Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-06 14:55Z
2026-06-05
2026-06-05 20:17Z
CRIT

CVE-2026-11420 — Altium On-prem_enterprise_server: Two path traversal vulnerabilities in the Network Installation Service (NIS) of Altium Enterprise Server

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-11420

Two path traversal vulnerabilities in the Network Installation Service (NIS) of Altium Enterprise Server allow an unauthenticated network attacker to write arbitrary files to any writable location on the server filesystem and to read package archive files from the server. No authentication, session, or credentials are required. Because content-controlled files can be written to web-accessible directories, or used to overwrite application binaries or configuration files, e CVSSv3.1 9.8 (CRITICAL) · EPSS 50th percentile

CWECWE 306CWECWE 22VNDTwoVNDAltiumTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-06-05
2026-06-05 20:17Z
HIGH

CVE-2026-11419 — Altium On-prem_enterprise_server: A path traversal vulnerability exists in the Altium Enterprise Server Vault Service UploadController due

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-11419

A path traversal vulnerability exists in the Altium Enterprise Server Vault Service UploadController due to improper validation of a user-controlled path component in image upload requests. An authenticated user can supply a crafted absolute path so that the configured storage root is discarded, allowing arbitrary files to be written to any location on the server filesystem writable by the service account. Because content-controlled files can be written to web-accessible CVSSv3.1 8.8 (HIGH) · EPSS 39th percentile

CWECWE 434CWECWE 22VNDAltiumTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-06-05
2026-06-05 20:17Z
CRIT

CVE-2026-11414 — Altium On-prem_enterprise_server: A hard-coded cryptographic key is used by Altium Enterprise Server to sign file download

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-11414

A hard-coded cryptographic key is used by Altium Enterprise Server to sign file download URLs in the Vault service. Because the key is identical across all installations, an unauthenticated network attacker who can reach the server can forge valid download signatures and retrieve files from the Vault storage area without any authentication, session, or credentials. A separate path traversal vulnerability in the same download endpoint allows the configured storage root to be CVSSv3.1 9.8 (CRITICAL) · EPSS 33th percentile

CWECWE 22CWECWE 798VNDAltiumTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-06-05
2026-06-05 20:17Z
HIGH

CVE-2026-11401 — An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced Go Wrapper

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-11401

An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rds_superuser, via a crafted function created by the actor that runs when that user connects to the cluster through the affected wrapper. To remediate this issue, users should upgrade to the AWS Advanced Go Wrapper release 2026-05-26 CVSSv3.1 8.0 (HIGH)

CWECWE 426TYPVulnerability
8.0
CVSS v3.1
90
Edit Score
2026-06-05
2026-06-05 20:17Z
HIGH

CVE-2026-11400 — An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced JDBC Wrapper

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-11400

An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rds_superuser, via a crafted function created by the actor that runs when that user connects to the cluster through an affected wrapper. To remediate this issue, users should upgrade to AWS Advanced JDBC Wrapper version 4.0.1. CVSSv3.1 8.0 (HIGH)

CWECWE 426TYPVulnerability
8.0
CVSS v3.1
90
Edit Score
2026-06-05
2026-06-05 19:41Z
CRIT

CVE-2026-0257 | Palo Alto Networks PAN-OS GlobalProtect Authentication Bypass Vulnerability | Active Exploitation

Horizon3.ai·horizon3.aiCVE-2026-0257in the wild0day

CVE-2026-0257 is a critical authentication bypass in Palo Alto Networks PAN-OS GlobalProtect portal/gateway that allows unauthenticated attackers to establish unauthorized VPN sessions by exploiting insufficient validation of authentication override cookies. The vulnerability affects PAN-OS 10.2, 11.1, 11.2, and 12.1 branches, with active exploitation confirmed since May 17, 2026, and inclusion in CISA's KEV catalog. Patches are available across all affected branches.

TACTA0001SRFNetwork ApplianceSWPan OsVNDPaloaltonetworksTYPVulnerabilitySTGInitial AccessTECT1133EXPAuth Bypass
92
Edit Score
2026-06-05
2026-06-05 19:16Z
HIGH

CVE-2026-5415 — Captcha: The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-5415

The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.38. This is due to the ajax_run_tool() AJAX handler relying solely on a nonce check (check_ajax_referer) for security without performing any capability check, combined with the create_temporary_link tool allowing the generation of passwordless login links for arbitrary user CVSSv3.1 8.8 (HIGH)

CWECWE 288VNDCaptchaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-06-05
2026-06-05 19:16Z
HIGH

CVE-2026-5411 — Captcha: The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-5411

The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 5.38. This is due to a capability check in the save_ajax() function of the licensing module, combined with unrestricted file extraction in sync_cloud_protection(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary CVSSv3.1 8.8 (HIGH)

CWECWE 434VNDCaptchaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-06-05
2026-06-05 19:16Z
HIGH

CVE-2026-46392 — HAX: CMS helps manage microsite universe with PHP or NodeJs backends.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-46392

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0 of HAX CMS PHP, the `saveFile` endpoint validates upload extensions case-insensitively and writes the filename to disk verbatim, but the `.htaccess` rule that forces `Content-Disposition: attachment` on HTML files is case-sensitive. An HTML file uploaded with an uppercase extension (`.HTML`, `.Html`, `.HTM`) is still served as `text/html` but the forced-download header never applies, CVSSv3.1 8.7 (HIGH)

CWECWE 434CWECWE 178VNDHaxTYPVulnerability
8.7
CVSS v3.1
94
Edit Score
2026-06-05
2026-06-05 19:16Z
CRIT

CVE-2026-46389 — UDS: Identity Config builds the Keycloak configuration image (realm, plugins, theme, truststore, JARs) consumed

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-46389

UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, truststore, JARs) consumed by UDS Core's Identity deployment. In versions 0.11.0 through 0.26.0, a logic error in the `client-kubernetes-secret` Keycloak client authenticator (shipped by `uds-identity-config` and consumed by UDS Core) causes the submitted `client_secret` to be overwritten with the mounted Kubernetes secret before comparison. An attacker who can reach the Keycloak token endpoin CVSSv3.1 10.0 (CRITICAL)

CWECWE 287CWECWE 303VNDUdsTYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2026-06-05
2026-06-05 19:16Z
CRIT

CVE-2026-10580 — Hippoo: The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-10580

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to and including 1.9.4. This is due to a logic conflation in HippooPermissions::get_user_permissions(), which returns the same null sentinel for both administrators and unauthenticated visitors — a value that HippooPermissions::has_role_access() unconditionally interprets as full administrator access — causing override_ CVSSv3.1 9.8 (CRITICAL)

CWECWE 285VNDHippooTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-06-05
2026-06-05 18:17Z
HIGH

CVE-2026-50733 — Markdown: When a victim previews or exports a crafted markdown document, an attacker can execute

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-50733

Markdown Preview Enhanced before 0.8.28 parses WaveDrom diagrams by evaluating untrusted markdown content with eval(), allowing arbitrary JavaScript execution. The flaw affects every render path - the live preview (window.eval) and presentation mode plus HTML export (the bundled WaveDrom.ProcessAll()/eva() helpers) - and can also be triggered through a <script type="WaveDrom"> element injected via raw HTML in markdown. When a victim previews or exports a crafted markdown docu CVSSv3.1 8.8 (HIGH)

CWECWE 95VNDMarkdownTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-06-05
2026-06-05 18:17Z
HIGH

CVE-2026-49493 — Markdown: Preview Enhanced before 0.8.28 parses Bitfield fenced code blocks with interpretJS(), which evaluates

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-49493

Markdown Preview Enhanced before 0.8.28 parses Bitfield fenced code blocks with interpretJS(), which evaluates the block content as code via vm.runInNewContext(), allowing arbitrary code execution. A crafted markdown document containing a malicious bitfield code block executes attacker-controlled code on the server side when the document is rendered or exported. Fixed in 0.8.28 by parsing bitfield register definitions with JSON5.parse(), since they are purely data. CVSSv3.1 8.8 (HIGH)

CWECWE 94VNDMarkdownTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-06-05
2026-06-05 18:17Z
HIGH

CVE-2026-49492 — Markdown: Preview Enhanced before 0.8.28 opens external files and links from the preview through

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-49492

Markdown Preview Enhanced before 0.8.28 opens external files and links from the preview through a shell and does not validate untrusted inputs taken from the markdown document - the diagram filename attribute, imported file paths, and the latex_engine code-chunk attribute. On Windows, a crafted markdown document can inject operating system commands that execute when the document is previewed. Fixed in 0.8.28 by passing these inputs as literal arguments instead of through a sh CVSSv3.1 8.8 (HIGH)

CWECWE 78VNDMarkdownTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-06-05
2026-06-05 18:17Z
CRIT

CVE-2026-45750 — Termix: Prior to version 2.3.2, the GET /ssh/file_manager/ssh/resolvePath endpoint in the Termix File Manager component

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-45750

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the GET /ssh/file_manager/ssh/resolvePath endpoint in the Termix File Manager component unsafely processes the path parameter and embeds it into a shell command executed over the active SSH session. Because the user-controlled value is placed inside double quotes and only double quotes are escaped, shell command substitution syntax such as $(.. CVSSv3.1 9.0 (CRITICAL)

CWECWE 639CWECWE 78VNDTermixTYPVulnerability
9.0
CVSS v3.1
95
Edit Score
2026-06-05
2026-06-05 18:17Z
HIGH

CVE-2026-45749 — Termix: An attacker who obtains a user's password (phishing, credential stuffing, the passwordHash leak in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-45749

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The `POST /users/totp/disable` and `POST /users/totp/backup-codes` endpoints in Termix prior to version 2.3.2 accept the account password as a sole authentication factor for MFA-critical operations. An attacker who obtains a user's password (phishing, credential stuffing, the passwordHash leak in GHSA-xxxx) can disable TOTP entirely or regenerate backup codes, without CVSSv3.1 8.1 (HIGH)

CWECWE 308VNDTermixTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-06-05
2026-06-05 18:17Z
CRIT

CVE-2026-45748 — Termix: The `POST /ssh/tunnel/connect` endpoint in Termix prior to version 2.3.2 builds an SSH tunnel

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-45748

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The `POST /ssh/tunnel/connect` endpoint in Termix prior to version 2.3.2 builds an SSH tunnel command by interpolating user-controlled host record fields (`endpointIP`, `endpointUsername`, `password`) directly into a shell command without escaping, allowing persistent OS command injection on the source SSH host. Version 2.3.2 patches the issue. CVSSv3.1 9.8 (CRITICAL)

CWECWE 78VNDTermixTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-06-05
2026-06-05 18:17Z
CRIT

CVE-2026-45746 — Termix: This allows an attacker to manipulate the value and access active File Manager sessions

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-45746

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the File Manager functionality in Termix contains a critical Broken Access Control vulnerability due to improper validation of the sessionId parameter. The backend trusts a client-controlled identifier without verifying that it belongs to the authenticated user. This allows an attacker to manipulate the value and access active File Manager sess CVSSv3.1 9.0 (CRITICAL)

CWECWE 639CWECWE 284VNDTermixTYPVulnerability
9.0
CVSS v3.1
95
Edit Score
2026-06-05
2026-06-05 18:17Z
HIGH

CVE-2026-45745 — Termix: This can lead to credential theft and JWT/session theft during login and normal use.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-45745

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Starting in version 1.7.0, Termix Desktop (Electron) disables TLS certificate validation, allowing a machine-in-the-middle attacker to intercept and modify HTTPS traffic to the configured Termix server. This can lead to credential theft and JWT/session theft during login and normal use. As of time of publication, no known patched versions are available. CVSSv3.1 8.0 (HIGH)

CWECWE 295VNDTermixTYPVulnerability
8.0
CVSS v3.1
90
Edit Score
2026-06-05
2026-06-05 18:17Z
CRIT

CVE-2026-45744 — Termix: Prior to version 2.3.2, the GET /ssh/file_manager/ssh/resolvePath endpoint in Termix is vulnerable to OS

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-45744

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the GET /ssh/file_manager/ssh/resolvePath endpoint in Termix is vulnerable to OS command injection. The endpoint uses double-quote escaping for shell command construction, which does not prevent $(...) and backtick command substitution. Any authenticated user with an active File Manager SSH session can execute arbitrary commands on the connecte CVSSv3.1 9.9 (CRITICAL)

CWECWE 78VNDTermixTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-06-05
2026-06-05 18:17Z
HIGH

CVE-2026-45743 — Termix: 16 file-manager endpoints in Termix prior to version 2.3.2 do not verify that the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-45743

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. 16 file-manager endpoints in Termix prior to version 2.3.2 do not verify that the requesting user owns the SSH session identified by `sessionId`. An authenticated attacker who knows or guesses another user's active `sessionId` can read, write, delete, download, and execute files on the victim's connected SSH host. Version 2.3.2 patches the issue. CVSSv3.1 8.1 (HIGH)

CWECWE 639VNDTermixTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-06-05
2026-06-05 18:17Z
HIGH

CVE-2026-45327 — TinyIce: In versions 0.8.95 through 2.4.1, missing authentication on WebRTC ingest endpoint allows unauthenticated stream

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-45327

TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection. Version 2.5.0 fixes the issue by requiring either HTTP Basic auth or a `?password=` query parameter, comparing the supplied password against the per-mount source password (or the `default_source_password` fallback) using bcrypt, hooking into the existing brute-force IP rate-limiter (5 failed attempts per CVSSv3.1 8.2 (HIGH)

CWECWE 306VNDTinyiceTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-06-05
2026-06-05 18:17Z
CRIT

CVE-2026-36500 — An issue in the cluster-admin:backup-datastore component of Controller v12.0.5 allows attackers to execute a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-36500

An issue in the cluster-admin:backup-datastore component of Controller v12.0.5 allows attackers to execute a directory traversal via a crafted request. CVSSv3.1 9.1 (CRITICAL) · EPSS 16th percentile

CWECWE 22TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-06-05
2026-06-05 18:16Z
CRIT

CVE-2025-71318 — NetMan: A remote, unauthenticated attacker can directly request administrative pages (such as administration.html, administration-commands.html, and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-71318

NetMan 204 fails to enforce authentication on its administrative pages and command endpoints. A remote, unauthenticated attacker can directly request administrative pages (such as administration.html, administration-commands.html, and configuration.html) to disclose sensitive information including LDAP configuration and active user details, and can invoke privileged UPS control commands — including shutdown, reboot, switch-on-bypass, and battery test — without supplying any c CVSSv3.1 9.8 (CRITICAL)

CWECWE 306VNDNetmanTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-06-05
2026-06-05 18:16Z
CRIT

CVE-2025-71317 — NetMan: 204 contains a hard-coded backdoor account with the username and password 'eurek' that

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-71317

NetMan 204 contains a hard-coded backdoor account with the username and password 'eurek' that grants administrative access. A remote, unauthenticated attacker can authenticate through the cgi-bin/login.cgi endpoint (for example /cgi-bin/login.cgi?username=eurek&password=eurek, which due to lax parameter validation can be shortened to /cgi-bin/login.cgi?username=eurek%20eurek) to obtain administrator privileges, allowing them to alter device configuration, enable the telnet/SS CVSSv3.1 9.8 (CRITICAL)

CWECWE 798VNDNetmanTYPVulnerability
9.8
CVSS v3.1
99
Edit Score