Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-09-26 01:03Z
2026-08-10
2026-08-10 11:17Z
CRIT

CVE-2026-72590 — An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72590

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the env_vars parameter. The handler appends the env_vars value directly to the crontab file string as '${envVars}\n' without stripping newline characters, enabling an attacker to insert arbitrary cron expressions that execute attacker-controlled co CVSSv3.1 9.8 (CRITICAL)

CWECWE 93TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-10
2026-08-10 11:17Z
CRIT

CVE-2026-72589 — An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72589

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The POST /import endpoint accepts arbitrary .db files and overwrites the application database without validation. The hook field value is embedded directly into a shell command by crontab.js makeCommand() without sanitization, so a malicious hook value in the imported file re CVSSv3.1 9.8 (CRITICAL)

CWECWE 78TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-10
2026-08-10 11:17Z
HIGH

CVE-2026-72581 — SSRF: A server-side request forgery (SSRF) vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72581

A server-side request forgery (SSRF) vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to make the Xiaomi smart speaker perform HTTP requests to arbitrary internal or external URLs. The /auth endpoint in api/main.py uses the user-supplied url POST parameter to redirect to a Home Assistant instance without validating the destination URL, enabling internal network scanning and access to internal services. CVSSv3.1 8.6 (HIGH)

CWECWE 918VNDSsrfTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-08-10
2026-08-10 11:17Z
CRIT

CVE-2026-72580 — An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72580

An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers running the patch. The /mute and /unmute endpoint handlers in api/main.py pass the user-supplied silent query parameter directly to os.system() without sanitization, enabling command injection via shell metacharacters. CVSSv3.1 9.8 (CRITICAL)

CWECWE 78TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-10
2026-08-10 11:17Z
HIGH

CVE-2026-72578 — CSRF: A cross-site request forgery (CSRF) vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72578

A cross-site request forgery (CSRF) vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator. The /admin/ajax.php dispatcher in amp_conf/htdocs/admin/libraries/BMO/Ajax.class.php does not implement CSRF tokens; its only protection is a Referer header check that is bypassed when the request is sent without a Referer header or from a same-site context, enabling attackers to tr CVSSv3.1 8.8 (HIGH)

CWECWE 352VNDCsrfTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-10
2026-08-10 11:17Z
CRIT

CVE-2026-72577 — NASA: Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72577

Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. The Flask application in src/fprime_gds/flask/app.py applies no authentication to any endpoint. A path traversal in src/fprime_gds/flask/updown.py allows reading and writing arbitrary files outside the upload directory. A hardcoded secret key (CWE-321) in the app CVSSv3.1 9.8 (CRITICAL)

CWECWE 306VNDNasaTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-10
2026-08-10 11:17Z
CRIT

CVE-2026-72575 — An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72575

An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records. The permission check functions (CanRead, CanPeek, CanCreate, CanUpdate, CanDelete, CanRefer) in server/permission/permission.go return true whenever p.UserId equals the requesting userId, but fail to reject the null/zero reference — unlike CanExecute, which explicitly guards it. Since usergroup table rows have no use CVSSv3.1 9.1 (CRITICAL)

CWECWE 284TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-08-10
2026-08-10 11:17Z
HIGH

CVE-2026-72573 — An OS command injection vulnerability in 4xmen/pm2panel (all versions) allows an authenticated remote attacker

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72573

An OS command injection vulnerability in 4xmen/pm2panel (all versions) allows an authenticated remote attacker to execute arbitrary system commands on the host. The pm2panel.js handler at line 188 passes the unsanitized req.query.id parameter directly to exec('pm2 restart ' + id) without input validation or shell escaping, enabling command chaining via semicolons or other shell metacharacters. CVSSv3.1 8.8 (HIGH)

CWECWE 78TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-10
2026-08-10 11:17Z
CRIT

CVE-2026-72569 — A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauthenticated remote attacker to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72569

A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauthenticated remote attacker to delete arbitrary files outside the intended served directory when the application is run with the --delete option. The lib/middleware/file-remove.js middleware does not sanitize the req.query.file parameter before using it to construct file system paths, enabling directory traversal via ../ sequences. CVSSv3.1 9.1 (CRITICAL)

CWECWE 22TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-08-10
2026-08-10 11:17Z
CRIT

CVE-2026-72567 — An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72567

An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to write to or delete arbitrary files with root privileges. The api/api.py wiki-cache endpoint constructs file paths from user-controlled owner, repo, and repo_type fields without sanitization, enabling path traversal. A second unauthenticated endpoint creates directories, and combined these primitives allow arbitrary file write and delete as t CVSSv3.1 9.8 (CRITICAL)

CWECWE 22TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-10
2026-08-10 11:17Z
CRIT

CVE-2026-72565 — SQL: A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72565

A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to bypass per-table access control and read arbitrary database tables via the Map-form @having operator. The APIJSONORM library's AbstractSQLConfig.java applies the per-role allow-list check only on the String form of @having but not on the Map form, allowing a guest user to inject raw SQL fragments and read tables that are configured with get:[] (empty, meaning no role can CVSSv3.1 9.8 (CRITICAL)

CWECWE 89TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-10
2026-08-10 11:17Z
CRIT

CVE-2026-72564 — An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attacker to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72564

An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attacker to authenticate to any resource in any organization by reusing an access token issued for a different resource. The server/routers/resource/authWithAccessToken.ts handler calls verifyResourceAccessToken() without passing the target resourceId, so a valid token scoped to resource X in organization A passes verification for resource Y in organization B. CVSSv3.1 9.6 (CRITICAL)

CWECWE 639TYPVulnerability
9.6
CVSS v3.1
98
Edit Score
2026-08-10
2026-08-10 11:17Z
CRIT

CVE-2026-55799 — Code: Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger <= 2.8.0 Users are recommended

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-55799

Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue. CVSSv3.1 9.8 (CRITICAL)

CWECWE 94VNDCodeTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-10
2026-08-10 11:17Z
CRIT

CVE-2026-44416 — Code: Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger <=

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-44416

Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue. CVSSv3.1 9.8 (CRITICAL)

CWECWE 94CWECWE 470VNDCodeTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-10
2026-08-10 11:17Z
CRIT

CVE-2026-42537 — Code: Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0 Users are

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-42537

Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue. CVSSv3.1 9.8 (CRITICAL)

CWECWE 94CWECWE 20VNDCodeTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-10
2026-08-10 11:17Z
CRIT

CVE-2026-40920 — Privilege: Escalation via URL Parameter is reported in Apache Ranger versions <= 2.8.0.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-40920

Privilege Escalation via URL Parameter is reported in Apache Ranger versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue. CVSSv3.1 9.8 (CRITICAL)

CWECWE 269CWECWE 287CWECWE 20TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-10
2026-08-10 11:17Z
CRIT

CVE-2026-32227 — SQL: Injection vulnerability vulnerability in Apache Ranger.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-32227

SQL Injection vulnerability vulnerability in Apache Ranger. This issue affects . Users are recommended to upgrade to version 2.9.0, which fixes the issue. CVSSv3.1 9.8 (CRITICAL)

CWECWE 89TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-10
2026-08-10 11:17Z
CRIT

CVE-2026-28672 — Neutralization: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-28672

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger. This issue affects Apache Ranger: from 0.6 through 2.8. CVSSv3.1 9.8 (CRITICAL)

CWECWE 77TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-10
2026-08-10 10:00Z
HIGH

IT threat evolution in Q2 2026. Non-mobile statistics

Kaspersky Securelist·securelist.comCVE-2026-33825CVE-2026-50751CVE-2026-50752in the wild0day

Kaspersky's Q2 2026 threat report documents 400M blocked web attacks, 71K ransomware victims, and 213K miner infections. Key incidents include Microsoft's disruption of Fox Tempest's malware-signing-as-a-service (used by Rhysida, Akira, Qilin, BlackByte), active exploitation of BlueHammer (CVE-2026-33825) in ransomware campaigns, and zero-day exploitation of Check Point VPN (CVE-2026-50751) by Qilin. Notable technique: PayoutsKing leveraging QEMU to deploy Alpine Linux VMs for evasion and backdoor deployment.

SRFOsTACTA0005TACTA0001TACTA0002SRFNetwork ApplianceTACTA0006TACTA0007SRFWeb
72
Edit Score
2026-08-10
2026-08-10 10:00Z
HIGH

IT threat evolution in Q2 2026. Mobile statistics

Kaspersky Securelist·securelist.com

Kaspersky's Q2 2026 mobile threat report documents 1.99M blocked attacks on Android/iOS devices, with banking Trojans (30.77% share) remaining the dominant threat. Notable findings include malicious loaders on Google Play using SDK-based targeting to evade app store review, and a significant shift toward Mamont banking Trojan variants despite declining overall banking malware discovery rates.

SRFMobileOSAndroidOSIosSWGoogle PlayVNDKasperskyTYPThreat Intel
62
Edit Score
2026-08-10
2026-08-10 09:17Z
HIGH

CVE-2026-66407 — DEEBOT: PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-66407

DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication. The WebSocket private key may be retrieved through analyzing the traffic data via a man-in-the-middle attack, and communication contents may be altered. CVSSv3.1 8.1 (HIGH)

CWECWE 327VNDDeebotTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-08-10
2026-08-10 09:17Z
HIGH

CVE-2026-66405 — DEEBOT: PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-66405

DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled. The telnet service may be leveraged to log in to the affected products. CVSSv3.1 8.8 (HIGH)

CWECWE 489VNDDeebotTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-10
2026-08-10 08:16Z
HIGH

CVE-2026-64940 — Tegalog: Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64940

Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a permissive regular expression, which may allow an attacker who can access the affected product to log in to the management console. As a result, the attacker may perform any operations available from the management console. CVSSv3.1 8.6 (HIGH)

CWECWE 625VNDTegalogTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-08-10
2026-08-10 07:16Z
CRIT

CVE-2026-19089 — Product: The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-19089

The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as accepting all files, allowing unauthenticated attackers to upload arbitrary files and achieve remote code execution on servers that do not honour the directory's access rules. CVSSv3.1 9.8 (CRITICAL) · EPSS 10th percentile

CWECWE 434TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-10
2026-08-10 07:16Z
CRIT

CVE-2026-19053 — ProSolution: The ProSolution WP Client WordPress plugin before 2.0.6 does not sanitise and escape a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-19053

The ProSolution WP Client WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement reachable by unauthenticated visitors, leading to a blind SQL injection. CVSSv3.1 9.1 (CRITICAL)

CWECWE 89VNDProsolutionTYPVulnerability
9.1
CVSS v3.1
96
Edit Score