

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-41870

Missing Authorization, Improper Control of Generation of Code ('Code Injection'), Improper Control of Dynamically-Managed Code Resources, Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Nutch Server (Nutch REST API). This issue affects Apache Nutch: from 1.11 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. If an upgrade is not possible, user must restrict access t CVSSv3.1 8.8 (HIGH)

CWECWE 94CWECWE 862CWECWE 913CWECWE 470TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
4d ago
2026-09-09 11:17Z
CRIT

CVE-2026-41869 — Authorization: Missing Authorization, Improper Resource Shutdown and Job Interruption vulnerability in Apache Nutch Server (Nutch

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-41869

Missing Authorization, Improper Resource Shutdown and Job Interruption vulnerability in Apache Nutch Server (Nutch REST API). This issue affects Apache Nutch: from 1.10 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. If an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only. Please, also visit the Apache Nutch security advisories https://nutch.apache.org/documen CVSSv3.1 9.1 (CRITICAL)

CWECWE 862CWECWE 404TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
4d ago
2026-09-09 11:00Z
HIGH

A “proof” of Fermat’s Last Theorem that fits the margin

Trail of Bits·blog.trailofbits.com

Trail of Bits discovered a critical bug in Lean 4 (up to v4.33.1) affecting String.Pos.Raw.extract, where a mismatch between the logical definition and compiled native code allows extraction of astronomically-positioned substrings to return the entire string instead of empty, enabling proof of false statements. The bug was patched in v4.34.0-rc1 within hours of disclosure, but highlights a soundness risk in theorem provers when native code evaluation diverges from logical semantics.

SRFApplicationSWLeanVNDAnthropicTYPVulnerabilitySTGDefense EvasionEXPType ConfusionSTApatched
72
Edit Score
4d ago
2026-09-09 10:22Z
HIGH

CVE-2026-87795 — zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-87795

zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashes. CVSSv3.1 8.2 (HIGH)

CWECWE 125TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
4d ago
2026-09-09 10:22Z
HIGH

CVE-2026-87794 — bestzip versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in the nativeZip function

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-87794

bestzip versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in the nativeZip function that allows attackers to inject arbitrary arguments to the Info-ZIP backend. Attackers can supply a malicious destination path combined with crafted source entries to execute arbitrary commands with Node.js process privileges. Fixed in 2.2.7 and 3.0.3. CVSSv3.1 8.4 (HIGH)

CWECWE 88TYPVulnerability
8.4
CVSS v3.1
92
Edit Score