Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-09-25 11:27Z
2026-08-12
2026-08-12 20:17Z
CRIT

CVE-2026-63296 — LXD: An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63296

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration. When migrating an instance to a target project, LXD accepts configuration overrides without validating the new configuration against the target project's enforced restrictions. An attacker can exploit this flaw to move instances with disallowed high-privilege configurations into restricted projects, bypassing security controls. CVSSv3.1 9.9 (CRITICAL)

CWECWE 863VNDLxdTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-08-12
2026-08-12 20:17Z
CRIT

CVE-2026-63294 — LXD: A link following vulnerability in LXD allows an attacker to achieve root command execution

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63294

A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image or backup archives, LXD fails to properly validate and confine the backup.yaml file when it exists as a symbolic link. An attacker can exploit this flaw by providing a malicious archive with a symlinked backup.yaml file, causing LXD to process unconfined configuration metadata and execute arbitrary commands with root pr CVSSv3.1 9.9 (CRITICAL)

CWECWE 59VNDLxdTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-08-12
2026-08-12 20:17Z
CRIT

CVE-2026-63293 — LXD: A link following vulnerability in LXD allows an attacker to achieve arbitrary file read

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63293

A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An attacker can exploit this flaw by providing a crafted image archive with a symlinked metadata.yaml file pointing to target file paths on the host system. CVSSv3.1 9.9 (CRITICAL)

CWECWE 59VNDLxdTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-08-12
2026-08-12 20:17Z
CRIT

CVE-2026-62420 — LXD: An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-62420

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via POST /1.0/instances/{name} with migration: true, project: <target>, and target: <member>, the destination node skips all project restriction checks because the request arrives as an internal cluster notification. An attacker can exploit this CVSSv3.1 9.9 (CRITICAL)

CWECWE 863VNDLxdTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-08-12
2026-08-12 20:17Z
CRIT

CVE-2026-19656 — ScadaLTS: Successful exploitation results in code execution in the context of the ScadaLTS server process

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-19656

ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenticated user (including one holding only low-privilege, read-only permissions) to execute arbitrary operating system commands on the host. Successful exploitation results in code execution in the context of the ScadaLTS server process (root), leading to full compromise of the underlying system. CVSSv3.1 9.9 (CRITICAL)

CWECWE 862VNDScadaltsTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-08-12
2026-08-12 20:17Z
HIGH

CVE-2026-19228 — GitLab: has remediated an issue in GitLab EE affecting all versions from 19.1 before

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-19228

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to cause AI usage to be attributed to another namespace, due to improper authorization of identity information supplied in requests. CVSSv3.1 8.5 (HIGH)

CWECWE 639VNDGitlabTYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2026-08-12
2026-08-12 20:17Z
HIGH

CVE-2026-18099 — IBM: i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-18099

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary script code due to improper neutralization of user-controlled input. CVSSv3.1 8.9 (HIGH)

CWECWE 79VNDIbmTYPVulnerability
8.9
CVSS v3.1
95
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-08-12
2026-08-12 20:17Z
HIGH

CVE-2026-17642 — IBM: i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-17642

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. CVSSv3.1 8.8 (HIGH)

CWECWE 78VNDIbmTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-12
2026-08-12 20:17Z
HIGH

CVE-2026-17445 — IBM: i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-17445

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of an attacker-supplied user profile name. CVSSv3.1 8.2 (HIGH)

CWECWE 250VNDIbmTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-08-12
2026-08-12 20:17Z
HIGH

CVE-2026-17417 — IBM: i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-17417

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of shell metacharacters. CVSSv3.1 8.8 (HIGH)

CWECWE 78VNDIbmTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-12
2026-08-12 20:17Z
CRIT

CVE-2026-17083 — IBM: i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-17083

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow. CVSSv3.1 9.8 (CRITICAL)

CWECWE 787VNDIbmTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-12
2026-08-12 20:17Z
HIGH

CVE-2026-17082 — IBM: i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-17082

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of a client-supplied profile name. CVSSv3.1 8.8 (HIGH)

CWECWE 269VNDIbmTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-12
2026-08-12 20:17Z
HIGH

CVE-2026-15217 — GitLab: has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-15217

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled values rendered in table cell content by an analytics dashboard component. CVSSv3.1 8.7 (HIGH)

CWECWE 79VNDGitlabTYPVulnerability
8.7
CVSS v3.1
94
Edit Score
2026-08-12
2026-08-12 20:17Z
HIGH

CVE-2026-15216 — GitLab: has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-15216

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled data rendered in pagination controls by an analytics dashboard component. CVSSv3.1 8.7 (HIGH)

CWECWE 79VNDGitlabTYPVulnerability
8.7
CVSS v3.1
94
Edit Score
2026-08-12
2026-08-12 20:17Z
HIGH

CVE-2026-13361 — IBM: Informix oninit sq_sgkprepare RCE via unchecked SQL Interface length field.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-13361

IBM Informix oninit sq_sgkprepare RCE via unchecked SQL Interface length field. CVSSv3.1 8.8 (HIGH)

CWECWE 121VNDIbmTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-12
2026-08-12 20:17Z
HIGH

CVE-2026-13267 — IBM: Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-13267

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 and IBM Security Verify Access Container 10.0 through 10.0.9.2 could allow an authenticated user to gain privileges of another user via a specially crafted request. CVSSv3.1 8.1 (HIGH)

CWECWE 302VNDIbmTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-08-12
2026-08-12 20:17Z
HIGH

CVE-2026-12359 — IBM: Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-12359

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 could allow a remote attacker to access sensitive information due to an inconsistent interpretation of an HTTP request by a reverse proxy. CVSSv3.1 8.1 (HIGH)

CWECWE 287VNDIbmTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-08-12
2026-08-12 20:17Z
HIGH

CVE-2026-12004 — IBM: Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-12004

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a format string injection vulnerability in the management interface that allows attackers to cause denial of service and information disclosure by crafting a malicious HTTP request. CVSSv3.1 8.7 (HIGH)

CWECWE 134VNDIbmTYPVulnerability
8.7
CVSS v3.1
94
Edit Score
2026-08-12
2026-08-12 19:17Z
HIGH

CVE-2026-19311 — Execute: Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-19311

Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters. CVSSv3.1 8.1 (HIGH)

CWECWE 475VNDExecuteTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-08-12
2026-08-12 19:17Z
HIGH

CVE-2026-18952 — Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-18952

Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform server-side request forgery and read local files via a crafted URL parameter to the threat intel source configuration endpoint. CVSSv3.1 8.1 (HIGH)

CWECWE 918TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-08-12
2026-08-12 18:18Z
CRIT

CVE-2026-73300 — Budibase: Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-73300

Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enabling execution of multiple SQL statements in a single query. Attackers can inject malicious SQL commands through user input fields, leading to complete database compromise. This vulnerability is fixed in 3.40.0. CVSSv3.1 9.6 (CRITICAL)

CWECWE 89VNDBudibaseTYPVulnerability
9.6
CVSS v3.1
98
Edit Score
2026-08-12
2026-08-12 18:18Z
CRIT

CVE-2026-73299 — Prompty: Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-73299

Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access. An attacker-controlled template could traverse constructor and prototype properties to execute JavaScript in the host Node.js process. This issue is fixed in versions 0.1.5 and 2.0.0-beta.5. CVSSv3.1 10.0 (CRITICAL)

CWECWE 94CWECWE 1336VNDPromptyTYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2026-08-12
2026-08-12 18:18Z
HIGH

CVE-2026-69106 — A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-69106

A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content. CVSSv3.1 8.8 (HIGH)

CWECWE 20TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-12
2026-08-12 18:17Z
HIGH

CVE-2026-49467 — Pingvin: A vulnerability in versions 1.5.0 through 1.18.0 allow an attacker to bypass password verification

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-49467

Pingvin Share X is a secure and easy self-hosted file sharing platform. A vulnerability in versions 1.5.0 through 1.18.0 allow an attacker to bypass password verification when managing Time-based One-Time Password (TOTP) settings. The root cause is a missing `await` keyword on calls to the asynchronous `verifyPassword` method in `authTotp.service.ts` and the `authenticateUser` method in `auth.service.ts`. In JavaScript, an unawaited `Promise` is always truthy. So the logic in CVSSv3.1 8.8 (HIGH)

CWECWE 304CWECWE 303VNDPingvinTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-12
2026-08-12 18:17Z
HIGH

CVE-2026-44741 — Admin: Versions prior to 2.3.6 and 1.7.18 have a SQL injection vulnerability in Pimcore's translation

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-44741

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Versions prior to 2.3.6 and 1.7.18 have a SQL injection vulnerability in Pimcore's translation grid date filter — the user-supplied `property` field from the filter JSON is interpolated directly into a `UNIX_TIMESTAMP(DATE(FROM_UNIXTIME(...)))` SQL expression without parameterization or allowlist validation. Versiosn 2.3.6 and 1.7.18 fix the issue. CVSSv3.1 8.8 (HIGH)

CWECWE 89TYPVulnerability
8.8
CVSS v3.1
94
Edit Score