Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-09-25 23:33Z
2026-08-10
2026-08-10 18:18Z
CRIT

CVE-2026-72736 — Dokploy: Prior to 0.29.13, Dokploy passes user-controlled values directly into shell commands via unquoted template

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72736

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy passes user-controlled values directly into shell commands via unquoted template literal interpolation in the registry credential testing and Docker Swarm cluster management endbpoints. Both endpoints have a safe local code path (using execFileAsync or the Docker API) but a vulnerable remote path (using execAsyncRemote which runs the shell string via SSH). This vulnerability is fixed in 0 CVSSv3.1 9.9 (CRITICAL)

CWECWE 77VNDDokployTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-08-10
2026-08-10 18:18Z
CRIT

CVE-2026-72735 — Dokploy: Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts serializes user-controlled Traefik configuration with yaml.stringify and interp

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72735

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts serializes user-controlled Traefik configuration with yaml.stringify and interpolates the resulting yamlStr into an echo command executed through execAsyncRemote. Single quotes in redirect regex and replacement fields, basic authentication usernames, domain host values, or middleware configuration can terminate the shell CVSSv3.1 9.9 (CRITICAL)

CWECWE 77VNDDokployTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-08-10
2026-08-10 18:18Z
HIGH

CVE-2026-72734 — Dokploy: From 0.28.7 until 0.29.13, the server.remove tRPC mutation in apps/dokploy/server/api/routers/server.ts accepts a caller-controlled serverId

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72734

Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.28.7 until 0.29.13, the server.remove tRPC mutation in apps/dokploy/server/api/routers/server.ts accepts a caller-controlled serverId and calls haveActiveServices, findServerById, removeDeploymentsByServerId, and deleteServer without verifying that currentServer.organizationId equals ctx.session.activeOrganizationId. An authenticated owner or administrator with server:delete in one organization who previous CVSSv3.1 8.4 (HIGH)

CWECWE 639VNDDokployTYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-08-10
2026-08-10 18:18Z
CRIT

CVE-2026-72733 — Dokploy: Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription builds database restore shell pipelines from the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72733

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription builds database restore shell pipelines from the user-controlled databaseName and backupFile fields without safely separating them from shell syntax. packages/server/src/utils/restore/utils.ts interpolates databaseName into database-specific restore commands, while packages/server/src/utils/restore/postgres.ts and the analogous restore modules in CVSSv3.1 9.9 (CRITICAL)

CWECWE 78VNDDokployTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-08-10
2026-08-10 17:17Z
HIGH

CVE-2026-72730 — Discourse: Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the Rich Text Editor rendered a chat-transcript

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72730

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the Rich Text Editor rendered a chat-transcript username as HTML, allowing stored cross-site scripting. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. CVSSv3.1 8.7 (HIGH)

CWECWE 79VNDDiscourseTYPVulnerability
8.7
CVSS v3.1
94
Edit Score
2026-08-10
2026-08-10 17:17Z
HIGH

CVE-2026-71576 — The manager component improperly validates the source identity of incoming CloudEvents on Kafka status

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-71576

A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certificate, can manipulate the self-asserted source identity. This allows the attacker to falsify or delete critical data, such as compliance, inventory, and cluster health information, belonging to other hubs in the database. CVSSv3.1 8.5 (HIGH)

CWECWE 345TYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2026-08-10
2026-08-10 16:51Z
INFO

v9.6.0-rc1

BloodHound releases·github.comCVE-2026-16221

BloodHound v9.6.0-rc1 release candidate published with 80+ commits including UI/UX improvements, API enhancements, dependency updates, and vulnerability fixes. Notable changes include queue management endpoints, findings prioritization features, S3 configuration support, and patches for CVE-2026-16221 and js-yaml vulnerabilities.

SWBloodhoundTYPTool
28
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-08-10
2026-08-10 16:19Z
CRIT

CVE-2026-66738 — SPIP: before 4.4.18 contains a code injection vulnerability in SQLite-backed installations.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-66738

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An authenticated attacker with at minimum editor (redacteur) privileges can submit a single crafted GET request to /ecrire/?exec=navigation to execute arbitrary OS commands in the web serve CVSSv3.1 9.8 (CRITICAL)

CWECWE 94VNDSpipTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-10
2026-08-10 16:19Z
CRIT

CVE-2026-47754 — Metacat: Versions 2.x through 2.19.1 and all 1.x versions contain an unauthenticated path traversal in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-47754

Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.x through 2.19.1 and all 1.x versions contain an unauthenticated path traversal in the `archiveEntryName` parameter of the `action=read` endpoint that is part of the original 1.x Metacat API. `ArchiveHandler.readArchiveEntry()` concatenates the user-supplied parameter into a filesystem path without validation, and the surrounding `hasReadPermission()` check is commented o CVSSv3.1 9.3 (CRITICAL)

CWECWE 862CWECWE 22VNDMetacatTYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2026-08-10
2026-08-10 15:17Z
CRIT

CVE-2026-18412 — OpenCart: An attacker can craft a malicious extension containing file path traversal sequences, such as

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-18412

OpenCart extensions are uploaded as zip files with .ocmod.zip extensions. Upon installation, the OpenCart v4.2.0.0 extension installer extracts these zip files, but does not validate that the extracted paths stay inside the intended extraction directory. An attacker can craft a malicious extension containing file path traversal sequences, such as ../. With this vulnerability, an attacker can write files, such as a PHP web shell, into the webroot directory. CVSSv3.1 9.1 (CRITICAL)

VNDOpencartTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-08-10
2026-08-10 14:17Z
CRIT

CVE-2026-63106 — ReadyEcommerce: before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63106

ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API where the rating parameter from the products endpoint is concatenated directly into a MySQL HAVING clause without parameterization in ProductController.php. Attackers can perform time-based blind SQL injection through the unsanitized rating parameter to extract the full database contents, including user credentials and administrator password hashes, with potential ad CVSSv3.1 9.8 (CRITICAL)

CWECWE 89VNDReadyecommerceTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-10
2026-08-10 13:20Z
CRIT

CVE-2026-68426 — Linux: validate_xmit_skb_list() later does tail->next = skb, writing through that stale pointer -- a use-after-free.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68426

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb->prev after async crypto steals a GSO segment skb_gso_segment() leaves the segment list head with ->prev pointing at the last segment, an invariant validate_xmit_skb_list() relies on when it sets its tail pointer (tail = skb->prev). When validate_xmit_xfrm() walks a GSO list and some segments are stolen by async crypto (->xmit() returns -EINPROGRESS), those segments are unlinked from th CVSSv3.1 9.8 (CRITICAL) · EPSS 30th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-10
2026-08-10 13:20Z
HIGH

CVE-2026-68409 — Linux: In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: defer link

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68409

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: defer link RX stats percpu free to RCU sta_remove_link() frees a removed MLO link's RX stats percpu buffer right away, but defers only the link container to RCU: sta_info_free_link(&alloc->info); kfree_rcu(alloc, rcu_head); The RX fast path reads link_sta under rcu_read_lock and writes the percpu stats. A reader that resolved link_sta before the removal keeps the pointer. The container s CVSSv3.1 8.8 (HIGH) · EPSS 16th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-10
2026-08-10 13:20Z
HIGH

CVE-2026-68397 — Linux: In the Linux kernel, the following vulnerability has been resolved: net/iucv: take a reference

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68397

In the Linux kernel, the following vulnerability has been resolved: net/iucv: take a reference on the socket found in afiucv_hs_rcv() afiucv_hs_rcv() looks up the destination socket under iucv_sk_list.lock, drops the lock, and then passes the socket to the afiucv_hs_callback_*() handlers without holding a reference. AF_IUCV sockets are not RCU-protected and are freed synchronously by iucv_sock_kill() -> sock_put(), so a concurrent close can free the socket in the window bet CVSSv3.1 8.8 (HIGH) · EPSS 18th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-10
2026-08-10 13:20Z
HIGH

CVE-2026-68393 — Linux: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: extend conn_hash

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68393

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: extend conn_hash lookup critical sections Using RCU-protected pointers outside the critical sections without refcount is incorrect and may result to UAF. Extend critical section to cover both hci_conn_hash lookup and use of the returned conn. Add surrounding rcu_read_lock() also when return value is not used, in preparation for RCU lockdep requirement to hci_lookup_le_connect(). This CVSSv3.1 8.8 (HIGH) · EPSS 16th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-10
2026-08-10 13:20Z
HIGH

CVE-2026-68390 — Linux: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold hdev->lock

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68390

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold hdev->lock for hci_conn_params lookups hci_conn_params_lookup requires hdev->lock be held, otherwise the list iteration or param access is not safe. Hold hdev->lock for params lookups in hci_sync. CVSSv3.1 8.8 (HIGH) · EPSS 13th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-10
2026-08-10 13:20Z
HIGH

CVE-2026-68389 — Linux: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_qca: Clear memdump

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68389

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_qca: Clear memdump state on invalid dump size qca_controller_memdump() allocates qca->qca_memdump before processing the first dump packet. For a sequence-zero packet it then disables IBS, marks memdump collection active, and reads the advertised dump size. If the controller reports a zero dump size, the error path frees the local qca_memdump object and returns without clearing qca->qca_memdu CVSSv3.1 8.8 (HIGH) · EPSS 18th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-10
2026-08-10 13:20Z
CRIT

CVE-2026-68388 — Linux: This also prevents a malformed range length from causing an out-of-bounds zero-buffer read.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68388

In the Linux kernel, the following vulnerability has been resolved: smb/client: handle overlapping allocated ranges in fallocate smb3_simple_fallocate_range() can skip holes when an allocated range returned by the server starts before the current fallocate offset. The skipped hole is not zero-filled, but fallocate still returns success. A later write to that hole may therefore fail with ENOSPC. The function queries allocated ranges so that it can preserve existing contents CVSSv3.1 9.8 (CRITICAL) · EPSS 38th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-10
2026-08-10 13:20Z
CRIT

CVE-2026-68385 — Linux: In the Linux kernel, the following vulnerability has been resolved: s390/checksum: Fix csum_partial() without

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68385

In the Linux kernel, the following vulnerability has been resolved: s390/checksum: Fix csum_partial() without vector facility Currently csum_partial() calls csum_copy() with copy=false and dst=NULL. On machines without the vector facility, csum_copy() falls back to cksm(dst, ...), causing the checksum to be calculated from address zero instead of the source buffer. The VX implementation already checksums data loaded from src. Make the fallback do the same by passing src to CVSSv3.1 9.8 (CRITICAL) · EPSS 40th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-10
2026-08-10 13:20Z
CRIT

CVE-2026-68381 — Linux: In the Linux kernel, the following vulnerability has been resolved: ksmbd: pin conn during

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68381

In the Linux kernel, the following vulnerability has been resolved: ksmbd: pin conn during async oplock break notification smb2_oplock_break_noti() and smb2_lease_break_noti() store a ksmbd_conn pointer in an async ksmbd_work and then queue that work on ksmbd-io. The work only increments conn->r_count, which prevents teardown from passing the pending-request wait after the increment, but it does not pin the struct ksmbd_conn object. If connection teardown races with an op CVSSv3.1 9.8 (CRITICAL) · EPSS 38th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-10
2026-08-10 13:20Z
HIGH

CVE-2026-68376 — Linux: This can lead to an invalid HMAC identifier being accepted and later cause an

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68376

In the Linux kernel, the following vulnerability has been resolved: sctp: fix auth_hmacs array size in struct sctp_cookie The auth_hmacs array in struct sctp_cookie is supposed to store a complete SCTP_AUTH_HMAC_ALGO parameter, which consists of a struct sctp_paramhdr followed by N HMAC identifiers. However, the array size was calculated using an extra 2 bytes instead of sizeof(struct sctp_paramhdr), which is 4 bytes. When four HMAC identifiers are configured, the HMAC-ALG CVSSv3.1 8.1 (HIGH) · EPSS 35th percentile

TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-08-10
2026-08-10 13:20Z
HIGH

CVE-2026-68373 — Linux: If the device delivers a truncated beacon or probe response, the oversized IE length

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68373

In the Linux kernel, the following vulnerability has been resolved: wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() at76_guess_freq() checks only that the received frame is at least a bare 802.11 header (24 bytes) before subtracting the fixed management-body offset: len -= el_off; For both beacon and probe response frames, el_off is 36. If the frame is shorter than el_off, subtracting it causes the calculated IE length to wrap. The length is eventually pa CVSSv3.1 8.1 (HIGH) · EPSS 19th percentile

TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-08-10
2026-08-10 13:20Z
HIGH

CVE-2026-68371 — Linux: In the Linux kernel, the following vulnerability has been resolved: usb: musb: omap2430: Do

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68371

In the Linux kernel, the following vulnerability has been resolved: usb: musb: omap2430: Do not put borrowed of_node in probe omap2430_probe() stores pdev->dev.of_node in a local np variable. This is a borrowed pointer and the probe function does not take a reference to it. The success and error paths nevertheless call of_node_put(np). This drops a reference that is owned by the platform device, and can leave pdev->dev.of_node with an unbalanced reference count. Do not pu CVSSv3.1 8.4 (HIGH) · EPSS 8th percentile

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-08-10
2026-08-10 13:20Z
HIGH

CVE-2026-68354 — Linux: In the Linux kernel, the following vulnerability has been resolved: firewire: net: Fix fragmented

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68354

In the Linux kernel, the following vulnerability has been resolved: firewire: net: Fix fragmented datagram reassembly fwnet_frag_new() keeps a sorted list of received fragments for a partial datagram. When a new fragment is adjacent to an existing fragment, the code checks whether the new fragment also closes the gap to the next or previous list entry. Those neighbor lookups currently assume that the current fragment always has a real next or previous fragment. At a list e CVSSv3.1 8.8 (HIGH) · EPSS 20th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-10
2026-08-10 13:20Z
HIGH

CVE-2026-68353 — Linux: This allows out-of-bounds reads of up to 1020 bytes past the WMI event buffer

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68353

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler The firmware-controlled num_msg field (u8, 0-255) drives the loop in ath6kl_wmi_tx_complete_event_rx() without validation against the buffer length. This allows out-of-bounds reads of up to 1020 bytes past the WMI event buffer when the firmware sends an inflated num_msg. Add a check that the buffer is large enough to hold the fixed str CVSSv3.1 8.1 (HIGH) · EPSS 21th percentile

TYPVulnerability
8.1
CVSS v3.1
91
Edit Score