Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-09-23 16:53Z
2026-08-14
2026-08-14 12:16Z
HIGH

CVE-2026-72831 — Flex: The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect authorization

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72831

The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect authorization vulnerability in its Flex Objects API. FlexApiController::update() checks only the general Flex directory permission and does not apply the additional target/field/super-admin checks enforced by the dedicated Users and Groups API controllers. An authenticated account with api.access, admin.login, and users.update permissions (but without api.users.write or admin.super) can use CVSSv3.1 8.8 (HIGH) · EPSS 23th percentile

CWECWE 863VNDFlexTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-14
2026-08-14 12:16Z
HIGH

CVE-2026-72830 — Grav: API plugin versions before 1.0.13 fail to enforce API key scope caps in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72830

Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. The scope cap is applied only inside requirePermission(), while the scheduler and backups gates use a bare isSuperAdmin() check that never consults api_key_scopes. An attacker holding an API key scoped to api.config.write that was minted on a super account can therefore inject arbitrary commands into scheduler. CVSSv3.1 8.8 (HIGH) · EPSS 37th percentile

CWECWE 269VNDGravTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-14
2026-08-14 12:16Z
HIGH

CVE-2026-72829 — Grav: The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope-cap bypass in UsersController's

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72829

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope-cap bypass in UsersController's create() and update() methods. These methods enforce the scope cap only for api.users.write, but gate super-privilege grants on a bare isSuperAdmin() check that reads access.api.super directly without consulting the key's scopes. As a result, an api.users.write-scoped key minted on a super account can set access.api.super or assign a super-granting group to mi CVSSv3.1 8.8 (HIGH) · EPSS 23th percentile

CWECWE 269VNDGravTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-14
2026-08-14 12:16Z
HIGH

CVE-2026-72827 — Grav: CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72827

Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute arbitrary operating-system commands. Attackers can inject Twig payloads using the unsandboxed find filter in email subject, body, to, or from fields to achieve remote code execution when forms are submitted. CVSSv3.1 8.8 (HIGH) · EPSS 39th percentile

CWECWE 1336VNDGravTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-14
2026-08-14 12:16Z
CRIT

CVE-2026-72826 — An attacker holding a minimal-scope API key on a super account can submit an

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72826

The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. The self-target path of requireApiKeyPermission() requires only the baseline api.access scope, and the new key's scopes are read directly from the request body with no subset check. An attacker holding a minimal-scope API key on a super account can submit an empty scopes array to mint an unscoped, full-access super CVSSv3.1 9.8 (CRITICAL) · EPSS 23th percentile

CWECWE 266TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-14
2026-08-14 12:16Z
HIGH

CVE-2026-72824 — Grav: The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API key scope-cap bypass in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72824

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API key scope-cap bypass in PagesController::guardTwigContent(). The Twig-toggle check uses a bare isSuperAdmin() gate that does not consult api_key_scopes, so a least-privilege API key scoped only to api.pages.write and minted on a super account can enable process.twig on a page save even though admin.pages_twig is intentionally outside the api.pages scope. When security.twig_content.process_enabled=true CVSSv3.1 8.8 (HIGH) · EPSS 39th percentile

CWECWE 862VNDGravTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-14
2026-08-14 12:16Z
HIGH

CVE-2026-72822 — Composer: The getgrav/grav-plugin-api Composer package before 1.0.13 (affected <= 1.0.12) fails to enforce API key

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72822

The getgrav/grav-plugin-api Composer package before 1.0.13 (affected <= 1.0.12) fails to enforce API key scope caps on the disable2fa endpoint. Unlike the sibling generate2fa endpoint, disable2fa authorizes the admin (non-self) path solely via ACL reads (isSuperAdmin/hasPermission) and never invokes requirePermission(), so the api_key_scopes cap is never applied. As a result, a holder of a narrow-scope API key on a super account, or a non-super account whose ACL includes api. CVSSv3.1 8.8 (HIGH) · EPSS 28th percentile

CWECWE 306VNDComposerTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-08-14
2026-08-14 12:16Z
HIGH

CVE-2026-72819 — Grav: CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72819

Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead of string notation, call the unZip routine with a malicious archive, and write PHP files to the web root for execution. CVSSv3.1 8.8 (HIGH) · EPSS 41th percentile

CWECWE 94VNDGravTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-14
2026-08-14 12:16Z
CRIT

CVE-2026-72811 — SiYuan: versions <= v3.7.2 contain a SQL injection vulnerability in the backlink/mention search query

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72811

SiYuan versions <= v3.7.2 contain a SQL injection vulnerability in the backlink/mention search query (kernel/model/backlink.go), which concatenates stored block metadata (title, name, alias, anchor text) and the client-supplied keyword into a SQL MATCH/search statement while escaping only the double-quote character and not the single quote. A single quote in the client keyword (first-order, reachable by an anonymous or RoleReader user on the publish surface) or in stored docu CVSSv3.1 10.0 (CRITICAL)

CWECWE 89VNDSiyuanTYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2026-08-14
2026-08-14 12:16Z
HIGH

CVE-2026-72810 — SiYuan: versions before v3.7.4 contain a publish-boundary bypass vulnerability in WebSocket broadcast sessions that

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72810

SiYuan versions before v3.7.4 contain a publish-boundary bypass vulnerability in WebSocket broadcast sessions that allows anonymous readers to receive unfiltered edits. Attackers can establish a WebSocket connection to the publish surface and passively receive real-time content events including password-protected and forbidden documents without authentication. CVSSv3.1 8.6 (HIGH) · EPSS 24th percentile

CWECWE 862VNDSiyuanTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-08-14
2026-08-14 11:16Z
HIGH

CVE-2026-19821 — Tenda: This manipulation of the argument rebootTime causes buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-19821

A vulnerability was determined in Tenda AC12 15.03.06.23_multi_TD01. This vulnerability affects the function formSetRebootTimer of the file /goform/SetSysAutoRebbotCfg of the component httpd web management interface. This manipulation of the argument rebootTime causes buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. CVSSv3.1 8.8 (HIGH) · EPSS 38th percentile

CWECWE 120CWECWE 119VNDTendaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-14
2026-08-14 09:00Z
CRIT

APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

Kaspersky Securelist·securelist.comin the wild

Kaspersky disclosed a major evolution of the CoolClient backdoor used by HoneyMyte (Mustang Panda) APT group, now featuring a signed kernel-mode Windows rootkit driver (msagent.sys) that hides processes, files, and registry entries. The malware employs multi-stage execution via DLL sideloading of a legitimate Sangfor application, UAC bypass via RPC-based process creation with PPID spoofing, and direct IOCTL communication between user-mode and kernel-mode components. Active exploitation observed across Asia (Pakistan, Mongolia, Myanmar) with PlugX used as initial access vector.

SRFApplicationSRFOsTACTA0005TACTA0002TACTA0003OSWindowsSWCoolclientSWPlugx
88
Edit Score
2026-08-14
2026-08-14 07:16Z
HIGH

CVE-2026-19811 — The manipulation of the argument Comment results in stack-based buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-19811

A security flaw has been discovered in TOTOLINK A800R 4.1.2cu.5137_B20200730. The impacted element is the function setIpQosRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. The manipulation of the argument Comment results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. CVSSv3.1 8.8 (HIGH) · EPSS 38th percentile

CWECWE 121CWECWE 119TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-14
2026-08-14 07:08Z
CRIT

You’re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?))

watchTowr Labs·labs.watchtowr.comCVE-2026-8452

watchTowr Labs disclosed a pre-authentication heap overflow in Citrix NetScaler ADC/Gateway that achieves remote code execution via malicious SAML SignedInfo canonicalization. The vulnerability exists in the nsppe packet-processing engine when processing oversized PrefixList attributes in XML exclusive canonicalization, allowing an attacker to overflow a fixed-size buffer, corrupt adjacent chunk metadata, and gain a write-what-where primitive. Affected versions include NetScaler 14.1 before 14.1-72.61 and 13.1 before 13.1-63.18; the vulnerability is reachable when SAML is configured as either Service Provider or Identity Provider.

SRFApplicationTACTA0002SRFNetwork ApplianceSWNetscalerVNDCitrixTYPResearchTYPVulnerabilitySTGExecution
92
Edit Score
2026-08-14
2026-08-14 06:17Z
HIGH

CVE-2026-18039 — Essential: The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied registration

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-18039

The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied registration fields from overwriting reserved account attributes, allowing unauthenticated attackers to register an account with an arbitrary role, including administrator, on sites where a custom profile field with a particular label has been configured. CVSSv3.1 8.1 (HIGH)

CWECWE 269VNDEssentialTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-08-14
2026-08-14 06:16Z
HIGH

CVE-2026-15205 — Paymob: This allows unauthenticated attackers to perform SQL injection and read arbitrary data from the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-15205

The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows unauthenticated attackers to perform SQL injection and read arbitrary data from the database — including user credentials and other secrets — through both in-band (reflected) and time-based b CVSSv3.1 8.6 (HIGH)

CWECWE 89VNDPaymobTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-08-14
2026-08-14 04:16Z
HIGH

CVE-2026-19788 — Tenda: The manipulation of the argument devName results in stack-based buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-19788

A vulnerability was found in Tenda AC1206 15.03.06.23_multi_TD01. This affects the function set_device_name of the file /goform/SetOnlineDevName of the component httpd web management interface. The manipulation of the argument devName results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used. CVSSv3.1 8.8 (HIGH) · EPSS 38th percentile

CWECWE 121CWECWE 119VNDTendaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-13
2026-08-13 22:27Z
INFO

v9.6.0-rc4

BloodHound releases·github.comCVE-2026-67213

BloodHound v9.6.0-rc4 release candidate includes dependency updates addressing XSS vulnerabilities in dompurify (3.4.13) and a CVE in nanoid (3.3.18), plus schema improvements for the Support Bundle OpenAPI endpoint.

SWBloodhoundVNDSpecteropsTYPTool
28
Edit Score
2026-08-13
2026-08-13 22:17Z
CRIT

CVE-2026-73843 — OpenChoreo: Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-73843

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/ and /api/exec/ operations, proxy the data-plane Kubernetes API, and execute commands in workload pods in multi-cluster deployments. This issue is fixed in versions 1.0.2 and 1.1.2. CVSSv3.1 9.6 (CRITICAL) · EPSS 21th percentile

CWECWE 862CWECWE 306CWECWE 668VNDOpenchoreoTYPVulnerability
9.6
CVSS v3.1
98
Edit Score
2026-08-13
2026-08-13 22:17Z
CRIT

CVE-2026-73842 — OpenChoreo: Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-73842

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any network-reachable caller to read tenant Kubernetes Secrets, mutate workloads, and execute commands across connected data planes. This issue is fixed in versions 1.0.3, 1.1.3, and 1.2.0-rc.2. CVSSv3.1 9.0 (CRITICAL) · EPSS 8th percentile

CWECWE 862CWECWE 269CWECWE 306VNDOpenchoreoTYPVulnerability
9.0
CVSS v3.1
95
Edit Score
2026-08-13
2026-08-13 22:17Z
HIGH

CVE-2026-73841 — OpenChoreo: Prior to 1.1.6 and 1.2.3, internal/openchoreo-api/api/handlers/exec.go and internal/openchoreo-api/api/handlers/wirelogs.go authorize component:exec and wirelogs:view usin

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-73841

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.1.6 and 1.2.3, internal/openchoreo-api/api/handlers/exec.go and internal/openchoreo-api/api/handlers/wirelogs.go authorize component:exec and wirelogs:view using the caller-supplied project query parameter instead of comp.Spec.Owner.ProjectName, allowing a user with a project-scoped grant to execute commands in and read wirelogs from components owned by other projects in the same namespace. Th CVSSv3.1 8.8 (HIGH) · EPSS 28th percentile

CWECWE 639CWECWE 863VNDOpenchoreoTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-13
2026-08-13 22:17Z
HIGH

CVE-2026-73667 — OpenChoreo: Prior to 1.0.4, 1.1.4, and 1.2.0-rc.2, OpenChoreo Workflow Plane templates under samples/getting-started/workflow-templates/ interpolated developer-controlled

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-73667

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.0-rc.2, OpenChoreo Workflow Plane templates under samples/getting-started/workflow-templates/ interpolated developer-controlled workflow parameters into shell program text executed through sh -c instead of passing the values through container.env, allowing arbitrary commands to run in workflow pods while affected privileged Podman templates lacked hostUsers: false. This iss CVSSv3.1 8.8 (HIGH) · EPSS 47th percentile

CWECWE 78VNDOpenchoreoTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-13
2026-08-13 22:17Z
HIGH

CVE-2026-73666 — OpenChoreo: Prior to 1.0.4, 1.1.4, and 1.2.1, the OpenChoreo Backstage backend hardcoded backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOuts

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-73666

OpenChoreo is a developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.1, the OpenChoreo Backstage backend hardcoded backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDevelopment to true, exposing /api/* without authentication and allowing unauthenticated catalog reads, scaffolder log reads, and catalog location creation or deletion. This issue is fixed in versions 1.0.4, 1.1.4, and 1.2.1. CVSSv3.1 8.2 (HIGH) · EPSS 40th percentile

CWECWE 306VNDOpenchoreoTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-08-13
2026-08-13 22:17Z
HIGH

CVE-2026-73659 — Trigger: From 4.4.2 until 4.5.0, the packet presign routes in apps/webapp/app/routes/api.v1.packets.$.ts pass a caller-controlled filename

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-73659

Trigger.dev is the open-source platform for building AI workflows in TypeScript. From 4.4.2 until 4.5.0, the packet presign routes in apps/webapp/app/routes/api.v1.packets.$.ts pass a caller-controlled filename through resolveStoreProtocolForPacketPresign to generatePresignedUrl and generatePresignedRequest in apps/webapp/app/v3/objectStore.server.ts, allowing .. traversal to escape the packets/<projectRef>/<env>/ object-store prefix and enabling a project API key to read or CVSSv3.1 8.1 (HIGH) · EPSS 27th percentile

CWECWE 22VNDTriggerTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-08-13
2026-08-13 22:17Z
HIGH

CVE-2026-73658 — Trigger: From 4.4.2 until 4.5.0-rc.5, Aws4FetchClient.buildUrl() and Aws4FetchClient.presign() in apps/webapp/app/v3/objectStoreClient.server.ts assign user-controlled packet keys to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-73658

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5, Aws4FetchClient.buildUrl() and Aws4FetchClient.presign() in apps/webapp/app/v3/objectStoreClient.server.ts assign user-controlled packet keys to URL.pathname, while apps/webapp/app/routes/api.v1.packets.$.ts accepts params["*"] without rejecting dot segments and uses findResource: async () => 1 without per-resource ownership validation. WHATWG path normaliz CVSSv3.1 8.2 (HIGH) · EPSS 26th percentile

CWECWE 862CWECWE 22CWECWE 20VNDTriggerTYPVulnerability
8.2
CVSS v3.1
91
Edit Score