opsecsafe — cyber intelligence

2026-05-29

2026-05-29 13:16Z

CRIT

CVE-2026-45312 — RAGFlow: In 0.24.0 and earlier, a Jinja2 template injection in the prompt generator (rag/prompts/generator.py) allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-45312

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In 0.24.0 and earlier, a Jinja2 template injection in the prompt generator (rag/prompts/generator.py) allows any authenticated user to execute arbitrary OS commands on the server. Any normal user can register, create a Canvas workflow with a DuckDuckGo + LLM component chain, and trigger the SSTI. CVSSv3.1 9.9 (CRITICAL)

CWECWE 1336VNDRagflowTYPVulnerability

9.9

CVSS v3.1

100

Edit Score

2026-05-29

2026-05-29 13:16Z

CRIT

CVE-2026-10071 — DreamMaker: developed by Interinfo has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-10071

DreamMaker developed by Interinfo has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server. CVSSv3.1 9.8 (CRITICAL)

CWECWE 434VNDDreammakerTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-05-29

2026-05-29 13:00Z

CRIT

Looting UniFi Controllers: Detecting and Weaponizing CVE-2026-22557

Bishop Fox Labs·bishopfox.comCVE-2026-22557 CVE-2026-22558 CVE-2026-22559

CVE-2026-22557 is an unauthenticated path traversal in UniFi Network Application's guest captive portal (CVSS 10.0) that allows reading arbitrary files including encrypted backups containing all device credentials. The vulnerability requires a customized guest portal to be enabled and is reachable on both guest and admin ports. Bishop Fox published a safe detection tool and detailed exploitation paths showing how attackers extract backups, decrypt them with hardcoded keys, and compromise all managed network devices.

TACTA0001SRFNetworkTACTA0007SRFWebSWUnifiVNDUbiquitiTYPResearchTYPVulnerability

Edit Score

2026-05-29

2026-05-29 12:16Z

CRIT

CVE-2026-9559 — A path traversal vulnerability exists in the campaign import feature of Mautic 7.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-9559

A path traversal vulnerability exists in the campaign import feature of Mautic 7. When extracting uploaded ZIP files during campaign imports, a flaw in the validation logic allows file paths to escape the intended temporary directories. An authenticated user with campaign import privileges (campaign:imports:create) can write arbitrary PHP files to sensitive system directories. An attacker can exploit this to overwrite critical internal configuration or cache components, resul CVSSv3.1 9.9 (CRITICAL)

CWECWE 98CWECWE 22CWECWE 73TYPVulnerability

9.9

CVSS v3.1

100

Edit Score

2026-05-29

2026-05-29 12:16Z

CRIT

CVE-2025-41277 — Waterfall-security Wf-500_firmware: Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-41277

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to execute arbitrary operating system commands on the device. CVSSv3.1 9.8 (CRITICAL)

CWECWE 78VNDWaterfall SecurityVNDNozomiTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-05-29

2026-05-29 12:16Z

CRIT

CVE-2025-41276 — Waterfall-security Wf-500_firmware: Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-41276

CWECWE 78VNDWaterfall SecurityVNDNozomiTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-05-29

2026-05-29 12:16Z

CRIT

CVE-2025-41275 — Waterfall-security Wf-500_firmware: Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-41275

CWECWE 78VNDWaterfall SecurityVNDNozomiTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-05-29

2026-05-29 12:16Z

CRIT

CVE-2025-41274 — Waterfall-security Wf-500_firmware: Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-41274

CWECWE 78VNDWaterfall SecurityVNDNozomiTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-05-29

2026-05-29 12:16Z

CRIT

CVE-2025-41273 — Waterfall-security Wf-500_firmware: Nozomi Networks Labs identified a CWE-288: Authentication Bypass Using an Alternate Path or Channel

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-41273

Nozomi Networks Labs identified a CWE-288: Authentication Bypass Using an Alternate Path or Channel in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to bypass authentication of the Console web application and perform actions as an authenticated user. CVSSv3.1 9.8 (CRITICAL)

CWECWE 288VNDWaterfall SecurityVNDNozomiTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-05-29

2026-05-29 12:16Z

CRIT

CVE-2025-41272 — Waterfall-security Wf-500_firmware: Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-41272

CWECWE 78VNDWaterfall SecurityVNDNozomiTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-05-29

2026-05-29 12:16Z

CRIT

CVE-2025-41270 — Waterfall-security Wf-500_firmware: Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-41270

CWECWE 78VNDWaterfall SecurityVNDNozomiTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-05-29

2026-05-29 12:16Z

CRIT

CVE-2025-41269 — Waterfall-security Wf-500_firmware: Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-41269

CWECWE 78VNDWaterfall SecurityVNDNozomiTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-05-29

2026-05-29 12:16Z

CRIT

CVE-2025-41268 — Waterfall-security Wf-500_firmware: Nozomi Networks Labs identified a CWE-23: Relative Path Traversal in the Administration WebUI in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-41268

Nozomi Networks Labs identified a CWE-23: Relative Path Traversal in the Administration WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to delete arbitrary files on the Host machines. CVSSv3.1 9.1 (CRITICAL)

CWECWE 23VNDWaterfall SecurityVNDNozomiTYPVulnerability

9.1

CVSS v3.1

Edit Score

2026-05-29

2026-05-29 11:16Z

CRIT

CVE-2026-9558 — Server: A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-9558

A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse this to execute arbitrary code on the hosting server (Remote Code Execution) or access restricted system files and configuration settings. CVSSv3.1 9.9 (CRITICAL)

CWECWE 1336TYPVulnerability

9.9

CVSS v3.1

100

Edit Score

2026-05-29

2026-05-29 11:16Z

CRIT

CVE-2026-49201 — Acer Wave_7_firmware: This allows an attacker to decrypt, modify, and re-encrypt system backups, facilitating persistent backdoor

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-49201

The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryption key. This allows an attacker to decrypt, modify, and re-encrypt system backups, facilitating persistent backdoor injection. CVSSv3.1 9.8 (CRITICAL) · EPSS 9th percentile

CWECWE 798VNDAcerTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-05-29

2026-05-29 09:16Z

HIGH

CVE-2026-6075 — Media: The Media Library Assistant plugin for WordPress is vulnerable to Cross-Site Request Forgery in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-6075

The Media Library Assistant plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.35 This is due to missing nonce verification on the bulk action handlers in the settings tab handlers. This makes it possible for unauthenticated attackers to trick an administrator into performing bulk delete, edit, or purge operations on plugin settings and attachment metadata via a forged request. CVSSv3.1 8.1 (HIGH)

CWECWE 352VNDMediaTYPVulnerability

8.1

CVSS v3.1

Edit Score

2026-05-29

2026-05-29 09:16Z

CRIT

CVE-2026-49200 — Acer Wave_7_firmware: This file contains cleartext login credentials (for web and Telnet), leading to unauthorized system

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-49200

The acer_cgi.log file in the device firmware is accessible without authentication via the web interface. This file contains cleartext login credentials (for web and Telnet), leading to unauthorized system access. CVSSv3.1 9.8 (CRITICAL) · EPSS 19th percentile

CWECWE 532VNDAcerTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-05-29

2026-05-29 09:16Z

CRIT

CVE-2026-49199 — Acer Predator_connect_w6x_firmware: Crafted MQTT messages can trigger command injection, resulting in root-level code execution on the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-49199

Crafted MQTT messages can trigger command injection, resulting in root-level code execution on the target device. CVSSv3.1 9.8 (CRITICAL) · EPSS 73th percentile

CWECWE 77VNDAcerVNDCraftedTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-05-29

2026-05-29 09:16Z

CRIT

CVE-2026-49197 — Acer Predator_connect_w6x_firmware: Web endpoints intended for the Acer Connect app improperly validate the HTTP Authorization header

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-49197

Web endpoints intended for the Acer Connect app improperly validate the HTTP Authorization header, failing to block requests when Base64 decoding fails. CVSSv3.1 9.8 (CRITICAL)

CWECWE 287VNDWebVNDAcerTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-05-29

2026-05-29 09:16Z

HIGH

CVE-2026-49195 — Acer Predator_connect_w6x_firmware: Unauthenticated Debug Service.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-49195

Unauthenticated Debug Service. The /sbin/mtk_dut binary is exposed on TCP port 9000 without authentication, allowing any LAN-based attacker to execute arbitrary UCC commands. CVSSv3.1 8.8 (HIGH) · EPSS 7th percentile

CWECWE 306VNDDebugVNDAcerTYPVulnerability

8.8

CVSS v3.1

Edit Score

2026-05-29

2026-05-29 08:16Z

CRIT

CVE-2026-3655 — OTP: The OTP Login With Phone Number, OTP Verification plugin for WordPress is vulnerable to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-3655

The OTP Login With Phone Number, OTP Verification plugin for WordPress is vulnerable to authentication bypass in versions 1.8.50 through 1.8.60. This is due to the Firebase verification flow in the `lwp_ajax_register` AJAX handler not binding the Firebase session to the phone number supplied in the request. The `idehweb_lwp_activate_through_firebase()` function validates that a Firebase OTP session is legitimate, but the `phoneNumber` returned by Firebase is never compared ag CVSSv3.1 9.8 (CRITICAL)

CWECWE 287VNDOtpTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-05-29

2026-05-29 07:16Z

CRIT

CVE-2026-8732 — Maps: The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-8732

The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all versions up to, and including, 6.1.0. This is due to the wpgmp_temp_access_ajax AJAX action being registered with wp_ajax_nopriv_ and protected only by a nonce check using the fc-call-nonce nonce, which is publicly embedded into every frontend page via wp_localize_script as the nonce field of the wpgmp_local JavaScript object, rendering the check ineffective as CVSSv3.1 9.8 (CRITICAL)

CWECWE 306VNDMapsTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-05-29

2026-05-29 07:16Z

HIGH

CVE-2025-11993 — WooCommerce: The WooCommerce Infinite Scroll and Ajax Pagination plugin for WordPress is vulnerable to PHP

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-11993

The WooCommerce Infinite Scroll and Ajax Pagination plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8 via the 'settings' parameter in the 'import_settings' function. This is due to deserialization of untrusted data supplied via the import configuration feature without capability checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. No POP chain is present w CVSSv3.1 8.8 (HIGH)

CWECWE 502VNDWoocommerceTYPVulnerability

8.8

CVSS v3.1

Edit Score

2026-05-29

2026-05-29 07:00Z

HIGH

What’s in the container? Analyzing vulnerabilities, risks and protection with Kaspersky Container Security and the KIRA AI assistant

Kaspersky Securelist·securelist.comCVE-2025-55182 CVE-2023-4911 CVE-2021-4034 CVE-2025-49844 CVE-2026-24061 CVE-2025-32463

Kaspersky's analysis of 100 popular Docker Hub images reveals systemic container security failures: 64% contain critical unpatched vulnerabilities (Redis RCE, nginx DoS/RCE, sudo/glibc privesc), hardcoded credentials in layer history, passwordless sudo configurations, and world-writable directories enabling privilege escalation. Only 10% of analyzed images are fully up-to-date; the research demonstrates how supply-chain risks (Trivy/LiteLLM incidents) compound the challenge of balancing timely patching against update-driven compromise.

TACTA0004TACTA0001TACTA0003SRFCloudSWDockerVNDKasperskyTYPResearchSTGPrivesc

Edit Score

2026-05-28

2026-05-28 23:16Z

HIGH

CVE-2026-9999 — Inappropriate: implementation in ANGLE in Google Chrome on Mac prior to 148.0.7778.216 allowed a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-9999

Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) CVSSv3.1 8.8 (HIGH)

CWECWE 269VNDInappropriateTYPVulnerability

8.8

CVSS v3.1

Edit Score

Latest intel// live feed

CVE-2026-45312 — RAGFlow: In 0.24.0 and earlier, a Jinja2 template injection in the prompt generator (rag/prompts/generator.py) allows

CVE-2026-10071 — DreamMaker: developed by Interinfo has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers

Looting UniFi Controllers: Detecting and Weaponizing CVE-2026-22557

CVE-2026-9559 — A path traversal vulnerability exists in the campaign import feature of Mautic 7.

CVE-2025-41277 — Waterfall-security Wf-500_firmware: Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an

CVE-2025-41276 — Waterfall-security Wf-500_firmware: Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an

CVE-2025-41275 — Waterfall-security Wf-500_firmware: Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an

CVE-2025-41274 — Waterfall-security Wf-500_firmware: Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an

CVE-2025-41273 — Waterfall-security Wf-500_firmware: Nozomi Networks Labs identified a CWE-288: Authentication Bypass Using an Alternate Path or Channel

CVE-2025-41272 — Waterfall-security Wf-500_firmware: Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an

CVE-2025-41270 — Waterfall-security Wf-500_firmware: Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an

CVE-2025-41269 — Waterfall-security Wf-500_firmware: Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an

CVE-2025-41268 — Waterfall-security Wf-500_firmware: Nozomi Networks Labs identified a CWE-23: Relative Path Traversal in the Administration WebUI in

CVE-2026-9558 — Server: A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine.

CVE-2026-49201 — Acer Wave_7_firmware: This allows an attacker to decrypt, modify, and re-encrypt system backups, facilitating persistent backdoor

CVE-2026-6075 — Media: The Media Library Assistant plugin for WordPress is vulnerable to Cross-Site Request Forgery in

CVE-2026-49200 — Acer Wave_7_firmware: This file contains cleartext login credentials (for web and Telnet), leading to unauthorized system

CVE-2026-49199 — Acer Predator_connect_w6x_firmware: Crafted MQTT messages can trigger command injection, resulting in root-level code execution on the

CVE-2026-49197 — Acer Predator_connect_w6x_firmware: Web endpoints intended for the Acer Connect app improperly validate the HTTP Authorization header

CVE-2026-49195 — Acer Predator_connect_w6x_firmware: Unauthenticated Debug Service.

CVE-2026-3655 — OTP: The OTP Login With Phone Number, OTP Verification plugin for WordPress is vulnerable to

CVE-2026-8732 — Maps: The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator

CVE-2025-11993 — WooCommerce: The WooCommerce Infinite Scroll and Ajax Pagination plugin for WordPress is vulnerable to PHP

What’s in the container? Analyzing vulnerabilities, risks and protection with Kaspersky Container Security and the KIRA AI assistant

CVE-2026-9999 — Inappropriate: implementation in ANGLE in Google Chrome on Mac prior to 148.0.7778.216 allowed a