Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-04 02:45Z
2026-06-26
2026-06-26 19:32Z
HIGH

Weekly Metasploit Update: Modules for Audiobookshelf, LiteLLM, Next.js, Dalfox and more

Rapid7 Research·rapid7.comCVE-2025-25205CVE-2026-42208CVE-2025-29927CVE-2026-45087

Rapid7 released Metasploit Framework 6.4.141 with four new modules: detection scanners for Audiobookshelf auth bypass (CVE-2025-25205), LiteLLM pre-auth SQL injection (CVE-2026-42208, CVSS 9.3), and Next.js middleware authorization bypass (CVE-2025-29927, CVSS 9.1), plus an exploit module for Dalfox Server deserialization RCE (CVE-2026-45087). Additional improvements include enhanced auth_brute mixin reporting and rex-socket UDP compatibility updates.

SRFApplicationSRFWebSWMetasploitSWLitellmSWNextjsSWAudiobookshelfSWDalfoxTYPTool
72
Edit Score
2026-06-26
2026-06-26 18:17Z
HIGH

CVE-2026-56876 — extract-zip does not validate symlink targets when extracting zip archives.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-56876

extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory. Depending on how extract-zip is used, an attacker could read or write to arbitrary files. CVSSv3.1 8.1 (HIGH)

CWECWE 22CWECWE 61TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-06-26
2026-06-26 18:17Z
HIGH

CVE-2026-55441 — mise manages dev tools like node, python, cmake, and terraform.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-55441

mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.6.4, mise's trust feature gates config files (mise.toml, .tool-versions) through trust_check, but task-include files are loaded on a path that never reaches it. When a directory has a task-include dir (mise-tasks/, .mise/tasks/, …) but no config file, mise falls back to the default includes and renders each task's tera fields — and that tera environment has exec() registered. A {{ exec(command='…') CVSSv3.1 8.6 (HIGH)

CWECWE 94CWECWE 732CWECWE 78TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-06-26
2026-06-26 18:16Z
CRIT

CVE-2026-33646 — Prior to 2026.3.10, mise processes .tool-versions files through the Tera template engine during parsing

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-33646

mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.3.10, mise processes .tool-versions files through the Tera template engine during parsing, with the exec() function registered, enabling arbitrary command execution. Unlike .mise.toml files, .tool-versions files are not subject to trust verification in non-paranoid mode. This means an attacker can place a malicious .tool-versions file in a git repository, and when a victim with mise activated cds in CVSSv3.1 9.6 (CRITICAL)

CWECWE 94TYPVulnerability
9.6
CVSS v3.1
98
Edit Score
2026-06-26
2026-06-26 17:16Z
HIGH

CVE-2026-57518 — Pagekit: CMS 1.0.18 contains a privilege escalation vulnerability that allows authenticated users with the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-57518

Pagekit CMS 1.0.18 contains a privilege escalation vulnerability that allows authenticated users with the 'user: manage users' permission to escalate privileges by assigning arbitrary custom roles to themselves due to missing authorization checks in UserApiController::saveAction(). Attackers can assign themselves a custom role with the 'system: manage packages' permission and then upload and install a malicious PHP package through the admin package installer to achieve remote CVSSv3.1 8.8 (HIGH)

CWECWE 862VNDPagekitTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-06-26
2026-06-26 17:16Z
HIGH

CVE-2026-56663 — AutoGPT: Prior to 0.6.52, an authenticated user can bypass the SSRF / private-IP protections in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-56663

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.52, an authenticated user can bypass the SSRF / private-IP protections in SendWebRequestBlock and reach internal network services. _is_ip_blocked() in backend/backend/util/request.py does not normalize IPv4-mapped IPv6 addresses before checking resolved IPs against the blocked IPv4 ranges, and does not block special-use ranges such as 100.64. CVSSv3.1 8.5 (HIGH)

CWECWE 918VNDAutogptTYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2026-06-26
2026-06-26 17:16Z
CRIT

CVE-2026-54636 — Dokku: Prior to 0.38.7, the cron plugin utilizes commands in the app.json file to manage

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-54636

Dokku is a docker-powered PaaS. Prior to 0.38.7, the cron plugin utilizes commands in the app.json file to manage system cron running as the Dokku user. An app.json cron command utilizing special shell characters - including, but not limited to, > or ; - can break out of the Docker container and execute commands on the host as the Dokku user. This vulnerability is fixed in 0.38.7. CVSSv3.1 9.0 (CRITICAL)

CWECWE 78VNDDokkuTYPVulnerability
9.0
CVSS v3.1
95
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-06-26
2026-06-26 17:16Z
CRIT

CVE-2026-45408 — Dokku Dokku: Prior to 0.38.2, the app name validation regex (^[a-z0-9][^/:_A-Z]*$) permits shell metacharacters.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-45408

Dokku is a docker-powered PaaS. Prior to 0.38.2, the app name validation regex (^[a-z0-9][^/:_A-Z]*$) permits shell metacharacters. When an authenticated user pushes to a git remote with a crafted app name, the name is embedded unquoted into a bash pre-receive hook script via an unquoted heredoc (<<EOF instead of <<'EOF') in fn-git-create-hook() at plugins/git/internal-functions:378. On git push, bash interprets the semicolon as a command separator, executing arbitrary comman CVSSv3.1 9.0 (CRITICAL)

CWECWE 78VNDDokkuTYPVulnerability
9.0
CVSS v3.1
95
Edit Score
2026-06-26
2026-06-26 17:16Z
CRIT

CVE-2026-45406 — Dokku: A filename containing a single quote breaks the quoting and allows command substitution to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-45406

Dokku is a docker-powered PaaS. Prior to 0.38.2, the openresty-vhosts plugin copies files from an app's openresty/http-includes/ git repository directory to the host and then interpolates their filenames, unescaped, into a single-quoted shell string that is later parsed by eval. A filename containing a single quote breaks the quoting and allows command substitution to execute arbitrary commands on the host as the dokku user during the app's next deploy. This vulnerability is CVSSv3.1 9.0 (CRITICAL)

CWECWE 95VNDDokkuTYPVulnerability
9.0
CVSS v3.1
95
Edit Score
2026-06-26
2026-06-26 17:16Z
CRIT

CVE-2026-45405 — Dokku Dokku: Prior to 0.38.2, the git:from-archive and certs:add commands extract user-supplied tar/zip archives into temporary

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-45405

Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:from-archive and certs:add commands extract user-supplied tar/zip archives into temporary directories without sanitizing member paths or preventing symlink traversal. GNU tar creates symlinks during extraction and follows them for subsequent entries, allowing an attacker to write arbitrary files anywhere writable by the dokku user — including overwriting ~/.ssh/authorized_keys to gain unrestricted shell access. This vul CVSSv3.1 9.0 (CRITICAL)

CWECWE 59VNDDokkuTYPVulnerability
9.0
CVSS v3.1
95
Edit Score
2026-06-26
2026-06-26 16:16Z
HIGH

CVE-2026-12411 — Broken: Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-12411

Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.volumes is enabled. CVSSv3.1 8.4 (HIGH)

CWECWE 862CWECWE 639VNDBrokenTYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-06-26
2026-06-26 16:16Z
CRIT

CVE-2026-0685 — Server: side template inject (SSTI) in the expression evaluation component in Genshi Template Engine

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-0685

Server side template inject (SSTI) in the expression evaluation component in Genshi Template Engine version 0.7.9 allows a remote attacker to achieve remote code execution (RCE) via crafted template expressions. CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-06-26
2026-06-26 16:16Z
CRIT

CVE-2025-11919 — JVM: The default JVM can access files and directories under `/tmp/` including the `$TemporaryDirectory` of

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-11919

The default JVM can access files and directories under `/tmp/` including the `$TemporaryDirectory` of other users on the same cloud instance (`/tmp/UserTemporaryFiles/`). The `-init` file for the the JVM initialization exists in the vulnerable directory during the startup of the JVM. An attacker with access to the shared `/tmp/` space can preemptively create or replace `.jar` files or directories (via the `-init` file) that the victim JVM will resolve first in its classpath CVSSv3.1 9.6 (CRITICAL)

VNDJvmTYPVulnerability
9.6
CVSS v3.1
98
Edit Score
2026-06-26
2026-06-26 15:16Z
HIGH

CVE-2026-57667 — Sales: Representative SQL Injection in Groundhogg <= 4.5 versions.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-57667

Sales Representative SQL Injection in Groundhogg <= 4.5 versions. CVSSv3.1 8.5 (HIGH)

CWECWE 89VNDSalesTYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2026-06-26
2026-06-26 15:16Z
HIGH

CVE-2026-57663 — Contributor: SQL Injection in Recipe Maker For Your Food Blog from Zip Recipes <=

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-57663

Contributor SQL Injection in Recipe Maker For Your Food Blog from Zip Recipes <= 8.2.7 versions. CVSSv3.1 8.5 (HIGH)

CWECWE 89VNDContributorTYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2026-06-26
2026-06-26 15:16Z
HIGH

CVE-2026-57662 — Contributor: SQL Injection in Contest Gallery <= 30.0.0 versions.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-57662

Contributor SQL Injection in Contest Gallery <= 30.0.0 versions. CVSSv3.1 8.5 (HIGH)

CWECWE 89VNDContributorTYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2026-06-26
2026-06-26 15:16Z
HIGH

CVE-2026-57659 — Site: Unauthenticated Cross Site Request Forgery (CSRF) in Paid Memberships Pro - Add Member From

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-57659

Unauthenticated Cross Site Request Forgery (CSRF) in Paid Memberships Pro - Add Member From Admin <= 0.7.2 versions. CVSSv3.1 8.8 (HIGH)

CWECWE 352TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-06-26
2026-06-26 15:16Z
CRIT

CVE-2026-57658 — Administrator: Arbitrary File Upload in TemplateSpare <= 4.2.0 versions.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-57658

Administrator Arbitrary File Upload in TemplateSpare <= 4.2.0 versions. CVSSv3.1 9.1 (CRITICAL)

CWECWE 434VNDAdministratorTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-06-26
2026-06-26 15:16Z
HIGH

CVE-2026-57655 — Site: Unauthenticated Cross Site Request Forgery (CSRF) in Child Theme Wizard <= 1.4 versions.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-57655

Unauthenticated Cross Site Request Forgery (CSRF) in Child Theme Wizard <= 1.4 versions. CVSSv3.1 8.2 (HIGH)

CWECWE 352TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-06-26
2026-06-26 15:16Z
HIGH

CVE-2026-57653 — Contributor: SQL Injection in WP Job Portal <= 2.5.2 versions.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-57653

Contributor SQL Injection in WP Job Portal <= 2.5.2 versions. CVSSv3.1 8.5 (HIGH)

CWECWE 89VNDContributorTYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2026-06-26
2026-06-26 15:16Z
HIGH

CVE-2026-57645 — Broken: newsletters_subscribers Broken Access Control in Newsletters <= 4.13 versions.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-57645

newsletters_subscribers Broken Access Control in Newsletters <= 4.13 versions. CVSSv3.1 8.1 (HIGH)

CWECWE 862VNDBrokenTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-06-26
2026-06-26 15:16Z
HIGH

CVE-2026-57644 — Contributor: SQL Injection in Restaurant Menu by MotoPress <= 2.4.10 versions.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-57644

Contributor SQL Injection in Restaurant Menu by MotoPress <= 2.4.10 versions. CVSSv3.1 8.5 (HIGH)

CWECWE 89VNDContributorTYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2026-06-26
2026-06-26 15:16Z
HIGH

CVE-2026-57643 — Contributor: SQL Injection in WP Post Author <= 3.9.1 versions.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-57643

Contributor SQL Injection in WP Post Author <= 3.9.1 versions. CVSSv3.1 8.5 (HIGH)

CWECWE 89VNDContributorTYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2026-06-26
2026-06-26 15:16Z
HIGH

CVE-2026-57642 — Contributor: SQL Injection in Gallery <= 4.7.8 versions.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-57642

Contributor SQL Injection in Gallery <= 4.7.8 versions. CVSSv3.1 8.5 (HIGH)

CWECWE 89VNDContributorTYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2026-06-26
2026-06-26 15:16Z
HIGH

CVE-2026-57636 — Contributor: SQL Injection in wpForo Forum <= 3.0.9 versions.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-57636

Contributor SQL Injection in wpForo Forum <= 3.0.9 versions. CVSSv3.1 8.5 (HIGH)

CWECWE 89VNDContributorTYPVulnerability
8.5
CVSS v3.1
93
Edit Score