Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-09-15 04:32Z
6d ago
2026-09-08 13:17Z
HIGH

CVE-2026-75021 — Node: As a result the debugging interface can be exposed beyond the local machine, and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-75021

fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the Inspector to a broadly reachable address instead of the intended loopback. As a result the debugging interface can be exposed beyond the local machine, and because the Inspector protocol allows arbitrary code evaluation, a remote party that reaches it can achieve remote code execution on the developer's machine. This affects fastify-cli CVSSv3.1 8.1 (HIGH)

CWECWE 1327TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
6d ago
2026-09-08 12:16Z
HIGH

CVE-2026-86712 — SiYuan: before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-86712

SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste handler, allowing code execution in the Node-enabled desktop renderer. Attackers can craft malicious web pages that write to the clipboard, and when pasted into SiYuan, injected scripts execute with full Node.js access through the Electron main process. CVSSv3.1 8.8 (HIGH)

CWECWE 79VNDSiyuanTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
6d ago
2026-09-08 12:16Z
HIGH

CVE-2026-80219 — A flaw was found in hawtio-operator.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80219

A flaw was found in hawtio-operator. When deploying Hawtio in cluster mode, the operator creates a cluster-scoped OAuthClient with automatic grant approval (GrantMethod: auto) and no client secret (public client). The redirect URIs are derived from the operator-created Route, whose hostname is tenant-controlled via the Hawtio CR spec.routeHostName field. A malicious tenant can register an arbitrary hostname as a valid OAuth redirect target and, because grants are auto-approve CVSSv3.1 8.7 (HIGH)

CWECWE 1390TYPVulnerability
8.7
CVSS v3.1
94
Edit Score
6d ago
2026-09-08 12:16Z
CRIT

CVE-2026-78234 — A flaw was found in hawtio-operator.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-78234

A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace and uses it to mint client certificates with a Subject Common Name (CN) supplied by the author of a namespaced Hawtio custom resource. Because the operator ships a ClusterRole that aggregates Hawtio CR permissions into the edit and admin roles, any user with edit access in any namespace can obtain a Service-CA-signed certificate with an CVSSv3.1 9.9 (CRITICAL)

CWECWE 295TYPVulnerability
9.9
CVSS v3.1
100
Edit Score
6d ago
2026-09-08 12:16Z
HIGH

CVE-2026-77968 — A flaw was found in hawtio-operator.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-77968

A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in the cluster. The operator also bypasses the cache via direct API calls. Compromise of the operator pod would yield read access to every Secret in the cluster, including bootstrap toke CVSSv3.1 8.2 (HIGH)

CWECWE 269TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
6d ago
2026-09-08 12:16Z
HIGH

CVE-2026-74860 — This flaw can lead to a denial of service (DoS) due to a reproducible

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74860

A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings. CVSSv3.1 8.5 (HIGH)

CWECWE 763TYPVulnerability
8.5
CVSS v3.1
93
Edit Score
6d ago
2026-09-08 12:16Z
HIGH

CVE-2026-16502 — Live: The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-16502

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is install CVSSv3.1 8.8 (HIGH)

CWECWE 502VNDLiveTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
728 × 90 / responsive · programmatic ad slot
6d ago
2026-09-08 11:01Z
HIGH

CVE-2026-86206, CVE-2026-86207: N-able N-central Authentication Bypass (FIXED)

Rapid7 Research·rapid7.comCVE-2026-86206CVE-2026-86207

Rapid7 disclosed two chained authentication bypass vulnerabilities in N-able N-central RMM platform affecting versions prior to 2026.3.1.13. CVE-2026-86206 exploits a semicolon path-parameter and malformed Forwarded header to bypass Envoy proxy and N-central access controls, reaching protected SOAP endpoints. CVE-2026-86207 leverages exception handling in legacy two-factor authentication to convert a pre-login session to an authenticated privileged session, enabling attacker creation of System administrator accounts. Both vulnerabilities have been patched.

SRFApplicationTACTA0001TACTA0002SRFNetworkSWN CentralVNDN AbleTYPResearchTYPVulnerability
82
Edit Score
6d ago
2026-09-08 09:18Z
CRIT

CVE-2026-71377 — Command: Argument Injection Vulnerability in Cosminexus Component Container.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-71377

Command Argument Injection Vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, from 11-10 through 11-10-11, from 11-00 through 11-00-12, from 09-87 before 09-87-10, from 09-80 through 09-80-04, from 09-70 before 09-70-28, from 09-50 through 09-50-22, and fr CVSSv3.1 9.8 (CRITICAL)

CWECWE 88VNDCommandTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
6d ago
2026-09-08 09:18Z
CRIT

CVE-2026-71376 — Cosminexus: OS command injection vulnerability in Cosminexus Component Container.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-71376

OS command injection vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, from 11-10 through 11-10-11, from 11-00 before 11-00-13, from 09-87 before 09-87-10, from 09-80 before 09-80-05, from 09-70 before 09-70-28, from 09-50 through 09-50-22, and from 09-00 CVSSv3.1 9.8 (CRITICAL)

CWECWE 78VNDCosminexusTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
6d ago
2026-09-08 09:18Z
HIGH

CVE-2026-67367 — Affected devices do not properly validate and neutralize directory traversal sequences in the file-serving

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-67367

A vulnerability has been identified in SIMOVE Fleetmanager V3.1 (All versions < V3.1.13), SIMOVE Fleetmanager V3.2 (All versions < V3.2.4), SIMOVE Fleetmanager V3.3 (All versions < V3.3.2), SIMOVE Fleetmanager V4.0 (All versions < V4.0.1), SIPLANT V1.7 (All versions), SIPLANT V2.2 (All versions), SIPLANT V3.0 (All versions), SIPLANT V3.1 (All versions < V3.1.4). Affected devices do not properly validate and neutralize directory traversal sequences in the file-serving endpoint CVSSv3.1 8.6 (HIGH)

CWECWE 23TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
6d ago
2026-09-08 09:18Z
HIGH

CVE-2026-62650 — This could allow an authenticated, low-privileged remote attacker to escalate privileges to an administrative

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-62650

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Server-side authorization checks in the web-based management interface are not properly enforced, allowing role-based access control (RBAC) restrictions to be bypassed through manipulation of request data. This could allow an authenticated, low-privileged remote attacker to escalate privileges to an administrative level. CVSSv3.1 8.8 (HIGH)

CWECWE 288TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
6d ago
2026-09-08 09:18Z
CRIT

CVE-2026-62645 — This could allow an attacker to bypass the authentication and gain unauthorized access to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-62645

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Information is exposed through the web interface that can be used to calculate the current and past session ID numbers. This could allow an attacker to bypass the authentication and gain unauthorized access to the device. CVSSv3.1 9.8 (CRITICAL)

CWECWE 306TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
6d ago
2026-09-08 09:18Z
CRIT

CVE-2026-50093 — A vulnerability in the OIS web module allows an attacker to upload arbitrary files

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-50093

A vulnerability has been identified in Siveillance Control Pro V3.0 (All versions < V3.0.12.2173), Siveillance Control Pro V4.0 (All versions < V4.0.9.2178), Siveillance Control V3.0 (All versions < V3.0.22.2177), Siveillance Control V4.0 (All versions < V4.0.11.2177). A vulnerability in the OIS web module allows an attacker to upload arbitrary files to the server. Successful exploitation of this vulnerability could allow an attacker to gain root access on the host system, po CVSSv3.1 9.0 (CRITICAL)

CWECWE 434TYPVulnerability
9.0
CVSS v3.1
95
Edit Score
6d ago
2026-09-08 09:18Z
HIGH

CVE-2026-34223 — The affected application is vulnerable to Client Code Execution (CCE) due to insufficient input

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-34223

A vulnerability has been identified in Desigo CC ClickOnce Client V6 (All versions), Desigo CC ClickOnce Client V7 (All versions), Desigo CC family V8 (All versions), Desigo CC family V9 (All versions), Desigo CC Flex Client V6 (All versions), Desigo CC Flex Client V7 (All versions), Desigo CC Installed Client V6 (All versions), Desigo CC Installed Client V7 (All versions). The affected application is vulnerable to Client Code Execution (CCE) due to insufficient input validat CVSSv3.1 8.2 (HIGH)

CWECWE 94TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
6d ago
2026-09-08 08:17Z
CRIT

CVE-2026-71374 — Deserialization: of untrusted data vulnerability in Cosminexus Component Container.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-71374

Deserialization of untrusted data vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, from 11-10 through 11-10-11, from 11-00 before 11-00-13, from 09-87 before 09-87-10, from 09-80 before 09-80-05, from 09-70 before 09-70-28, from 09-50 through 09-50-22, a CVSSv3.1 9.8 (CRITICAL)

CWECWE 502TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
6d ago
2026-09-08 07:00Z
INFO

Testing race conditions with memory access tracing and stack-based delay injection

Project Zero·googleprojectzero.blogspot.com

Project Zero researcher publishes MAccConc, a tooling suite for detecting and testing race conditions in the Linux kernel via memory access tracing and stack-based delay injection. The system uses ASAN instrumentation to identify communication points between threads, count-augmented stack traces for stable identification across runs, and KCOV-based delay injection to force specific execution orderings. Includes automatic A-B-A interleaving tester, terminal UI, and GUI for manual exploration.

SRFOsOSLinuxTYPResearchTYPToolSTGDiscoveryTECT1592EXPRace Condition
78
Edit Score
1w ago
2026-09-08 02:17Z
CRIT

CVE-2026-86510 — Such manipulation leads to out-of-bounds write.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-86510

A vulnerability has been found in D-Link DIR-822A A_101. Affected is the function tunnel_set_params of the component L2TP Control Message Parser. Such manipulation leads to out-of-bounds write. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. CVSSv3.1 9.9 (CRITICAL)

CWECWE 787CWECWE 119TYPVulnerability
9.9
CVSS v3.1
100
Edit Score
1w ago
2026-09-08 01:17Z
CRIT

CVE-2026-86509 — This manipulation causes stack-based buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-86509

A flaw has been found in D-Link DIR-895L A1_102b07. This impacts the function sendOffer/sendACK of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack can only be done within the local network. The exploit has been published and may be used. CVSSv3.1 9.6 (CRITICAL)

CWECWE 121CWECWE 119TYPVulnerability
9.6
CVSS v3.1
98
Edit Score
1w ago
2026-09-08 01:17Z
CRIT

CVE-2026-76969 — NPM: Successful exploitation can result in a high impact on availability and integrity of the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-76969

@sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credentials and abuse them to replace or delete tenant data. Successful exploitation can result in a high impact on availability and integrity of the application. There may also be partial impact to the confidentiality of business data. CVSSv3.1 9.4 (CRITICAL)

CWECWE 522TYPVulnerability
9.4
CVSS v3.1
97
Edit Score
1w ago
2026-09-08 01:17Z
HIGH

CVE-2026-76958 — SAP: Successful exploitation could allow the attacker to read sensitive file contents from the server

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-76958

SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privileges could submit specially crafted XML payloads containing malicious external entity declarations. Successful exploitation could allow the attacker to read sensitive file contents from the server and expose them through monitoring or logging output, resulting in a high impact on confidentiality. It could also lead to re CVSSv3.1 8.5 (HIGH)

CWECWE 611VNDSapTYPVulnerability
8.5
CVSS v3.1
93
Edit Score
1w ago
2026-09-08 01:17Z
CRIT

CVE-2026-66768 — SAP: This could allow arbitrary command execution on the victim's machine, leading to a high

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-66768

SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality. This could allow arbitrary command execution on the victim's machine, leading to a high impact on the confidentiality, integrity, and availability of the affected system. CVSSv3.1 9.0 (CRITICAL)

CWECWE 807VNDSapTYPVulnerability
9.0
CVSS v3.1
95
Edit Score
1w ago
2026-09-08 01:17Z
CRIT

CVE-2026-58240 — SAP: An unauthenticated attacker with network access to the affected service could exploit this weakness

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-58240

SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system. CVSSv3.1 9.8 (CRITICAL)

CWECWE 308VNDSapTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
1w ago
2026-09-08 01:17Z
CRIT

CVE-2026-44756 — A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-44756

A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Under specific conditions, an unauthenticated attacker could exploit a crafted network request containing a malformed EPP header, potentially resulting in undefined behavior and abnormal program termination. Successful exploitation may have a high impact on the confidentiality, integrity, and availability of the application. CVSSv3.1 10.0 (CRITICAL)

CWECWE 120TYPVulnerability
10.0
CVSS v3.1
100
Edit Score
1w ago
2026-09-07 23:16Z
HIGH

CVE-2026-86544 — knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-86544

knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-only operations. Attackers with read-restricted sessions can exploit code.replace to modify permission configurations and escalate privileges on subsequent calls. CVSSv3.1 8.1 (HIGH)

CWECWE 863TYPVulnerability
8.1
CVSS v3.1
91
Edit Score