Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-09-26 19:11Z
2026-08-03
2026-08-03 17:16Z
CRIT

CVE-2026-39932 — OpenEMR: through 8.2.0 contains a remote code execution vulnerability in the document category tree

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-39932

OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree component (library/classes/Tree.class.php) that allows authenticated administrators to execute arbitrary operating system commands by injecting PHP payloads into the categories database table. Attackers can chain arbitrary SQL execution to alter the id column type to VARCHAR and insert a malicious PHP payload, which is then executed via an unsanitized eval() call whenever any pa CVSSv3.1 9.1 (CRITICAL)

CWECWE 95VNDOpenemrTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-08-03
2026-08-03 17:16Z
HIGH

CVE-2026-18607 — The manipulation of the argument HTTP_COOKIE leads to stack-based buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-18607

A security vulnerability has been detected in Wavlink WN572, WN570H, WN573, WN529, WN530, WN531, WN535, etc. WN529, WN530, WN531, WN535, WN536, WN551, WN557 and NU516 up to 20260609. Affected by this issue is the function strcpy of the file upload.cgi of the component lighttpd. The manipulation of the argument HTTP_COOKIE leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. CVSSv3.1 8.8 (HIGH)

CWECWE 121CWECWE 119TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-03
2026-08-03 17:16Z
CRIT

CVE-2026-18602 — Executing a manipulation of the argument Hostname can lead to command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-18602

A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function ovpn-client.get_recommend_config of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Executing a manipulation of the argument Hostname can lead to command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability. CVSSv3.1 9.8 (CRITICAL)

CWECWE 74CWECWE 77TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-03
2026-08-03 17:11Z
CRIT

Rapid7 Analysis: KindaRails2Shell (CVE-2026-66066)

Rapid7 Research·rapid7.comCVE-2026-66066

CVE-2026-66066 is a critical arbitrary file read vulnerability in Ruby on Rails Active Storage affecting versions <7.2.3.2, >=8.0 <8.0.5.1, and >=8.1 <8.1.3.1 when using Vips image processor with untrusted uploads. The vulnerability exploits a trust mismatch between Rails (which accepts attacker-supplied content_type in direct uploads) and libvips/libmatio (which disagree on MAT/HDF5 file format detection), allowing attackers to craft malicious MAT files that trigger HDF5 external storage reads from arbitrary filesystem paths. The file read can recover Rails signing material (SECRET_KEY_BASE) and escalate to unauthenticated RCE via forged variation keys that invoke Kernel#spawn or Kernel#eval through image_processing's transformation chain.

SRFApplicationTACTA0001TACTA0002SRFWebSWLibvipsSWRailsSWActive StorageSWLibmatio
95
Edit Score
2026-08-03
2026-08-03 16:16Z
CRIT

CVE-2026-18248 — This results in a full authentication and authorization bypass and privilege escalation for any

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-18248

@fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsLambda.context, values that applications are documented to use for authorization decisions such as reading API Gateway authorizer claims. In the default configuration, the getter that populates this decoration reads the client-controlled x-apigateway-event and x-apigateway-context HTTP headers before falling back to the trusted internal request token, and those reserve CVSSv3.1 9.1 (CRITICAL)

CWECWE 345TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-08-03
2026-08-03 16:00Z
HIGH

ConfigManBearPig 2.0 – Things Are Getting Cereal

SpecterOps·specterops.io

ConfigManBearPig 2.0 is a Python rewrite of the original PowerShell collector for Microsoft Configuration Manager (SCCM) that identifies misconfigurations enabling 30+ known attack techniques. The tool now integrates with BloodHound for attack-path visualization, offers 56% speed improvements, cross-platform execution, SOCKS proxy support, and covers 19 of 28 documented SCCM tradecraft techniques including 9 complete hierarchy takeover paths.

SRFApplicationTACTA0007SWBloodhoundSWConfigmanbearpigSWSccmVNDMicrosoftTYPToolSTGDiscovery
78
Edit Score
2026-08-03
2026-08-03 14:48Z
INFO

Metasploit Pro 5.1 Released

Rapid7 Research·rapid7.com

Metasploit Pro 5.1 released with Malleable C2 profile support integrated into the UI, allowing operators to reshape Meterpreter HTTP(S) traffic to emulate legitimate services without command-line knowledge. Additional improvements include service hierarchy tracking, enhanced network topology visualization with rich host information panels, and MITRE ATT&CK technique filtering for module discovery.

SRFApplicationSWMetasploitVNDRapid7TYPToolTECT1071TECT1027
62
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-08-03
2026-08-03 14:16Z
CRIT

CVE-2026-9487 — XML: XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-9487

XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID. _get_signed_xml() in lib/XML/Sig.pm, called from verify(), resolves the SignedInfo Reference/@URI to a node with the XPath expression "//*[@ID='$id']" and returns the first node of the resulting node set. A document in which two elements share that ID value is accepted: the digest and signature are checked against whichever element comes first in document order, and the duplicate is not detecte CVSSv3.1 9.1 (CRITICAL)

CWECWE 347TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-08-03
2026-08-03 14:16Z
CRIT

CVE-2026-9390 — XML: XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-9390

XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify() and _get_signed_xml() in lib/XML/Sig.pm build XPath expressions by concatenating the SignedInfo/Reference/@URI value read from the document being verified. The value is neither escaped nor checked against the NCName grammar that XML requires of an ID, so a URI containing a single quote closes the string literal in the generated expression and appends arbitrary XPath operators. A crafted URI CVSSv3.1 9.1 (CRITICAL)

CWECWE 1287CWECWE 643TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-08-03
2026-08-03 14:16Z
HIGH

CVE-2026-69096 — OpenWrt: luci-app-dockerman (LuCI master and openwrt-25.12 snapshots containing the ucode docker_rpc.uc RPC backend after

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-69096

OpenWrt luci-app-dockerman (LuCI master and openwrt-25.12 snapshots containing the ucode docker_rpc.uc RPC backend after the JS/ucode conversion) contains an OS command injection vulnerability. The package's read ACL grants broad ubus access to docker.* / docker.container.*, which exposes the docker.container.ttyd_start method even though it performs mutating operations. The run_ttyd handler builds a shell command from the request-controlled id, cmd, and uid fields and passes CVSSv3.1 8.8 (HIGH)

CWECWE 78VNDOpenwrtTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-03
2026-08-03 14:16Z
HIGH

CVE-2026-69088 — Grav: Using built-in gadget methods this allows reading of any server-readable file (disclosed to anonymous

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-69088

Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls (Class::method) in blueprint dynamic-field directives because Blueprint::isSafeDynamicCall() only applies its dangerous-callable denylist to strings that do not contain '::'. An account with only page-editing rights (admin.pages, not super-admin or admin.pages_twig) can plant a directive in a page's form-field frontmatter that invokes an arbitrary public static PHP method with attacker CVSSv3.1 8.1 (HIGH)

CWECWE 94VNDGravTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-08-03
2026-08-03 14:16Z
CRIT

CVE-2026-69085 — SiYuan: before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-69085

SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly into SQL statements with no escaping or parameter binding. The endpoint is reachable by a publish RoleReader token, or unauthenticated when publish mode is enabled with Publish.Auth.Enable set to false. Because the statement executes on a read-write SQLite handle via a driver that supports stacked (semicolon CVSSv3.1 10.0 (CRITICAL)

CWECWE 89VNDSiyuanTYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2026-08-03
2026-08-03 14:16Z
CRIT

CVE-2026-69084 — SiYuan: versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-69084

SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no single-statement, read-only, or admin restrictions. The endpoint is gated only by CheckAuth, making it reachable by the publish RoleReader token and by anonymous users when publish authentication is disabled. Because the underlying driver executes stacked statements, an attacker can read and modify co CVSSv3.1 10.0 (CRITICAL)

CWECWE 89VNDSiyuanTYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2026-08-03
2026-08-03 14:16Z
CRIT

CVE-2026-69083 — SiYuan: versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-69083

SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP clauses to read, modify, or delete cross-notebook data. CVSSv3.1 10.0 (CRITICAL)

CWECWE 89VNDSiyuanTYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2026-08-03
2026-08-03 14:16Z
HIGH

CVE-2026-68587 — SiYuan: versions before v3.7.3 contain an information disclosure vulnerability in the getHeadingDeleteTransaction, getHeadingLevelTransaction, and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68587

SiYuan versions before v3.7.3 contain an information disclosure vulnerability in the getHeadingDeleteTransaction, getHeadingLevelTransaction, and getHeadingInsertTransaction endpoints that return rendered block DOM without publish-access checks. Anonymous readers or publish RoleReader tokens can supply a heading block ID to read full rendered content of publish-disabled documents that should be restricted. CVSSv3.1 8.6 (HIGH)

CWECWE 862VNDSiyuanTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-08-03
2026-08-03 14:16Z
HIGH

CVE-2026-68586 — SiYuan: before v3.7.3 fails to apply publish-access filters to the getBacklinkDoc and getBackmentionDoc content

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68586

SiYuan before v3.7.3 fails to apply publish-access filters to the getBacklinkDoc and getBackmentionDoc content endpoints (/api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc). While the corresponding backlink list endpoints filter publish-forbidden documents, the content endpoints (gated only by CheckAuth) do not. A publish-mode reader — including an anonymous reader when publish Basic Auth is disabled — can call these endpoints directly with a publish-forbidden document's CVSSv3.1 8.6 (HIGH)

CWECWE 862VNDSiyuanTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-08-03
2026-08-03 14:16Z
HIGH

CVE-2026-68584 — SiYuan: versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68584

SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning endpoints getHeadingChildrenDOM, getHeading*Transaction, and getBacklinkDoc perform no password check despite protecting the primary getDoc endpoint. Anonymous attackers can retrieve full content of password-protected documents by obtaining internal block IDs from reader-accessible endpoints and calling unprotected content endpoints to bypass the password gate. CVSSv3.1 8.6 (HIGH)

CWECWE 288VNDSiyuanTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-08-03
2026-08-03 14:16Z
CRIT

CVE-2026-64827 — Telenia: Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64827

Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an authentication bypass vulnerability in set_env.php where the redirectToLoginAdminIRequestHaveAccessToken() function derives the current page name from PHP_SELF and skips authentication when the value matches 'login_admin.php'. Attackers can append '/login_admin.php' to the path of any target PHP script to cause the authentication check to pass and gain unauthenticated access CVSSv3.1 9.8 (CRITICAL)

CWECWE 807VNDTeleniaTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-03
2026-08-03 14:16Z
CRIT

CVE-2026-18601 — Performing a manipulation of the argument filename results in command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-18601

A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5. This impacts the function ovpn-client.check_config of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Performing a manipulation of the argument filename results in command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability. CVSSv3.1 9.8 (CRITICAL)

CWECWE 74CWECWE 77TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-03
2026-08-03 14:16Z
HIGH

CVE-2026-18600 — Such manipulation of the argument switch leads to command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-18600

A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. This affects the function network.switch_info/network.switch_status of the file /usr/lib/oui-httpd/rpc/network of the component Network Lua RPC Plugin. Such manipulation of the argument switch leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnera CVSSv3.1 8.8 (HIGH)

CWECWE 74CWECWE 77TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-03
2026-08-03 14:16Z
CRIT

CVE-2026-18108 — Net: Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accepts an EncryptedAssertion

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-18108

Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accepts an EncryptedAssertion whose decrypted content carries no signature. _verify_encrypted_assertion decrypts the EncryptedAssertion and returns it as verified when it carries no signature, via "return $xml unless $xpath->exists('dsig:Signature', $assert);". The signature check and the trust anchor check that follow run only when a signature is present, so a decrypted CVSSv3.1 9.8 (CRITICAL)

CWECWE 347TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-03
2026-08-03 14:16Z
HIGH

CVE-2026-18092 — Net: Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-18092

Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because new_from_xml reads assertion identity with document-wide XPath instead of the signed subtree. new_from_xml reads the NameID, attribute values, SessionIndex, audience and other identity fields with document-wide XPath, such as //saml:Assertion/saml:AttributeStatement/saml:Attribute and //saml:Subject/saml:NameID, which select the first matching element in document orde CVSSv3.1 8.1 (HIGH)

CWECWE 347TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-08-03
2026-08-03 13:17Z
CRIT

CVE-2026-2346 — Authorization: bypass through User-Controlled key vulnerability in Menulux Software Inc.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-2346

Authorization bypass through User-Controlled key vulnerability in Menulux Software Inc. Mobile App allows Software Integrity Attack. This issue affects Mobile App: through 12.05.2026. CVSSv3.1 9.8 (CRITICAL)

CWECWE 639TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-03
2026-08-03 13:17Z
HIGH

CVE-2026-18599 — This manipulation of the argument record_size causes command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-18599

A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5. The impacted element is the function logread.set_config of the file /usr/lib/oui-httpd/rpc/logread of the component Logread Lua RPC Plugin. This manipulation of the argument record_size causes command injection. The exploit has been published and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability. CVSSv3.1 8.0 (HIGH)

CWECWE 74CWECWE 77TYPVulnerability
8.0
CVSS v3.1
90
Edit Score
2026-08-03
2026-08-03 13:17Z
HIGH

CVE-2026-18598 — The manipulation of the argument module results in command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-18598

A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function logread.get_system_log of the file /usr/lib/oui-httpd/rpc/logread of the component Logread Lua RPC plugin. The manipulation of the argument module results in command injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability. CVSSv3.1 8.8 (HIGH)

CWECWE 74CWECWE 77TYPVulnerability
8.8
CVSS v3.1
94
Edit Score