Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-08 00:52Z
2026-05-27
2026-05-27 20:16Z
HIGH

CVE-2026-45108 — Himmelblau: From 2.0.0 to before 3.1.5 and 2.3.11, Himmelblau contained an authentication bypass vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-45108

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From 2.0.0 to before 3.1.5 and 2.3.11, Himmelblau contained an authentication bypass vulnerability in the Device Authorization Grant (DAG) flow that allowed a user within the same Entra ID domain to obtain a local Unix session as another user by providing their own valid credentials. The vulnerability existed in the token_validate function, which validated domain aliases for legitimate multi-doma CVSSv3.1 8.4 (HIGH)

CWECWE 863VNDHimmelblauTYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-05-27
2026-05-27 20:16Z
CRIT

CVE-2026-45102 — OneUptime: Prior to 10.0.98, OneUptime uses the Node.js' vm module as an isolation primitive.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-45102

OneUptime is an open-source monitoring and observability platform. Prior to 10.0.98, OneUptime uses the Node.js' vm module as an isolation primitive. This API was not designed for that and can be escaped via error objects and infinite recursion. This vulnerability is fixed in 10.0.98. CVSSv3.1 9.9 (CRITICAL)

CWECWE 693VNDOneuptimeTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-05-27
2026-05-27 20:16Z
CRIT

CVE-2026-44888 — Alert: Since pialert.conf is loaded via Python's exec() every 3–5 minutes by the background cron

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-44888

Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. Prior to 2026-05-07, Pi.Alert's SaveConfigFile() endpoint writes user-supplied numeric config values (e.g., SMTP_PORT) directly into pialert.conf without validation. Since pialert.conf is loaded via Python's exec() every 3–5 minutes by the background cron process, an attacker can inject arbitrary Python code and achieve unauthenticated OS-level RCE. On default installations (PIALERT_WEB_PROTECTION = False CVSSv3.1 9.8 (CRITICAL)

CWECWE 94VNDAlertTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-27
2026-05-27 20:16Z
CRIT

CVE-2026-44887 — Alert: Prior to 2026-05-07, Pi.Alert's web-based configuration editor allows arbitrary Python code to be injected

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-44887

Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. Prior to 2026-05-07, Pi.Alert's web-based configuration editor allows arbitrary Python code to be injected into pialert.conf. Since the background scan daemon loads this file via Python's exec(), injected code executes as the daemon process. With web protection disabled (the default configuration), no authentication is required, making this an unauthenticated Remote Code Execution vulnerability. This vuln CVSSv3.1 9.8 (CRITICAL)

CWECWE 94VNDAlertTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-27
2026-05-27 20:16Z
CRIT

CVE-2026-44590 — Sherlock: Prior to 0.16.1, the GitHub Actions workflow validate_modified_targets.yml is vulnerable to command injection via

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-44590

Sherlock hunts down social media accounts by username across social networks. Prior to 0.16.1, the GitHub Actions workflow validate_modified_targets.yml is vulnerable to command injection via the pull_request_target trigger. Any GitHub user can execute arbitrary commands on the CI runner and exfiltrate the GITHUB_TOKEN by opening a pull request. No approval, review, or merge is required. This vulnerability is fixed in 0.16.1. CVSSv3.1 9.3 (CRITICAL)

CWECWE 78VNDSherlockTYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2026-05-27
2026-05-27 20:16Z
HIGH

CVE-2026-42197 — RELATE: Versions prior to commit 555f0efb1c5bd7531c07cd73724d7e566a81f620 have a stored cross-site scripting vulnerability that allows any

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-42197

RELATE is a web-based courseware package. Versions prior to commit 555f0efb1c5bd7531c07cd73724d7e566a81f620 have a stored cross-site scripting vulnerability that allows any enrolled student to execute arbitrary JavaScript in an administrator's browser session, potentially leading to full admin account takeover. The `get_user()` method in `ParticipationAdmin` renders user-controlled input using `mark_safe` combined with Python's % string formatting. This bypasses Django\'s aut CVSSv3.1 8.7 (HIGH)

CWECWE 79VNDRelateTYPVulnerability
8.7
CVSS v3.1
94
Edit Score
2026-05-27
2026-05-27 19:16Z
HIGH

CVE-2026-4868 — GitLab: has remediated an issue in GitLab EE affecting all versions from 18.8 before

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4868

GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that, under certain conditions, could have allowed an authenticated user to cause specific Duo AI workflows to run under another user's identity due to improper user identity resolution when triggering Duo AI workflow runners. CVSSv3.1 8.2 (HIGH)

CWECWE 639VNDGitlabTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-05-27
2026-05-27 18:16Z
HIGH

CVE-2026-48153 — Budibase: Prior to 3.39.0, fetchToken in the OAuth2 SDK makes a POST to a builder-supplied

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-48153

Budibase is an open-source low-code platform. Prior to 3.39.0, fetchToken in the OAuth2 SDK makes a POST to a builder-supplied URL with plain node-fetch, skipping the blacklist.isBlacklisted check that every other outbound fetch path in the codebase uses. The Joi schema for the OAuth2 URL has no scheme or host restriction. This vulnerability is fixed in 3.39.0. CVSSv3.1 8.5 (HIGH)

CWECWE 918VNDBudibaseTYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2026-05-27
2026-05-27 18:16Z
HIGH

CVE-2026-48152 — Budibase: The result is server-side disclosure of the builder-configured REST Authorization secret to an attacker-controlled

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-48152

Budibase is an open-source low-code platform. Prior to 3.39.0, the single-datasource GET and PUT routes are guarded by generic TABLE READ, not by Builder/Admin permission or datasource-specific ownership/resource checks. The built-in Basic app user role maps to the WRITE permission set, which includes table read/write and query write. A Basic user can therefore read an existing REST datasource, receive redacted authConfigs values, submit an update that changes only config.url CVSSv3.1 8.1 (HIGH)

CWECWE 863VNDBudibaseTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-05-27
2026-05-27 18:16Z
CRIT

CVE-2026-48150 — Budibase: The whole flow is tenant-wide privilege escalation from an app-level role, available to anyone

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-48150

Budibase is an open-source low-code platform. Prior to 3.39.0, /api/public/v1/roles/assign is guarded by the builderOrAdmin middleware, which passes any user who is a builder for the app id in the x-budibase-app-id header. That check admits both global builders and workspace-scoped builders (builder.apps set but builder.global unset). The controller then spreads the request body into the SDK call, and the SDK grants builder.global=true or admin.global=true on whichever user i CVSSv3.1 9.0 (CRITICAL)

CWECWE 915VNDBudibaseTYPVulnerability
9.0
CVSS v3.1
95
Edit Score
2026-05-27
2026-05-27 18:16Z
HIGH

CVE-2026-48149 — Budibase: Any column a builder binds to a Text component in Markdown mode is a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-48149

Budibase is an open-source low-code platform. Prior to 3.39.0, the Budibase Text component renders markdown by assigning marked.parse(markdown) straight to innerHTML with no sanitizer (packages/bbui/src/Markdown/MarkdownViewer.svelte:22). Any column a builder binds to a Text component in Markdown mode is a stored-XSS sink writable by every BASIC app user with WRITE on the underlying table. This vulnerability is fixed in 3.39.0. CVSSv3.1 8.1 (HIGH)

CWECWE 79VNDBudibaseTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-05-27
2026-05-27 18:16Z
CRIT

CVE-2026-46425 — Budibase: Prior to 3.38.2, packages/worker/src/api/routes/global/scim.ts attaches only two middlewares to the SCIM router: requireSCIM (checks

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-46425

Budibase is an open-source low-code platform. Prior to 3.38.2, packages/worker/src/api/routes/global/scim.ts attaches only two middlewares to the SCIM router: requireSCIM (checks the Enterprise feature flag and SCIM config) and doInScimContext (sets the SCIM request context). There is no role check. Any authenticated user who reaches the worker (BASIC role, workspace-scoped builder, anyone) can call SCIM endpoints and CRUD every user and group in the tenant. This vulnerabilit CVSSv3.1 9.9 (CRITICAL)

CWECWE 862VNDBudibaseTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-05-27
2026-05-27 18:16Z
HIGH

CVE-2026-45717 — Budibase: Because no network-level SSRF protection is applied to SQL driver connections, redirecting a PostgreSQL/MySQL/MongoDB

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-45717

Budibase is an open-source low-code platform. Prior to 3.38.1, Budibase exposes a REST API for datasource management. The route PUT /api/datasources/:datasourceId is registered in the authorizedRoutes group with TABLE/READ permission. This is the same authorization level as the read endpoint (GET /api/datasources/:datasourceId). Every authenticated Budibase app user with the BASIC built-in role or higher carries TABLE/WRITE (and therefore TABLE/READ) permissions, and the data CVSSv3.1 8.8 (HIGH)

CWECWE 862VNDBudibaseTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-27
2026-05-27 18:16Z
HIGH

CVE-2026-45716 — Budibase: A builder-level user can create a new global admin account and receive the generated

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-45716

Budibase is an open-source low-code platform. Prior to 3.38.1, the POST /api/global/users/onboard endpoint is protected by workspaceBuilderOrAdmin middleware, allowing any user with builder permissions to access it. When SMTP email is not configured (the default for self-hosted Budibase instances), this endpoint bypasses the admin-restricted invite flow and directly creates users via bulkCreate, accepting arbitrary admin and builder role assignments from the request body. A b CVSSv3.1 8.8 (HIGH)

CWECWE 269VNDBudibaseTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-27
2026-05-27 18:16Z
HIGH

CVE-2026-45089 — Dalfox: is a powerful open-source XSS scanner and utility focused on automation.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-45089

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the output, output-all, and debug fields in model.Options are JSON-tagged and deserialized directly from the attacker's request body, then propagated unchanged through dalfox.Initialize into the scan engine's logging path. The logger opens the attacker-supplied path with os.O_APPEND|os.O_CREATE|os.O_WRONLY and writes scan log lines to it CVSSv3.1 8.2 (HIGH)

CWECWE 434CWECWE 306CWECWE 73VNDDalfoxTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-05-27
2026-05-27 18:16Z
CRIT

CVE-2026-45087 — Dalfox: is a powerful open-source XSS scanner and utility focused on automation.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-45087

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is started in REST API server mode (dalfox server), the server binds to 0.0.0.0:6664 by default and requires no API key unless the operator explicitly passes --api-key. Because model.Options — including FoundAction and FoundActionShell — is deserialized directly from attacker-supplied JSON in POST /scan, and because dalfox.Initialize explicitly propagates those two fie CVSSv3.1 10.0 (CRITICAL)

CWECWE 306CWECWE 78CWECWE 15VNDDalfoxTYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2026-05-27
2026-05-27 18:16Z
HIGH

CVE-2026-44521 — Prior to 2.1.68, an authenticated SQL injection vulnerability in the elFinder MySQL volume driver

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-44521

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.68, an authenticated SQL injection vulnerability in the elFinder MySQL volume driver (elFinderVolumeMySQL) allows any logged-in user, including users with read-only access to the affected volume, to inject SQL through a crafted target file hash. Successful exploitation can lead to unauthorized data disclosure and denial of service. This vulnerability only affects installations CVSSv3.1 8.8 (HIGH)

CWECWE 89TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-27
2026-05-27 18:16Z
HIGH

CVE-2026-44346 — BentoML: Prior to 1.4.39, a malicious bentofile.yaml containing a newline-injected value in envs[*].name produces unquoted

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-44346

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, a malicious bentofile.yaml containing a newline-injected value in envs[*].name produces unquoted RUN directives in the BentoML-generated Dockerfile. When the victim runs bentoml containerize on the imported bento, those RUN directives execute on the host during docker build. This vulnerability is fixed in 1.4.39. CVSSv3.1 8.8 (HIGH)

CWECWE 94CWECWE 78VNDBentomlTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-27
2026-05-27 18:16Z
HIGH

CVE-2026-44345 — BentoML: Prior to 1.4.39, src/bentoml/_internal/container/frontend/dockerfile/templates/base_v2.j2 interpolates docker.base_image raw with no escaping, newline filtering, or validatio

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-44345

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, src/bentoml/_internal/container/frontend/dockerfile/templates/base_v2.j2 interpolates docker.base_image raw with no escaping, newline filtering, or validation. A malicious bento.yaml with a multi-line docker.base_image value smuggles arbitrary Dockerfile directives into the generated Dockerfile, and bentoml containerize then runs docker build which execu CVSSv3.1 8.8 (HIGH)

CWECWE 78VNDBentomlTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-27
2026-05-27 18:16Z
HIGH

CVE-2026-38807 — Permissions: Insecure Permissions vulnerability in kvf-admin v1.0.0 allows a remote attacker to escalate privileges via

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-38807

Insecure Permissions vulnerability in kvf-admin v1.0.0 allows a remote attacker to escalate privileges via the UserController.java component CVSSv3.1 8.8 (HIGH)

CWECWE 639TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-27
2026-05-27 17:16Z
CRIT

CVE-2026-48027 — Nx Nx_console: On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-48027

Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Marketplace. For OpenVSX, the problem was detected later, and the compromised version was available from 12:33 UTC to 13:09 UTC (~36 minutes). Version 18.100.0 of Nx Console is not compromised and users may remediate by upgrading to that version. CVSSv3.1 9.8 (CRITICAL)

CWECWE 506VNDNxVNDConsoleTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-27
2026-05-27 17:16Z
HIGH

CVE-2026-44483 — RVF: (formerly Remix Validated Form) provides easy form validation and state management for React.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-44483

RVF (formerly Remix Validated Form) provides easy form validation and state management for React. From 6.0.0 to before 6.0.4 and 7.0.2, setPath in @rvf/set-get (used by @rvf/core to flatten incoming form data into a nested object) does not block the keys __proto__, constructor, or prototype when walking a path. Because field names in submitted form data are passed directly to setPath via preprocessFormData (and through parseFormData / validate), an attacker who can submit a f CVSSv3.1 8.2 (HIGH)

CWECWE 1321VNDRvfTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-05-27
2026-05-27 17:16Z
CRIT

CVE-2026-44330 — free5GC is an open-source implementation of the 5G core network.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-44330

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the nnef-pfdmanagement route group without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can use a forged or arbitrary bearer token (e.g. Authorization: Bearer not-a-real-token) to read PFD application data via GET /applications and GET /applications/{appID}, and to create or delete PFD change-notification subscriptions via POST /s CVSSv3.1 10.0 (CRITICAL)

CWECWE 863TYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2026-05-27
2026-05-27 17:16Z
CRIT

CVE-2026-44329 — free5GC is an open-source implementation of the 5G core network.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-44329

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's SMF mounts the UPI management route group without OAuth2/bearer-token authorization middleware. A network attacker who can reach SMF on the SBI can hit UPI endpoints with no Authorization header at all, and the requests reach the SMF business handlers. In the running Docker lab this was directly demonstrated for read (GET /upi/v1/upNodesLinks), write (POST /upi/v1/upNodesLinks with atta CVSSv3.1 10.0 (CRITICAL)

CWECWE 862CWECWE 306TYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2026-05-27
2026-05-27 17:16Z
HIGH

CVE-2026-44328 — This is an unauthenticated, state-mutating panic-DoS sink that an off-path network attacker can trigger

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-44328

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's SMF mounts the UPI management route group without inbound OAuth2 middleware. On top of that, the DELETE /upi/v1/upNodesLinks/{upNodeRef} handler unconditionally dereferences upNode.UPF after the type-guarded async release, even though AN-typed nodes are constructed without a UPF object. As a result, a single unauthenticated DELETE /upi/v1/upNodesLinks/gNB1 request crashes the handler wi CVSSv3.1 8.2 (HIGH)

CWECWE 862CWECWE 306CWECWE 476TYPVulnerability
8.2
CVSS v3.1
91
Edit Score