Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-09-26 16:33Z
2026-08-04
2026-08-04 17:16Z
CRIT

CVE-2026-63456 — REST: Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63456

Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive information on the target system. CVSSv3.1 9.8 (CRITICAL)

VNDRestTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-04
2026-08-04 17:16Z
CRIT

CVE-2026-63455 — REST: Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-63455

Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive information on the target system. CVSSv3.1 9.8 (CRITICAL)

VNDRestTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-04
2026-08-04 17:16Z
HIGH

CVE-2026-18787 — The manipulation of the argument args.id leads to command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-18787

A vulnerability was identified in GL.iNet AX1800 up to 4.8.3. The affected element is the function remove_rule of the file /usr/share/gl-ngx/oui-rpc.lua of the component RPC Endpoint. The manipulation of the argument args.id leads to command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure. CVSSv3.1 8.8 (HIGH)

CWECWE 74CWECWE 77TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-04
2026-08-04 17:16Z
HIGH

CVE-2026-15307 — Django: Writing a file to a location later imported by the application can result in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-15307

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a `GeometryField` or `RasterField` reaches this constructor, including untrusted input, for example a spatial-field filter submitted through the Django admin changelist query string by a staff user with view CVSSv3.1 8.8 (HIGH)

CWECWE 918CWECWE 73VNDDjangoTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-04
2026-08-04 17:16Z
CRIT

CVE-2025-29296 — H3C: Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-29296

H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic NX15 V100R017, H3C Magic R1510 V100R016, and H3C NE36 Pro V100R002 contain multiple command injection vulnerabilities in the /api/esps request handler. The affected object interfaces and methods are esps.dhcpd.vlan (getlist, delete), esps.filter.url (add, modify), esps.apcm.version (delete, H3C Magic NX15 only), esps.swcm.version (delete, upgrade, all affected mod CVSSv3.1 9.8 (CRITICAL)

CWECWE 77VNDH3cTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-04
2026-08-04 16:16Z
HIGH

CVE-2026-69254 — Flowiseai Flowise: An authenticated attacker reaching packages/server/src/routes/node-custom-functions/index.ts could run a custom function that imported flowise-components/dist/src/u

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-69254

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, executeJavaScriptCode() accepted caller-provided nodeVMOptions and merged them over the default NodeVM security settings in packages/components/src/utils.ts. An authenticated attacker reaching packages/server/src/routes/node-custom-functions/index.ts could run a custom function that imported flowise-components/dist/src/utils.js, called executeJavaScriptCode() again with no CVSSv3.1 8.8 (HIGH) · EPSS 30th percentile

CWECWE 94VNDFlowiseaiVNDFlowiseTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-04
2026-08-04 16:16Z
HIGH

CVE-2026-69253 — Flowiseai Flowise: An authenticated user could craft a baseURL that passed this check, closed the surrounding

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-69253

Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to version 3.1.3, several custom-tool components — AgentAsTool, ChatflowTool, and ExecuteFlow — ran code in the in-process  vm2  sandbox. To build that code, they inserted a user-controlled  baseURL  value straight into the JavaScript source, for example  const url = "${baseURL}/..."; . The only check on  baseURL  was  isValidURL , but a valid-looking URL can still contai CVSSv3.1 8.8 (HIGH) · EPSS 24th percentile

CWECWE 95VNDFlowiseaiVNDFlowiseTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-08-04
2026-08-04 16:16Z
HIGH

CVE-2026-69252 — Flowiseai Flowise: Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-69252

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce checkPermission on GET or DELETE. A low-privileged authenticated API key with unrelated permissions could call GET /api/v1/files to list files under the organization storage root and DELETE /api/v1/files?path=... to delete files belonging to other workspaces in the same organizati CVSSv3.1 8.8 (HIGH) · EPSS 18th percentile

CWECWE 862VNDFlowiseaiVNDFlowiseTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-04
2026-08-04 16:16Z
CRIT

CVE-2026-69110 — OpenCode: Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-69110

OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the temp and static/music directories by directly accessing the GET /api/tmp/:tmpFile and GET /api/music/:fileName endpoints. Attackers can retrieve intermediate audio, video artifacts, and subtitles belonging to other users' jobs, and additionally delete any video by ID through the unauthenticated DELETE /api/short-video/:vi CVSSv3.1 9.1 (CRITICAL)

CWECWE 22VNDOpencodeTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-08-04
2026-08-04 16:16Z
HIGH

CVE-2026-69100 — LAMP: Rapid Development Platform through 5.6.2, fixed in commit 84b0c27, contains a remote code

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-69100

LAMP Rapid Development Platform through 5.6.2, fixed in commit 84b0c27, contains a remote code execution vulnerability in GlueFactory that executes unsandboxed Groovy scripts from database template fields without compilation restrictions or whitelisting. Attackers can write or influence the script field via message template endpoints to execute arbitrary Groovy code and OS commands on the backend server. CVSSv3.1 8.8 (HIGH)

CWECWE 94VNDLampTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-04
2026-08-04 16:16Z
CRIT

CVE-2026-69098 — kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_connection endpoint that allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-69098

kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_connection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a __type__ field. Attackers can exploit this to override the __type__ field with subprocess.check_output and arbitrary arguments, achieving remote code execution with application process privileges. CVSSv3.1 9.8 (CRITICAL)

CWECWE 502TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-04
2026-08-04 16:16Z
CRIT

CVE-2026-25289 — Memory: Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-25289

Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values. CVSSv3.1 9.6 (CRITICAL)

CWECWE 121TYPVulnerability
9.6
CVSS v3.1
98
Edit Score
2026-08-04
2026-08-04 16:16Z
HIGH

CVE-2026-24079 — Cryptographic: Issue while processing registration requests with malformed or missing authentication parameters.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-24079

Cryptographic Issue while processing registration requests with malformed or missing authentication parameters. CVSSv3.1 8.1 (HIGH)

CWECWE 306VNDCryptographicTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-08-04
2026-08-04 15:16Z
HIGH

CVE-2026-69251 — Flowiseai Flowise: TypeORM DataSource options such as entities, subscribers, and migrations can load local JavaScript files

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-69251

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise record manager and agent memory nodes allowed users to set arbitrary TypeORM DataSource options through the additionalConfig input in packages/components/nodes/recordmanager/MySQLRecordManager/MySQLrecordManager.ts, packages/components/nodes/recordmanager/PostgresRecordManager/PostgresRecordManager.ts, packages/components/nodes/recordmanager/SQLiteRecordManager/SQL CVSSv3.1 8.8 (HIGH) · EPSS 76th percentile

CWECWE 94VNDFlowiseaiVNDFlowiseTYPVulnerability
8.8
CVSS v3.1
95
Edit Score
2026-08-04
2026-08-04 15:16Z
HIGH

CVE-2026-67195 — Perspective: 5.0.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-67195

Perspective 5.0.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary operating system commands by submitting crafted expression strings to the PolarsVirtualServer backend, which passes client-supplied input directly to Python's eval() with only __builtins__={} cleared. Attackers can exploit Python object attribute traversal through the interpreter's loaded class list to reach subprocess.Popen via a TableValidateExprReq or CVSSv3.1 8.8 (HIGH)

CWECWE 95VNDPerspectiveTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-04
2026-08-04 15:16Z
CRIT

CVE-2026-61515 — Puwell: IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-61515

Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability that allows remote attackers to execute arbitrary operating system commands by sending a crafted JSON payload to the DebugShell interface exposed on TCP port 34567. Attackers can exploit the lack of authentication and input sanitization in the binary protocol service to pass arbitrary commands directly to the underlying operating system, achieving root-level code exe CVSSv3.1 9.8 (CRITICAL)

CWECWE 912VNDPuwellTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-04
2026-08-04 15:16Z
CRIT

CVE-2026-61514 — Puwell: IP Camera firmware versions 2.x through 4.x contains an authentication bypass vulnerability that

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-61514

Puwell IP Camera firmware versions 2.x through 4.x contains an authentication bypass vulnerability that allows unauthenticated attackers to access device functions by sending protocol-conforming packets over TCP port 23456 without credentials. Attackers can exploit the unvalidated Session field in the proprietary control protocol header to access live video streams, control pan and tilt motors, activate audio functions, and remotely restart the device. CVSSv3.1 9.8 (CRITICAL)

CWECWE 306VNDPuwellTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-04
2026-08-04 15:16Z
HIGH

CVE-2026-18650 — Authorization: Missing Authorization vulnerability in HAVELSAN Inc.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-18650

Missing Authorization vulnerability in HAVELSAN Inc. Liman MYS allows Privilege Escalation. This issue affects Liman MYS: from 2.2.3 before 2.3.1. CVSSv3.1 8.8 (HIGH)

CWECWE 862TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-04
2026-08-04 14:16Z
HIGH

CVE-2026-17070 — Authorization: Missing Authorization vulnerability in HAVELSAN Inc.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-17070

Missing Authorization vulnerability in HAVELSAN Inc. Liman MYS allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Liman MYS: from 2.2.3 before 2.3.1. CVSSv3.1 8.8 (HIGH)

CWECWE 862TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-04
2026-08-04 13:18Z
HIGH

CVE-2026-70373 — Koha's reports/issues_stats.pl (the circulation statistics report) builds its calculation query in sub calculate by

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-70373

Koha's reports/issues_stats.pl (the circulation statistics report) builds its calculation query in sub calculate by concatenating several user-controlled request parameters directly into the SQL string. The PeriodTypeSel, PeriodDaySel, and PeriodMonthSel parameters are interpolated raw into single-quoted equality and function-comparison fragments, and the Filter slots plus the Line and Column identifiers are likewise interpolated with no whitelist and no placeholder binding. CVSSv3.1 8.8 (HIGH)

CWECWE 89TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-04
2026-08-04 13:18Z
HIGH

CVE-2026-70372 — SQL: Koha's reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-70372

Koha's reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Criteria parameter is only normalized by a table-name prefix and is never whitelisted, landing verbatim in identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY); Filter values are concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments, and the Limit parameter is appended raw to a LIMIT CVSSv3.1 8.8 (HIGH)

CWECWE 89TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-04
2026-08-04 13:18Z
HIGH

CVE-2026-70371 — SQL: Koha's reports/issues_avg_stats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-70371

Koha's reports/issues_avg_stats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY), and each Filter slot is concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments with no bound parameters. An authenticated staff user holding CVSSv3.1 8.8 (HIGH)

CWECWE 89TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-04
2026-08-04 13:18Z
HIGH

CVE-2026-70370 — SQL: Koha's reports/catalogue_stats.pl builds dynamic SQL in sub calculate by interpolating the user-controlled Line and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-70370

Koha's reports/catalogue_stats.pl builds dynamic SQL in sub calculate by interpolating the user-controlled Line and Column request parameters directly into identifier positions of the query (SELECT DISTINCTROW, GROUP BY, ORDER BY) with no whitelist validation. When Line contains itemcallnumber and the cotedigits parameter is truthy, cotedigits is additionally concatenated raw as the numeric argument of a LEFT() call. An authenticated staff user holding the reports module perm CVSSv3.1 8.8 (HIGH)

CWECWE 89TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-04
2026-08-04 13:18Z
HIGH

CVE-2026-70369 — Koha's reports/acquisitions_stats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-70369

Koha's reports/acquisitions_stats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode, biblioitems.itemtype, aqbudgets.budget_code, aqorders.sort1, and aqorders.sort2. The statement is prepared and executed with no bound parameters. An authenticated staff user holding the reports CVSSv3.1 8.8 (HIGH)

CWECWE 89TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-04
2026-08-04 13:18Z
HIGH

CVE-2026-58080 — Eclipse Milo: In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleMapper`.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-58080

In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleMapper`. On servers that rely on role permissions and construct the running configuration through `copy()`, sessions receive no role IDs and the default access controller skips role-permission checks, allowing an anonymous client where anonymous sessions are permitted to read role-permission metadata, invoke protected methods, or delete protected nodes. CVSSv3.1 8.2 (HIGH)

CWECWE 862VNDEclipseTYPVulnerability
8.2
CVSS v3.1
91
Edit Score