Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-07 04:06Z
2026-06-04
2026-06-04 15:16Z
HIGH

CVE-2026-10863 — Misp Misp: Depending on how the value was processed by the underlying data access layer, this

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-10863

A security issue was fixed in the correlations over-correlation endpoint where the order query parameter was accepted from user-controlled named request parameters. This allowed an authenticated user to override the server-defined ordering of over-correlating values. Depending on how the value was processed by the underlying data access layer, this could allow manipulation of database query ordering and potentially expose the application to unsafe query construction. The p CVSSv3.1 8.1 (HIGH) · EPSS 17th percentile

CWECWE 20VNDMispTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-06-04
2026-06-04 14:16Z
CRIT

CVE-2026-8037 — Command: OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-8037

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints CVSSv3.1 9.6 (CRITICAL)

CWECWE 77VNDCommandTYPVulnerability
9.6
CVSS v3.1
98
Edit Score
2026-06-04
2026-06-04 14:16Z
HIGH

CVE-2025-59874 — HCL: Hive Telco Observability is affected by a Required directives missing from the CSP

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-59874

HCL Hive Telco Observability is affected by  a Required directives missing from the CSP issue is detected in keycloak component of the web application. Missing essential directives can leave a site vulnerable. CVSSv3.1 8.1 (HIGH)

CWECWE 1027VNDHclTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-06-04
2026-06-04 14:16Z
HIGH

CVE-2019-25745 — WordPress: Plugin Google Review Slider 6.1 contains a time-based blind SQL injection vulnerability that

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-25745

WordPress Plugin Google Review Slider 6.1 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'tid' parameter. Attackers can send GET requests to the admin interface with malicious 'tid' values to extract sensitive database information using time-based blind SQL injection techniques. CVSSv3.1 8.2 (HIGH)

CWECWE 89VNDWordpressTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-06-04
2026-06-04 14:16Z
CRIT

CVE-2019-25741 — Mobatek: MobaXterm 12.1 contains a structured exception handling (SEH) based buffer overflow vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-25741

Mobatek MobaXterm 12.1 contains a structured exception handling (SEH) based buffer overflow vulnerability in the username field of session files that allows remote attackers to execute arbitrary code. Attackers can craft a malicious MobaXterm sessions file with overflow data that triggers the vulnerability when imported and executed, enabling reverse shell execution with user privileges. CVSSv3.1 9.8 (CRITICAL)

CWECWE 120VNDMobatekTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-06-04
2026-06-04 14:16Z
CRIT

CVE-2019-25738 — WordPress: Hybrid Composer 1.4.6 contains an unauthenticated settings change vulnerability that allows unauthenticated attackers

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-25738

WordPress Hybrid Composer 1.4.6 contains an unauthenticated settings change vulnerability that allows unauthenticated attackers to modify WordPress options by exploiting the hc_ajax_save_option action. Attackers can send POST requests to the admin-ajax.php endpoint with the action parameter set to hc_ajax_save_option to enable user registration and set the default role to administrator, enabling account takeover. CVSSv3.1 9.8 (CRITICAL)

CWECWE 306VNDWordpressTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-06-04
2026-06-04 14:16Z
HIGH

CVE-2019-25736 — LabF: nfsAxe 3.7 Ping Client contains a buffer overflow vulnerability that allows local attackers

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-25736

LabF nfsAxe 3.7 Ping Client contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious payload in the Host IP field. Attackers can craft a specially formatted input file with shellcode and overwrite the return address to execute calc.exe or other arbitrary commands. CVSSv3.1 8.4 (HIGH)

CWECWE 120VNDLabfTYPVulnerability
8.4
CVSS v3.1
92
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-06-04
2026-06-04 14:16Z
HIGH

CVE-2019-25735 — AllPlayer: 7.4 contains a local buffer overflow vulnerability in URL handling that allows attackers

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-25735

AllPlayer 7.4 contains a local buffer overflow vulnerability in URL handling that allows attackers to overwrite structured exception handling pointers by supplying an excessively long URL string. Attackers can craft a malicious URL, paste it into the Open URL dialog, and trigger SEH-based code execution to run arbitrary commands with user privileges. CVSSv3.1 8.4 (HIGH)

CWECWE 120VNDAllplayerTYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-06-04
2026-06-04 14:16Z
HIGH

CVE-2019-25733 — NetShareWatcher: 1.5.8.0 contains a structured exception handler buffer overflow vulnerability that allows local attackers

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-25733

NetShareWatcher 1.5.8.0 contains a structured exception handler buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying malicious input. Attackers can craft a payload with overwritten SEH and NSEH pointers through the Restrictions custom filter field to trigger code execution when the Find function is invoked. CVSSv3.1 8.4 (HIGH)

CWECWE 120VNDNetsharewatcherTYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-06-04
2026-06-04 14:16Z
HIGH

CVE-2019-25732 — PHP: EI-Tube Script 3 contains an SQL injection vulnerability that allows unauthenticated attackers to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-25732

PHP EI-Tube Script 3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the search parameter. Attackers can send GET requests to the search endpoint with crafted SQL payloads in the query parameter to extract sensitive database information including usernames, passwords, and version details. CVSSv3.1 8.2 (HIGH)

CWECWE 89TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-06-04
2026-06-04 14:16Z
HIGH

CVE-2019-25730 — Listing: Hub CMS 1.0 contains a SQL injection vulnerability that allows unauthenticated attackers to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-25730

Listing Hub CMS 1.0 contains a SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to pages.php with crafted id values using error-based SQL injection techniques to extract database credentials, usernames, and version information. CVSSv3.1 8.2 (HIGH)

CWECWE 89VNDListingTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-06-04
2026-06-04 14:16Z
CRIT

CVE-2019-25729 — PDF: Signer 3.0 contains a server-side template injection vulnerability that allows unauthenticated attackers to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-25729

PDF Signer 3.0 contains a server-side template injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP commands through the CSRF-TOKEN cookie parameter. Attackers can craft malicious cookie values containing template injection payloads like shell_exec() to execute system commands and retrieve sensitive information from the server. CVSSv3.1 9.8 (CRITICAL)

CWECWE 352VNDPdfTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-06-04
2026-06-04 14:16Z
HIGH

CVE-2019-25728 — Care2x: 2.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-25728

Care2x 2.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL commands by manipulating the ck_config cookie parameter. Attackers can inject malicious SQL through the ck_config cookie in multiple endpoints including login.php, indexframe.php, and various module files to extract sensitive database information without authentication. CVSSv3.1 8.2 (HIGH)

CWECWE 89VNDCare2xTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-06-04
2026-06-04 14:16Z
CRIT

CVE-2019-25727 — WordPress: Plugin ad manager wd 1.0.11 contains an arbitrary file download vulnerability that allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-25727

WordPress Plugin ad manager wd 1.0.11 contains an arbitrary file download vulnerability that allows unauthenticated attackers to download sensitive files by manipulating the path parameter. Attackers can send GET requests to the edit.php endpoint with export=export_csv and a malicious path parameter to read arbitrary files like wp-config.php accessible to the web server. CVSSv3.1 9.8 (CRITICAL)

CWECWE 22VNDWordpressTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-06-04
2026-06-04 14:16Z
HIGH

CVE-2019-25726 — One: All in One Video Downloader 1.2 contains an SQL injection vulnerability that allows unauthenticated

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-25726

All in One Video Downloader 1.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send requests to the admin interface with UNION-based SQL injection payloads in the id parameter to extract sensitive database information including usernames, databases, and version details. CVSSv3.1 8.2 (HIGH)

CWECWE 89VNDOneTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-06-04
2026-06-04 12:16Z
CRIT

CVE-2026-4104 — Authorization: bypass through User-Controlled SQL primary key vulnerability in Akmer Informatics Automation Industry and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4104

Authorization bypass through User-Controlled SQL primary key vulnerability in Akmer Informatics Automation Industry and Trade Ltd. Co. TeknoPass allows SQL Injection. This issue affects TeknoPass: from 20210501 through 20260429. CVSSv3.1 9.8 (CRITICAL)

CWECWE 89TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-06-04
2026-06-04 12:16Z
CRIT

CVE-2026-10840 — A flaw was found in the OpenShift Pipelines operator.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-10840

A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the cluster, any authenticated user can disrupt workload scheduling, tamper with scheduling priorities, delete other tenants' Workload objects, or induce cert-manager to overwrite TLS Secret CVSSv3.1 9.6 (CRITICAL)

CWECWE 732TYPVulnerability
9.6
CVSS v3.1
98
Edit Score
2026-06-04
2026-06-04 12:00Z
CRIT

VerdantBamboo: Just Another BRICKSTORM in the Firewall

Volexity·volexity.comin the wild

Volexity disclosed a 18+ month intrusion by Chinese APT VerdantBamboo (WARP PANDA, UNC5221) targeting a victim organization and its MSP via compromised Egnyte Storage Sync and pfSense firewall appliances. The threat actor deployed three malware families—BRICKSTORM (Golang/Rust RAT), AGENTPSD (Python reverse shell), and PLENET (.NET Core backdoor)—to establish persistent access, bypass Conditional Access policies on M365, and pivot through the victim's infrastructure. The attack exploited a local privilege escalation in Egnyte's sudo configuration, credential theft from the MSP, and exposed firewall administrative interfaces.

SRFApplicationTACTA0004TACTA0005TACTA0001SRFNetwork ApplianceTACTA0003TACTA0008TACTA0011
92
Edit Score
2026-06-04
2026-06-04 10:16Z
CRIT

CVE-2026-50225 — Acer Connect_m6e_5g_firmware: The registration path /v1/account/register provides no bot mitigation mechanisms, allowing malicious automated systems to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-50225

The registration path /v1/account/register provides no bot mitigation mechanisms, allowing malicious automated systems to flood the database. CVSSv3.1 9.1 (CRITICAL) · EPSS 13th percentile

CWECWE 306VNDAcerTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-06-04
2026-06-04 10:16Z
CRIT

CVE-2026-50214 — Acer Connect_m6e_5g_firmware: The /v1/Plan service relies entirely on a shared global API token for full administrative

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-50214

The /v1/Plan service relies entirely on a shared global API token for full administrative management, allowing arbitrary creation of zero-cost network access plans. CVSSv3.1 9.8 (CRITICAL) · EPSS 5th percentile

CWECWE 345VNDAcerTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-06-04
2026-06-04 09:16Z
CRIT

CVE-2026-50211 — Acer Connect_m6e_5g_firmware: Leftover engineering diagnostics and factory-level diagnostic software remain exposed on retail builds, giving malicious

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-50211

Leftover engineering diagnostics and factory-level diagnostic software remain exposed on retail builds, giving malicious apps write privileges to internal NVRAM registers. CVSSv3.1 9.8 (CRITICAL)

CWECWE 134VNDAcerVNDLeftoverTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-06-04
2026-06-04 09:16Z
CRIT

CVE-2026-50208 — Acer Connect_m6e_5g_firmware: Combined with hard-coded DES symmetric encryption keys, a Man-in-the-Middle (MITM) actor could decrypt network

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-50208

High-risk TrustAllCerts routines disable standard TLS certificate validation. Combined with hard-coded DES symmetric encryption keys, a Man-in-the-Middle (MITM) actor could decrypt network traffic. CVSSv3.1 9.4 (CRITICAL)

CWECWE 330VNDAcerVNDHighTYPVulnerability
9.4
CVSS v3.1
97
Edit Score
2026-06-04
2026-06-04 07:16Z
HIGH

CVE-2026-50205 — Acer Connect_m6e_5g_firmware: System log files output unencrypted SMTP server authentication passwords alongside sensitive employee corporate identification

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-50205

System log files output unencrypted SMTP server authentication passwords alongside sensitive employee corporate identification data. CVSSv3.1 8.2 (HIGH)

CWECWE 532VNDAcerTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-06-04
2026-06-04 07:16Z
HIGH

CVE-2026-49203 — Acer Connect_m6e_5g_firmware: Crucial management API endpoints for cellular eSIM allocation do not validate caller authorization, allowing

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-49203

Crucial management API endpoints for cellular eSIM allocation do not validate caller authorization, allowing remote profiles to be rewritten or deleted. CVSSv3.1 8.3 (HIGH)

CWECWE 287VNDAcerVNDCrucialTYPVulnerability
8.3
CVSS v3.1
92
Edit Score
2026-06-04
2026-06-04 07:16Z
HIGH

CVE-2026-49202 — Acer Connect_m6e_5g_firmware: Internal multimedia session archives are accessible without authentication, exacerbated by loose Cross-Origin Resource Sharing

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-49202

Internal multimedia session archives are accessible without authentication, exacerbated by loose Cross-Origin Resource Sharing (CORS) rules that allow cross-site theft. CVSSv3.1 8.6 (HIGH)

CWECWE 287VNDAcerTYPVulnerability
8.6
CVSS v3.1
93
Edit Score