Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-09-23 01:08Z
2026-08-17
2026-08-17 22:17Z
CRIT

CVE-2026-71424 — Onyx: Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/{persona_id} endpoints expose

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-71424

Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/{persona_id} endpoints expose another user's OAuth Authorization header because OnyxTokenStorage.set_tokens and OnyxTokenStorage.set_client_info in backend/onyx/server/features/mcp/api.py copy per-user tokens into a shared admin MCPConnectionConfig row and _db_mcp_server_to_api_mcp_server returns that row through auth_template.headers to any BAS CVSSv3.1 9.6 (CRITICAL)

CWECWE 863CWECWE 200VNDOnyxTYPVulnerability
9.6
CVSS v3.1
98
Edit Score
2026-08-17
2026-08-17 22:17Z
CRIT

CVE-2026-67960 — PbootCMS: An issue in PbootCMS v.3.2.15 allows an attacker to execute arbitrary code via the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-67960

An issue in PbootCMS v.3.2.15 allows an attacker to execute arbitrary code via the MemberController.php, UserController.php, CommentController.php, ContentController.php, and helper.php components CVSSv3.1 9.8 (CRITICAL) · EPSS 33th percentile

CWECWE 94VNDPbootcmsTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-17
2026-08-17 22:17Z
CRIT

CVE-2026-67868 — A heap-based out-of-bounds write vulnerability exists in S2OPC 1.7.3 in server-side EventFilter handling during

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-67868

A heap-based out-of-bounds write vulnerability exists in S2OPC 1.7.3 in server-side EventFilter handling during CreateMonitoredItems processing. This allows a remote attacker to execute arbitrary code. CVSSv3.1 9.8 (CRITICAL)

CWECWE 122TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-17
2026-08-17 22:17Z
CRIT

CVE-2026-67854 — SQL: Injection vulnerability in Qcms v.6.0.6 allows a remote attacker to execute arbitrary code

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-67854

SQL Injection vulnerability in Qcms v.6.0.6 allows a remote attacker to execute arbitrary code CVSSv3.1 9.8 (CRITICAL)

CWECWE 89TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-17
2026-08-17 22:17Z
HIGH

CVE-2026-65346 — Apple Ipados: An integer overflow was addressed with improved input validation.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-65346

An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing an image may lead to arbitrary code execution. CVSSv3.1 8.8 (HIGH)

CWECWE 190VNDAppleTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-17
2026-08-17 22:17Z
CRIT

CVE-2026-64849 — MLflow: Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64849

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive CVSSv3.1 9.3 (CRITICAL)

CWECWE 918VNDMlflowTYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2026-08-17
2026-08-17 22:17Z
HIGH

CVE-2026-56677 — 9Router is an AI router & token saver.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-56677

9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery() in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing unauthenticated attackers when dashboard login is disabled to scan internal services and reflect OIDC discovery fields including token_endpoint and jwks_uri. CVSSv3.1 8.6 (HIGH)

CWECWE 306CWECWE 918TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-08-17
2026-08-17 22:17Z
CRIT

CVE-2026-51977 — Trueview: An issue in Trueview T18061 WiFi 3MP Robot Pan-Tilt Security Camera Version 1.0 allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-51977

An issue in Trueview T18061 WiFi 3MP Robot Pan-Tilt Security Camera Version 1.0 allows a physically proximate attacker to escalate privileges via the RSA private key component CVSSv3.1 9.1 (CRITICAL) · EPSS 21th percentile

CWECWE 321VNDTrueviewTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-08-17
2026-08-17 22:17Z
HIGH

CVE-2026-45790 — Dokploy: Prior to 0.29.6, Dokploy's organization.inviteMember tRPC procedure in apps/dokploy/server/api/routers/organization.ts allows a user with member:create

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-45790

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's organization.inviteMember tRPC procedure in apps/dokploy/server/api/routers/organization.ts allows a user with member:create permission to invite an account with the owner role, while packages/server/src/services/user.ts allows a privileged self-hosted user to create an account with an arbitrary role, enabling permanent organization takeover because owner roles cannot be demoted. This is CVSSv3.1 8.0 (HIGH)

CWECWE 269VNDDokployTYPVulnerability
8.0
CVSS v3.1
90
Edit Score
2026-08-17
2026-08-17 22:17Z
HIGH

CVE-2026-43794 — Apple Safari: A memory corruption issue was addressed with improved memory handling.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-43794

A memory corruption issue was addressed with improved memory handling. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to memory corruption. CVSSv3.1 8.8 (HIGH)

CWECWE 119VNDAppleTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-17
2026-08-17 22:17Z
CRIT

CVE-2026-42163 — Mahara: before 25.04.5 and 26.04.0 is vulnerable to unauthorized access to internal accounts via

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-42163

Mahara before 25.04.5 and 26.04.0 is vulnerable to unauthorized access to internal accounts via Learning Tools Interoperability (LTI) under certain circumstances. This applies to LTI 1.1 and LTI 1.3 Advantage. CVSSv3.1 9.8 (CRITICAL) · EPSS 26th percentile

CWECWE 284VNDMaharaTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-17
2026-08-17 21:16Z
HIGH

CVE-2026-75481 — SkyPilot: fails to validate that authenticated users are entitled to grant administrator roles when

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-75481

SkyPilot fails to validate that authenticated users are entitled to grant administrator roles when updating service account permissions. Attackers can create a service account, escalate it to administrator role, and authenticate with its bearer token to gain administrative control over all users and workspaces. CVSSv3.1 8.8 (HIGH)

CWECWE 269VNDSkypilotTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-17
2026-08-17 21:16Z
CRIT

CVE-2026-75110 — MemOS: In deployments where authentication is enabled (AUTH_ENABLED=true) but the undocumented, defaultless INTERNAL_SERVICE_SECRET environment variable

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-75110

MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is enabled (AUTH_ENABLED=true) but the undocumented, defaultless INTERNAL_SERVICE_SECRET environment variable is unset, the is_internal_request() check in src/memos/api/middleware/auth.py fails open: os.getenv("INTERNAL_SERVICE_SECRET") returns None and a request omitting the X-Internal-Service header also yields None, so the comparison None == None evaluates true. The request is th CVSSv3.1 9.8 (CRITICAL)

CWECWE 697VNDMemosTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-17
2026-08-17 21:16Z
CRIT

CVE-2026-75106 — OpnForm: derives editable-submission secrets from sequential row identifiers using Hashids with an empty default

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-75106

OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticated attackers to compute hashes for any submission. Attackers can read other respondents' full submission data through the submission-fetch endpoint or overwrite submissions by supplying predicted hashes to the answer endpoint. CVSSv3.1 9.1 (CRITICAL)

CWECWE 340VNDOpnformTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-08-17
2026-08-17 21:16Z
HIGH

CVE-2026-75103 — Crawlab: Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-75103

Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account takeover and arbitrary code execution. CVSSv3.1 8.8 (HIGH)

CWECWE 639VNDCrawlabTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-17
2026-08-17 21:16Z
HIGH

CVE-2026-73410 — Budibase: Prior to 3.40.0, packages/backend-core/src/utils/outboundFetch.ts pinned a validated address through a Node agent, but the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-73410

Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outboundFetch.ts pinned a validated address through a Node agent, but the REST integration used getDispatcher from packages/backend-core/src/utils/fetch.ts, causing undici to ignore that agent and resolve the hostname again. A builder could use DNS rebinding to make packages/server/src/integrations/rest.ts connect to an internal address after a public address passed validation, with CVSSv3.1 8.5 (HIGH)

CWECWE 918CWECWE 367VNDBudibaseTYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2026-08-17
2026-08-17 21:16Z
CRIT

CVE-2026-67967 — Buffer: Overflow vulnerability in Tenda W20E V16.01.0.6(2782) allows an attacker to execute arbitrary code.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-67967

Buffer Overflow vulnerability in Tenda W20E V16.01.0.6(2782) allows an attacker to execute arbitrary code. This is an incomplete fix for CVE-2025-44867 and CVE-2026-36819 CVSSv3.1 9.8 (CRITICAL)

CWECWE 121VNDBufferTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-17
2026-08-17 21:16Z
CRIT

CVE-2026-67966 — Tenda: W20E V16.01.0.6(2782) /goform/telnet endpoint allows unauthenticated remote attackers to activate the Telnet daemon

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-67966

Tenda W20E V16.01.0.6(2782) /goform/telnet endpoint allows unauthenticated remote attackers to activate the Telnet daemon and obtain root shell access. CVSSv3.1 9.8 (CRITICAL)

CWECWE 306VNDTendaTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-17
2026-08-17 21:16Z
CRIT

CVE-2026-67965 — Tneda: An issue in Tneda W20E v.16.01.0.6(2782) allows a remote attacker to execute arbitrary code

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-67965

An issue in Tneda W20E v.16.01.0.6(2782) allows a remote attacker to execute arbitrary code via the url_need_login function CVSSv3.1 9.8 (CRITICAL)

CWECWE 78VNDTnedaTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-17
2026-08-17 21:16Z
CRIT

CVE-2026-67926 — JeecgBoot: An issue in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-67926

An issue in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the files Parameter in JeecgBoot AI Chat Module CVSSv3.1 9.8 (CRITICAL)

CWECWE 94VNDJeecgbootTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-17
2026-08-17 21:16Z
CRIT

CVE-2026-67917 — zuraCast versions up to and including 0.23.7 contain a SQL injection vulnerability in the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-67917

zuraCast versions up to and including 0.23.7 contain a SQL injection vulnerability in the backup restore functionality. The `azuracast:restore` command executes the `db.sql` file extracted from a backup archive without any content validation or sanitization. This allows a remote attacker to escalate privileges CVSSv3.1 9.8 (CRITICAL)

CWECWE 89TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-17
2026-08-17 21:16Z
CRIT

CVE-2026-66795 — The Certificate Signing Request (CSR) auto-approval logic improperly validates incoming CSRs, specifically by not

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-66795

A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allows a privileged service account on a spoke cluster to submit a malicious CSR. Successful exploitation can lead to privilege escalation, enabling the attacker to obtain administrative credentials on the hub cluster. CVSSv3.1 9.1 (CRITICAL)

CWECWE 295TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-08-17
2026-08-17 21:16Z
CRIT

CVE-2026-65974 — ERPNext: Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a permission boundary in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-65974

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a permission boundary in Frappe safe execution because frappe.render_template is exposed without forcing restrict_globals, allowing server-side template injection and remote code execution. This issue is fixed in versions 15.111.0 and 16.22.0. CVSSv3.1 9.9 (CRITICAL)

CWECWE 1336VNDErpnextTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-08-17
2026-08-17 21:16Z
HIGH

CVE-2026-65832 — Deskflow: Prior to continuous build 1.26.0.299, a remote unauthenticated Deskflow server can send kMsgDSetOptions (DSOP)

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-65832

Deskflow is a keyboard and mouse sharing app. Prior to continuous build 1.26.0.299, a remote unauthenticated Deskflow server can send kMsgDSetOptions (DSOP) values to ServerProxy::setOptions() in src/lib/client/ServerProxy.cpp so that the value following a modifier option poisons m_modifierTranslationTable, after which ServerProxy::translateKey() or ServerProxy::translateModifierMask() indexes the seven-row s_translationTable or s_masks arrays out of bounds, disclosing four b CVSSv3.1 8.2 (HIGH)

CWECWE 125CWECWE 129VNDDeskflowTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-08-17
2026-08-17 21:16Z
HIGH

CVE-2026-65640 — WordPress: is vulnerable to a remote code execution vulnerability via malicious Postscript file upload

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-65640

WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: * Imagick and Ghostscript in use on the server * A malicious user with the `upload_files` capability This issue affects all versions of WordPress. Version 7.0.4 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7. CVSSv3.1 8.8 (HIGH)

CWECWE 434VNDWordpressTYPVulnerability
8.8
CVSS v3.1
94
Edit Score