Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-09-26 12:47Z
2026-08-05
2026-08-05 13:24Z
HIGH

CVE-2026-71259 — ESPHome: through 2026.7.0-dev contains an operator-precedence bug in the cv.url() validator in esphome/config_validation.py: `if

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-71259

ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url() validator in esphome/config_validation.py: `if parsed.scheme and parsed.netloc or parsed.scheme == "file": return parsed.geturl()`. Because `and` binds tighter than `or`, any file: URI passes validation regardless of netloc. This validator gates the `url:` field of the external_components YAML directive's git source schema, which is passed to `git clone` (git supports file:// natively). A crafted CVSSv3.1 8.6 (HIGH)

CWECWE 184VNDEsphomeTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-08-05
2026-08-05 13:00Z
HIGH

Python Software Foundation - Python 3.11.0a3 to 3.15.0b2

Bishop Fox Labs·bishopfox.comCVE-2026-12003

Bishop Fox disclosed CVE-2026-12003, a privilege escalation vulnerability in CPython 3.11.0a3 through 3.15.0b2 on Windows. The flaw allows low-privilege users to execute arbitrary code in the context of elevated accounts by exploiting insecure path construction that references directories outside the Python installation directory (C:\Lib). The vulnerability requires Windows default installation paths and the ability to create directories at the C:\ root level; patches are available in Python 3.13.15, 3.14.7, and 3.15.0b3+.

SRFOsTACTA0004OSWindowsSWCpythonTYPResearchTYPVulnerabilitySTGPrivescTECT1547
78
Edit Score
2026-08-05
2026-08-05 12:18Z
CRIT

CVE-2026-71256 — nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-71256

nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in nmbs_read_device_identification_basic() / recv_read_device_identification_res() in nanomodbus.c. A fixed 3-element stack array order[3] = {0,1,2} maps object IDs to buffer indices. The server-supplied object_id field (0-255, read directly from the wire) is used without any bounds check as buf_index = order[object_id]. When a malicious Modbus server sends a Read Device Identifica CVSSv3.1 9.8 (CRITICAL)

CWECWE 125TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-05
2026-08-05 12:18Z
HIGH

CVE-2026-71255 — nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recv_read_device_identification_res() function (FC

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-71255

nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recv_read_device_identification_res() function (FC 0x2B/MEI 0x0E, Read Device Identification) in nanomodbus.c. The server-supplied object_length field (0-246) is validated only against the remaining PDU size (res_size_left) and is never validated against the caller-supplied buffers_length parameter. After copying data with strncpy(buffers_out[buf_index], str, buffers_length), the code uncondi CVSSv3.1 8.6 (HIGH)

CWECWE 787TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-08-05
2026-08-05 12:18Z
CRIT

CVE-2026-71254 — nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus server-side handle_read_file_record() function (FC

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-71254

nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus server-side handle_read_file_record() function (FC 0x14, Read File Record) in nanomodbus.c. The function validates that the total request size does not exceed 245 bytes and that each sub-request's record_length is at most 124, but it never validates the CUMULATIVE response size across all sub-requests before processing them. The accumulator response_data_size is declared as uint8_t and is incremented by CVSSv3.1 9.8 (CRITICAL)

CWECWE 787TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-05
2026-08-05 11:16Z
HIGH

CVE-2026-71252 — toner-management's admin state-changing handlers (add.php, edit.php, delete.php under admin/toners, admin/toner-brands, admin/printers, and related admin

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-71252

toner-management's admin state-changing handlers (add.php, edit.php, delete.php under admin/toners, admin/toner-brands, admin/printers, and related admin subdirectories) executed INSERT/UPDATE/DELETE database operations with no authentication or authorization check, while access control was enforced only in listing views. An unauthenticated remote attacker could invoke these handlers directly to create, modify, or destroy application data. The vendor has since merged a fix re CVSSv3.1 8.2 (HIGH)

CWECWE 862TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-08-05
2026-08-05 11:16Z
CRIT

CVE-2026-71248 — Inventory: Inventory-Management-System-PHP's login.php constructs its authentication query via direct string concatenation of raw POST parameters

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-71248

Inventory-Management-System-PHP's login.php constructs its authentication query via direct string concatenation of raw POST parameters: $sql = "select * from user where email = '$email' and password = '$password'", with no escaping or parameterization, allowing authentication bypass via a payload such as email=' OR 1=1 LIMIT 1-- -. Separately, delete.php executes mysqli_query($db, "DELETE FROM product WHERE product_id=" . $_GET['id']) with no authentication check and no valid CVSSv3.1 9.8 (CRITICAL)

CWECWE 89VNDInventoryTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-08-05
2026-08-05 11:16Z
HIGH

CVE-2026-71243 — a user-chosen backup name) is vulnerable to arbitrary OS command execution on the backup

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-71243

The backmeup npm package assembles shell command strings by directly concatenating its option values (name, source, destination, filter) - e.g. cmd = "mkdir -p " + path.join(info.destination, info.name) + "; " - and executes the resulting string through a shell via ssh2-exec (locally via child_process, or remotely via SSH when an ssh handle is supplied), rather than using execFile/spawn with an argument array. The only processing applied is path.normalize()/path.join(), which CVSSv3.1 8.8 (HIGH)

CWECWE 78TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-05
2026-08-05 11:16Z
HIGH

CVE-2026-71242 — NotePolicy: Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-71242

Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify $user->hasCompany($model->company_id). NotesController's show(), update(), and destroy() actions authorize via $this->authorize('view notes'/'manage notes') without passing the target Note model, and Note's company-scoping (scopeWhereCompany) is applied only in the list end CVSSv3.1 8.3 (HIGH)

CWECWE 639VNDNotepolicyTYPVulnerability
8.3
CVSS v3.1
92
Edit Score
2026-08-05
2026-08-05 11:16Z
HIGH

CVE-2026-71239 — An authenticated user with mass-mail message edit rights can inject Django template syntax ({{

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-71239

DjangoCRM's massmail module renders user-controlled EmlMessage fields (subject, content) through Django's Template() constructor with no sanitization, in at least three locations: message_previews.py builds an f-string embedding message.subject/message.content directly into a Template() call; email_creators.py passes eml_message.subject directly as a template string to Template(); and helpers.py contains the same f-string interpolation pattern. An authenticated user with mass CVSSv3.1 8.1 (HIGH)

CWECWE 1336TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-08-05
2026-08-05 11:16Z
CRIT

CVE-2026-71238 — DjangoCRM: Since this key is used for session signing, CSRF token generation, and password reset

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-71238

DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for session signing, CSRF token generation, and password reset tokens, anyone who reads the public repository can forge valid session cookies (including for the superadmin account), forge CSRF tokens, and forge password reset tokens, achieving full account takeover. The repository also ships with DEBUG=True as CVSSv3.1 9.1 (CRITICAL)

CWECWE 798VNDDjangocrmTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-08-05
2026-08-05 11:16Z
CRIT

CVE-2026-71237 — The username value is passed through htmlspecialchars(), which does not encode single quotes by

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-71237

Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from $_POST['pwd'] with no sanitization and concatenates it into a raw SQL string: mysql_query("select * from userlists where username='$username' and password='$password' limit 1"). The username value is passed through htmlspecialchars(), which does not encode single quotes by default and therefore does not prevent SQL injection through the password field. An unauthenticated atta CVSSv3.1 9.8 (CRITICAL)

CWECWE 89TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-05
2026-08-05 11:16Z
HIGH

CVE-2026-71236 — API: This double-decode reconstructs live HTML/script tags from the entity-encoded form that HTMLPurifier produced to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-71236

Grocy's API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing &amp;lt;, &amp;gt;, and &amp;amp; back to <, >, and & immediately after purification. This double-decode reconstructs live HTML/script tags from the entity-encoded form that HTMLPurifier produced to neutralize them, re-introducing stored XSS ac CVSSv3.1 8.7 (HIGH)

CWECWE 79VNDApiTYPVulnerability
8.7
CVSS v3.1
94
Edit Score
2026-08-05
2026-08-05 11:16Z
HIGH

CVE-2026-71235 — Rules: Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-71235

Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Go script engine (re/golang.go) runs scripts through the Yaegi interpreter with stdlib.Symbols, exposing the full Go standard library (including os and net/http) with validation limited to a regex blocking goroutines and panic() calls; dangerous functions such as os.ReadFile, os.WriteFile, os.Remove, and os.Environ remain full CVSSv3.1 8.8 (HIGH)

CWECWE 94VNDRulesTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-05
2026-08-05 11:16Z
HIGH

CVE-2026-71233 — InvoiceNinja: This is a distinct code path from the previously published invoice line-item description field

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-71233

InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive {!! $entity->terms !!} (resources/views/portal/ninja2020/invoices/includes/terms.blade.php) with no HTML sanitization. StoreInvoiceRequest.php only strips newlines from the field and does not purify HTML. An authenticated user with invoice creation access can set the terms field via the REST API (PUT /api/v1/invoices/{id}) to an HTML/JavaScript pa CVSSv3.1 8.7 (HIGH)

CWECWE 79VNDInvoiceninjaTYPVulnerability
8.7
CVSS v3.1
94
Edit Score
2026-08-05
2026-08-05 11:16Z
CRIT

CVE-2026-71231 — An unauthenticated attacker can set a lastLogin cookie containing a base64-encoded SQL injection payload

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-71231

IOTSmartHome's gui/login.php checkCookie() function builds an authentication query as SELECT * FROM users WHERE ID='<decoded lastLogin cookie>' after base64-decoding the client-supplied lastLogin cookie via safe_decode(), which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated into the SQL string. An unauthenticated attacker can set a lastLogin cookie containing a base64-encoded SQL injection payload (e.g. base64("' OR '1'=' CVSSv3.1 9.8 (CRITICAL)

CWECWE 89TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-05
2026-08-05 11:16Z
CRIT

CVE-2026-66747 — Zbtlink: Because the channel is unauthenticated and cleartext, control is not limited to whoever planted

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-66747

Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel's [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-sh CVSSv3.1 9.8 (CRITICAL)

CWECWE 506VNDZbtlinkTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-05
2026-08-05 11:16Z
HIGH

CVE-2026-60009 — Eclipse: Because `multipart/form-data` is a CORS-safelisted request type, a cross-origin web page can trigger the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-60009

In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled deployment. The handler takes an attacker-supplied absolute path from the multipart `uri` field and calls `fs.move(tmp, target, { overwrite: true })` with no workspace confinement and no authentication. In browser (non-Electron) deployments the connection token is enforced only on WebSocket upgrades; the HTTP middleware in `@theia/core` r CVSSv3.1 8.8 (HIGH)

CWECWE 352CWECWE 306CWECWE 22CWECWE 73VNDEclipseTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-05
2026-08-05 11:00Z
HIGH

A few notes on AWS Nitro Enclaves: KMS integration

Trail of Bits·blog.trailofbits.com

Trail of Bits publishes a comprehensive security analysis of AWS Nitro Enclaves' integration with KMS, cataloging passive and active attack classes against the enclave-KMS communication channel. The research identifies cryptographic and operational risks including data-swap attacks, CMK substitution, replay attacks, and key commitment weaknesses, along with vulnerabilities in the AWS Nitro Enclaves SDK for C. The post provides a detailed threat model and mitigation checklist for developers integrating KMS with enclaves.

SRFApplicationTACTA0006TACTA0007SRFCloudSWAws Nitro EnclavesVNDAwsTYPResearchSTGDefense Evasion
78
Edit Score
2026-08-05
2026-08-05 10:17Z
CRIT

CVE-2026-44945 — A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go).

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-44945

A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the default user global role can gain full administrative access to the Rancher control plane and transitively to all downstream clusters it manages. This issue affects Rancher: from 2.11.0 before 2.11.16, from 2.12.0 before 2.12.12, from 2.13.0 before 2.13.8, and from 2.14.0 before 2.14.2. CVSSv3.1 9.1 (CRITICAL)

CWECWE 441CWECWE 497TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-08-05
2026-08-05 09:18Z
CRIT

CVE-2026-10090 — This allows the attacker to include cluster-scoped resources in the Helm chart, such as

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-10090

A flaw was found in the Application Subscription controller (multicluster-operators-subscription) of Red Hat Advanced Cluster Management for Kubernetes (ACM). A user with namespace-scoped "edit" privileges in an ACM hub namespace can create a Channel resource pointing to a Helm repository they control and a Subscription resource referencing it. The app-subscription controller fetches and applies the Helm chart contents with its own elevated authority, without verifying whethe CVSSv3.1 9.9 (CRITICAL)

CWECWE 267TYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-08-05
2026-08-05 09:18Z
CRIT

CVE-2026-10059 — This leads to a privilege escalation, allowing the tenant administrator to gain full control

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-10059

A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a token for a ServiceAccount with cluster-wide administrative authority. This leads to a privilege escalation, allowing the tenant administrator to gain full control over the cluster. CVSSv3.1 9.1 (CRITICAL)

CWECWE 266TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-08-05
2026-08-05 08:16Z
HIGH

CVE-2026-7520 — MailChimp: The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7520

The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `sign_in()` and `sign_up()` AJAX handlers in all versions up to, and including, 3.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to relink the site's MailMunch integration to an attacker-controlled MailMunch account by submitting attacker-supplied credentials. Once relinked, all subs CVSSv3.1 8.1 (HIGH)

CWECWE 862VNDMailchimpTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-08-05
2026-08-05 08:16Z
HIGH

CVE-2026-7444 — Search: The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7444

The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.16. This is due to missing or incorrect nonce validation on the `process_bulk_action()` function of `MWTSA_Stats_Table`. This makes it possible for unauthenticated attackers to delete arbitrary search-term records, including all associated search-history rows, via a forged request granted they can trick a user with access to the plugin's "Sear CVSSv3.1 8.1 (HIGH)

CWECWE 352VNDSearchTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-08-05
2026-08-05 08:16Z
CRIT

CVE-2026-71214 — The Aerie/PlanDev sequencing-server's authorization middleware (sequencing-server/src/app.ts) derives the caller's Hasura session role via getHasuraSession()

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-71214

The Aerie/PlanDev sequencing-server's authorization middleware (sequencing-server/src/app.ts) derives the caller's Hasura session role via getHasuraSession(), which prefers a session_variables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims, with no verification that the request actually originated from Hasura. By setting {"session_variables":{"x-hasura-role":"aerie_admin"}} in the body of a request to POST /command- CVSSv3.1 9.8 (CRITICAL)

CWECWE 306TYPVulnerability
9.8
CVSS v3.1
99
Edit Score