Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-09-29 14:12Z
2026-07-16
2026-07-16 00:00Z
HIGH

TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains

Elastic Security Labs·elastic.coin the wild

Elastic Security Labs discovered TELEPUZ, a modular malware-as-a-service (MaaS) platform actively spreading via CLICKFIX-VIDAR social engineering chains since April 2026. The malware employs sophisticated evasion techniques including indirect syscalls, AMSI/ETW patching, NTDLL unhooking, and UAC bypass via COM elevation and AppInfo ALPC. Command & control infrastructure uses WebSockets with fallback mechanisms via Telegram, Steam profiles, DNS records, and Polygon blockchain smart contracts.

SRFApplicationSRFOsTACTA0005TACTA0001TACTA0003TACTA0011TYPVulnerabilityTYPThreat Intel
82
Edit Score
2026-07-15
2026-07-15 22:53Z
INFO

v4.0.0rc2

Mythic releases·github.com

Mythic v4.0.0rc2 release candidate published on GitHub. No detailed changelog or feature notes are accessible in the provided content due to page load errors.

SWMythicTYPTool
15
Edit Score
2026-07-15
2026-07-15 22:17Z
CRIT

CVE-2026-55652 — Wekan: is open source kanban built with Meteor.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-55652

Wekan is open source kanban built with Meteor. Prior to 9.46, header-login with HEADER_LOGIN_TRUSTED_IPS uses getRequestIp() in server/lib/headerLoginAuth.js to trust the client-supplied X-Forwarded-For header before the real socket address, allowing an unauthenticated attacker to send HEADER_LOGIN_ID for any username and receive a meteor_login_token session, including for admin. This issue is fixed in version 9.46. CVSSv3.1 9.8 (CRITICAL)

CWECWE 287CWECWE 290VNDWekanTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-07-15
2026-07-15 22:17Z
HIGH

CVE-2026-55234 — Wekan: Prior to 9.37, Wekan DDP update allow rules in server/permissions/cards.js, server/permissions/lists.js, and server/permissions/swimlanes.js authorize

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-55234

Wekan is open source kanban built with Meteor. Prior to 9.37, Wekan DDP update allow rules in server/permissions/cards.js, server/permissions/lists.js, and server/permissions/swimlanes.js authorize against the stored source boardId and do not validate a new boardId in the update modifier. Any authenticated user with write access to their own board can call /cards/update, /lists/update, or /swimlanes/update to move cards, lists, or swimlanes into a private board they are not a CVSSv3.1 8.5 (HIGH)

CWECWE 639CWECWE 284VNDWekanTYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2026-07-15
2026-07-15 22:17Z
CRIT

CVE-2026-54458 — WWBN: Versions prior to 29.0 contain a stored DOM Cross-Site Scripting vulnerability in the YPTSocket

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-54458

WWBN AVideo is an open source video platform. Versions prior to 29.0 contain a stored DOM Cross-Site Scripting vulnerability in the YPTSocket plugin. Any unauthenticated remote attacker can execute arbitrary JavaScript in the authenticated origin of every administrator currently viewing a page that renders the YPTSocket online-users debug panel. plugin/YPTSocket/getWebSocket.json.php issues a signed WebSocket token to any anonymous caller, and MessageSQLiteV2::onOpen at plugi CVSSv3.1 9.6 (CRITICAL)

CWECWE 79VNDWwbnTYPVulnerability
9.6
CVSS v3.1
98
Edit Score
2026-07-15
2026-07-15 22:17Z
CRIT

CVE-2026-52891 — Wekan: is open source kanban built with Meteor.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-52891

Wekan is open source kanban built with Meteor. Prior to 9.07, Wekan avatar upload functionality embeds user-supplied filenames into paths later passed to child_process.exec() for MIME-type detection. Because models/avatars.js and models/fileValidation.js used a shell command with the avatar filename, shell metacharacters such as backticks and $() in the filename could execute commands on the server. This issue is fixed in version 9.07. CVSSv3.1 9.9 (CRITICAL)

CWECWE 78CWECWE 88VNDWekanTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-07-15
2026-07-15 22:16Z
HIGH

CVE-2026-48795 — AdonisJS: From 10.1.3 until 10.1.5 and 11.0.3, AdonisJS @adonisjs/bodyparser incompletely fixed CVE-2026-25754 because nested multipart

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-48795

AdonisJS is a TypeScript-first web framework. From 10.1.3 until 10.1.5 and 11.0.3, AdonisJS @adonisjs/bodyparser incompletely fixed CVE-2026-25754 because nested multipart field payloads such as user.__proto__.polluted and constructor.prototype still caused lodash _.set() via @poppinss/utils to create plain intermediate objects and pollute Object.prototype. This issue is fixed in versions 10.1.5 and 11.0.3. CVSSv3.1 8.6 (HIGH)

CWECWE 1321VNDAdonisjsTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-07-15
2026-07-15 22:16Z
CRIT

CVE-2026-30623 — LiteLLM: 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-30623

LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality. The application allows users to add MCP servers via a JSON configuration specifying arbitrary command and args values. LiteLLM executes these values on the host without validation, enabling attackers to run arbitrary operating system commands. Successful exploitation may result in remote code execution with the privileges of the LiteLLM process. CVSSv3.1 9.8 (CRITICAL)

CWECWE 77VNDLitellmTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-07-15
2026-07-15 22:16Z
CRIT

CVE-2026-30618 — Fay: xszyou Fay 4.3.1 contains a remote code execution vulnerability in its MCP STDIO server

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-30618

xszyou Fay 4.3.1 contains a remote code execution vulnerability in its MCP STDIO server management and command execution handling. A remote attacker can access the publicly exposed MCP management interface and configure an MCP STDIO server with attacker-controlled commands and parameters, resulting in execution of arbitrary commands on the server. Successful exploitation allows arbitrary command execution within the context of the Fay service. CVSSv3.1 9.8 (CRITICAL)

CWECWE 94VNDFayTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-07-15
2026-07-15 22:16Z
CRIT

CVE-2026-26718 — Site: A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3.0.0 that

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-26718

A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform unauthorized modifications to Glue IDE shell scripts. The affected endpoint lacks proper CSRF token validation and accepts arbitrary HTTP methods via a permissive request mapping CVSSv3.1 9.1 (CRITICAL)

CWECWE 352TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-07-15
2026-07-15 22:16Z
CRIT

CVE-2025-65720 — Open: An issue in Open Source GPT Researcher v3.3.7 allows attackers to execute arbitrary commands

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-65720

An issue in Open Source GPT Researcher v3.3.7 allows attackers to execute arbitrary commands on a victim system via user interaction with a crafted HTML page. CVSSv3.1 9.8 (CRITICAL)

CWECWE 77TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-07-15
2026-07-15 21:16Z
HIGH

CVE-2026-62312 — Prior to 0.5.2, 9Router allows a remote authenticated attacker to achieve arbitrary code execution

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-62312

9Router is an AI router & token saver. Prior to 0.5.2, 9Router allows a remote authenticated attacker to achieve arbitrary code execution on the host operating system by combining a Host header bypass of localhost-only routes with unvalidated MCP plugin args passed to child_process.spawn(), allowing malicious custom plugins to execute commands through /api/mcp//sse. This issue is fixed in version 0.5.2. CVSSv3.1 8.8 (HIGH)

CWECWE 78TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-07-15
2026-07-15 21:16Z
HIGH

CVE-2026-59950 — Lfprojects Mcp_python_sdk: The MCP Python SDK, called mcp on PyPI, is a Python implementation of the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-59950

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.28.1, the deprecated mcp.server.websocket.websocket_server transport accepted WebSocket handshakes without applying Host or Origin header validation, leaving no SDK-level way to restrict which origins could connect to applications that exposed that transport. This issue is fixed in version 1.28.1. CVSSv3.1 8.1 (HIGH) · EPSS 8th percentile

CWECWE 1385CWECWE 346VNDLfprojectsVNDMcpTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-07-15
2026-07-15 21:16Z
CRIT

CVE-2026-54052 — MCP: n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-54052

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.56.1, in HTTP mode with multi-tenancy enabled through ENABLE_MULTI_TENANT=true, n8n-mcp's local workflow version history backups were not isolated per tenant, allowing an authenticated tenant to read workflow version snapshots belonging to other tenants and delete or destroy other tenants' stored backups, including full node definitions, credential ref CVSSv3.1 9.9 (CRITICAL)

CWECWE 862CWECWE 639VNDMcpTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-07-15
2026-07-15 21:16Z
CRIT

CVE-2026-52887 — NocoBase: Prior to 2.0.61, NocoBase @nocobase/plugin-notification-in-app-message exposed GET /api/myInAppChannels:list, where the filter[latestMsgReceiveTimestamp][$lt] value was inse

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-52887

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.0.61, NocoBase @nocobase/plugin-notification-in-app-message exposed GET /api/myInAppChannels:list, where the filter[latestMsgReceiveTimestamp][$lt] value was inserted into a Sequelize.literal() template string without escaping or parameter binding, allowing a signed-up authenticated user to run stacked PostgreSQL statements and potentially execute comman CVSSv3.1 10.0 (CRITICAL)

CWECWE 89VNDNocobaseTYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2026-07-15
2026-07-15 21:16Z
CRIT

CVE-2026-51380 — Buffer: Overflow vulnerability in Tenda AC10 v3 (firmware V03.03.16.09) allows attackers to cause a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-51380

Buffer Overflow vulnerability in Tenda AC10 v3 (firmware V03.03.16.09) allows attackers to cause a permanent Denial of Service (DoS) or potentially execute remote code via the /cgi-bin/UploadCfg endpoint CVSSv3.1 9.8 (CRITICAL)

CWECWE 120VNDBufferTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-07-15
2026-07-15 21:16Z
CRIT

CVE-2026-49352 — 9Router is an AI router & token saver.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-49352

9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used the hardcoded fallback JWT secret 9router-default-secret-change-me in src/app/api/auth/login/route.js, src/middleware.js, and later src/lib/auth/dashboardSession.js, allowing attackers to forge an auth_token cookie when JWT_SECRET was unset. This issue is fixed in version 0.4.44 CVSSv3.1 9.8 (CRITICAL)

CWECWE 798TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-07-15
2026-07-15 21:16Z
CRIT

CVE-2026-46339 — 9Router is an AI router & token saver.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-46339

9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/cli-tools/* and /api/mcp/*, allowing unauthenticated registration of customPlugins through src/app/api/cli-tools/cowork-settings/route.js and command execution through the MCP bridge. This vulnerability is fixed in 0.4.37. CVSSv3.1 10.0 (CRITICAL)

CWECWE 306CWECWE 78TYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2026-07-15
2026-07-15 20:32Z
INFO

v4.0.0rc1

Mythic releases·github.com

Mythic v4.0.0rc1 release candidate published on GitHub. The release notes are not accessible in the provided content; only metadata indicating a tag creation and GitHub Actions update are visible.

SWMythicTYPTool
15
Edit Score
2026-07-15
2026-07-15 20:17Z
CRIT

CVE-2026-49445 — Cilium: Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled, the embedded

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-49445

Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes, allowing a local attacker to access Envoy admin endpoints, expose TLS secrets, disrupt cluster traffic, or terminate Envoy. This issue is fixed in versions 1.17.14, 1.18.8, and 1.19.2. CVSSv3.1 9.2 (CRITICAL)

CWECWE 732VNDCiliumTYPVulnerability
9.2
CVSS v3.1
96
Edit Score
2026-07-15
2026-07-15 19:18Z
HIGH

CVE-2026-62349 — TDengine: In 3.4.1.6 and earlier, source/libs/parser/src/parUtil.c trimString() checks space for only one byte before processing

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-62349

TDengine is an open source, time-series database optimized for Internet of Things devices. In 3.4.1.6 and earlier, source/libs/parser/src/parUtil.c trimString() checks space for only one byte before processing SQL string escape sequences \%, \_, or \x, allowing a one-byte out-of-bounds write to the stack buffer tmpTokenBuf that can cause denial of service and potentially remote code execution. This issue is fixed in version 3.4.1.14. CVSSv3.1 8.3 (HIGH)

CWECWE 787CWECWE 121VNDTdengineTYPVulnerability
8.3
CVSS v3.1
92
Edit Score
2026-07-15
2026-07-15 19:17Z
HIGH

CVE-2026-49987 — Yamadashy Repomix: Prior to 1.14.1, src/core/git/gitCommand.ts execGitShallowClone passes the --remote-branch value directly to git fetch and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-49987

Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, src/core/git/gitCommand.ts execGitShallowClone passes the --remote-branch value directly to git fetch and git checkout without validation or --end-of-options, allowing --upload-pack or other Git option injection that bypasses validateGitUrl() dangerous parameter checks and can execute commands through local or SSH-style transports. This issue is fixed in version 1.14.1. CVSSv3.1 8.8 (HIGH) · EPSS 40th percentile

CWECWE 88VNDYamadashyVNDRepomixTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-07-15
2026-07-15 19:17Z
HIGH

CVE-2026-46485 — Dashy: Prior to 4.0.8, Dashy deployments using OIDC can allow unauthenticated users or non-admin authenticated

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-46485

Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can allow unauthenticated users or non-admin authenticated users to write changes to the main config.yaml through the config-saving functionality despite configured permissions, allowing unauthorized modification of dashboard configuration and potential service disruption. This issue is fixed in version 4.0.8. CVSSv3.1 8.2 (HIGH)

CWECWE 287CWECWE 284CWECWE 15CWECWE 602VNDDashyTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-07-15
2026-07-15 18:16Z
CRIT

CVE-2026-62948 — OpenWrt: Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-62948

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases through src/statefiles.c statefiles_write_state6() and statefiles_write_state4() without escaping, allowing newline injection of forged lease lines that LuCI rpcd-mod-luci getDHCPLeases displays through htdocs/luci-static/resources/view/status/include/40_dhcp.js and htdocs/luci-static/resources/luci.js dom.append as li CVSSv3.1 9.6 (CRITICAL)

CWECWE 79CWECWE 150CWECWE 117VNDOpenwrtTYPVulnerability
9.6
CVSS v3.1
98
Edit Score
2026-07-15
2026-07-15 18:16Z
HIGH

CVE-2026-59258 — immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-59258

immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint that allows shared album editors to modify member roles without owner-only restrictions. Attackers with editor access can demote the album owner to editor and promote themselves to owner in sequential requests, gaining full control including deletion and eviction capabilities. CVSSv3.1 8.3 (HIGH)

CWECWE 863TYPVulnerability
8.3
CVSS v3.1
92
Edit Score