Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-08 15:55Z
2026-05-15
2026-05-15 16:16Z
CRIT

CVE-2026-45772 — Vercel Turborepo: From 1.1.0 to before 2.9.14, Turborepo can be vulnerable to arbitrary code execution when

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-45772

Turborepo is a high-performance build system for JavaScript and TypeScript codebases. From 1.1.0 to before 2.9.14, Turborepo can be vulnerable to arbitrary code execution when run in untrusted repositories that contain malicious Yarn configuration. In affected versions, package manager detection executed yarn --version from the project directory, which could cause Yarn to load and execute a project-controlled yarnPath from .yarnrc.yml. An attacker who controls repository cont CVSSv3.1 9.8 (CRITICAL)

CWECWE 426VNDVercelVNDTurborepoTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-15
2026-05-15 16:16Z
HIGH

CVE-2026-35194 — Code: injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-35194

Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x allows authenticated users with query submission privileges to execute arbitrary code on TaskManagers via maliciously crafted SQL queries. The vulnerability affects JSON functions (1.15.0+) and LIKE expressions with ESCAPE clauses (1.17.0+). User-controlled strings are interpolated into generated Java code without proper escaping, allowing attackers to break out of string literal CVSSv3.1 8.1 (HIGH)

CWECWE 94VNDCodeTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-05-15
2026-05-15 15:16Z
HIGH

CVE-2026-34253 — This vulnerability occurs in the remote control functionality when processing malformed input, leading to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-34253

A buffer underflow vulnerability has been identified in the ogg123 utility from the vorbis-tools 1.4.3 package in function remotethread in remote.c. This vulnerability occurs in the remote control functionality when processing malformed input, leading to a stack buffer underflow that can cause application crashes and potentially allow code execution. CVSSv3.1 8.2 (HIGH)

CWECWE 124TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-05-15
2026-05-15 13:16Z
CRIT

CVE-2026-41553 — Dhtmlx Pdf_export_module: PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Remote

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-41553

PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Remote Code Execution due to lack of "data" parameter sanitization. An unauthenticated attacker can inject the malicious JavaScript code to the parameter whose value is processed by Node.js and subsequently executed. This can lead to server compromise. This issue was fixed in PDF Export Module version 0.7.6. CVSSv3.1 10.0 (CRITICAL)

CWECWE 78VNDPdfVNDDhtmlxTYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2026-05-15
2026-05-15 10:16Z
HIGH

CVE-2026-41964 — Permission: control vulnerability in the web.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-41964

Permission control vulnerability in the web. Impact: Successful exploitation of this vulnerability may affect availability. CVSSv3.1 8.4 (HIGH)

CWECWE 362TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-05-15
2026-05-15 09:16Z
CRIT

CVE-2026-8398 — Attackers gained unauthorized access to the vendor's (AVB Disc Soft) build or distribution infrastructure

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-8398

A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendor's (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally si CVSSv3.1 9.8 (CRITICAL)

CWECWE 506TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-15
2026-05-15 09:16Z
HIGH

CVE-2026-6228 — Frontend: The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-6228

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 3.28.36. This is due to insufficient authorization checks in the role field update mechanism combined with overly permissive capabilities for the admin_form post type. The admin_form custom post type uses 'capability_type' => 'page', which grants editors the ability to create and edit forms. When an editor creates an edit_user form, they can manipulate t CVSSv3.1 8.8 (HIGH)

CWECWE 269VNDFrontendTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-05-15
2026-05-15 09:16Z
CRIT

CVE-2026-5229 — Form: The Form Notify plugin for WordPress is vulnerable to Authentication Bypass in versions up

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-5229

The Form Notify plugin for WordPress is vulnerable to Authentication Bypass in versions up to and including 1.1.10. This is due to the plugin trusting user-controlled cookie data to determine which WordPress account to authenticate after a LINE OAuth login. When LINE doesn't provide an email address (which is common), the plugin falls back to reading the 'form_notify_line_email' cookie value without verifying that the LINE account is associated with that email address. This m CVSSv3.1 9.8 (CRITICAL)

CWECWE 287VNDFormTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-15
2026-05-15 07:16Z
HIGH

CVE-2026-4094 — FOX: The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4094

The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the 'admin_head' function in all versions up to, and including, 1.4.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete the entire multi-currency configuration by visiting any wp-admin page with the `woocs_reset` parameter appended. Additionally, because no nonce is veri CVSSv3.1 8.1 (HIGH)

CWECWE 862VNDFoxTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-05-15
2026-05-15 06:16Z
HIGH

CVE-2026-43490 — Linux: In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate inherited ACE

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-43490

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate inherited ACE SID length smb_inherit_dacl() walks the parent directory DACL loaded from the security descriptor xattr. It verifies that each ACE contains the fixed SID header before using it, but does not verify that the variable-length SID described by sid.num_subauth is fully contained in the ACE. A malformed inheritable ACE can advertise more subauthorities than are present in the ACE. c CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-15
2026-05-15 06:16Z
HIGH

CVE-2026-28761 — Cross-site request forgery vulnerability exists in Musetheque V4 Information Disclosure for IPKNOWLEDGE V4L1 rev2203.0

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-28761

Cross-site request forgery vulnerability exists in Musetheque V4 Information Disclosure for IPKNOWLEDGE V4L1 rev2203.0 and earlier. If a user views a malicious page while logged-in to the affected product, unexpected operations may be done. CVSSv3.1 8.1 (HIGH)

CWECWE 352TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-05-15
2026-05-15 03:16Z
HIGH

CVE-2026-2652 — A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-2652

A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (`--app-name basic-auth`) and served via uvicorn (ASGI). The FastAPI permission middleware only enforces authentication on `/gateway/` routes, leaving other routes such as the Job API (`/ajax-api/3.0/jobs/*`) and the OpenTelemetry trace ingestion API (`/v1/traces`) unprotected. This allows unauthenticated re CVSSv3.1 8.6 (HIGH)

CWECWE 305TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-05-14
2026-05-14 21:16Z
HIGH

CVE-2026-45369 — python-utcp is the python implementation of UTCP.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-45369

python-utcp is the python implementation of UTCP. Prior to 1.1.3, the _substitute_utcp_args method in cli_communication_protocol.py inserts user-controlled tool_args values directly into shell command strings without any sanitization or escaping. These commands are then executed via /bin/bash -c (Unix) or powershell.exe -Command (Windows), allowing an attacker to inject arbitrary shell commands. This vulnerability is fixed in 1.1.3. CVSSv3.1 8.3 (HIGH)

CWECWE 78TYPVulnerability
8.3
CVSS v3.1
92
Edit Score
2026-05-14
2026-05-14 21:16Z
CRIT

CVE-2026-44212 — PrestaShop: Prior to 8.2.6 and 9.1.1, there is a stored Cross-Site Scripting (XSS) vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-44212

PrestaShop is an open source e-commerce web application. Prior to 8.2.6 and 9.1.1, there is a stored Cross-Site Scripting (XSS) vulnerability in the PrestaShop back-office Customer Service view. An unauthenticated attacker can submit the public Contact Us form with a malicious email address. The payload is stored in the database and executed when a back-office employee opens the affected customer thread, enabling session hijacking and full back-office takeover. This vulnerabi CVSSv3.1 9.3 (CRITICAL)

CWECWE 79VNDPrestashopTYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2026-05-14
2026-05-14 20:17Z
CRIT

CVE-2026-8634 — Crabbox: prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-8634

Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a malicious or compromised repository to forward local secrets such as API tokens, cloud credentials, and broker tokens into the remote command environment. Attackers can exploit overly permissive environment variable allowlisting in repo-local Crabbox configuration to serialize sensitive environment variables into remote command execution, exposing credential CVSSv3.1 9.1 (CRITICAL)

CWECWE 94VNDCrabboxTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-05-14
2026-05-14 20:17Z
HIGH

CVE-2026-8629 — Crabbox: prior to v0.12.0 contains a privilege escalation vulnerability that allows users with shared

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-8629

Crabbox prior to v0.12.0 contains a privilege escalation vulnerability that allows users with shared visibility-only access to obtain Code, WebVNC, and Egress agent tickets by sending POST requests to ticket endpoints. Attackers can exploit insufficient access control checks on the /v1/leases/:id/code/ticket, /v1/leases/:id/webvnc/ticket, and /v1/leases/:id/egress/ticket endpoints to obtain bridge-agent tickets and impersonate trusted lease-side bridges despite having only vi CVSSv3.1 8.1 (HIGH)

CWECWE 639VNDCrabboxTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-05-14
2026-05-14 20:17Z
HIGH

CVE-2026-8587 — Use: after free in Extensions in Google Chrome on Mac prior to 148.0.7778.168 allowed

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-8587

Use after free in Extensions in Google Chrome on Mac prior to 148.0.7778.168 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Medium) CVSSv3.1 8.8 (HIGH)

CWECWE 416TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-14
2026-05-14 20:17Z
HIGH

CVE-2026-8581 — Use: after free in GPU in Google Chrome prior to 148.0.7778.168 allowed a remote

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-8581

Use after free in GPU in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) CVSSv3.1 8.8 (HIGH)

CWECWE 416TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-14
2026-05-14 20:17Z
CRIT

CVE-2026-8580 — Use: after free in Mojo in Google Chrome prior to 148.0.7778.168 allowed a remote

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-8580

Use after free in Mojo in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) CVSSv3.1 9.6 (CRITICAL)

CWECWE 416TYPVulnerability
9.6
CVSS v3.1
98
Edit Score
2026-05-14
2026-05-14 20:17Z
HIGH

CVE-2026-8577 — Integer: overflow in Fonts in Google Chrome prior to 148.0.7778.168 allowed a remote attacker

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-8577

Integer overflow in Fonts in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) CVSSv3.1 8.8 (HIGH)

CWECWE 472TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-14
2026-05-14 20:17Z
HIGH

CVE-2026-8575 — Use: after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-8575

Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) CVSSv3.1 8.3 (HIGH)

CWECWE 416TYPVulnerability
8.3
CVSS v3.1
92
Edit Score
2026-05-14
2026-05-14 20:17Z
HIGH

CVE-2026-8574 — Use: after free in Core in Google Chrome on Windows prior to 148.0.7778.168 allowed

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-8574

Use after free in Core in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) CVSSv3.1 8.3 (HIGH)

CWECWE 416TYPVulnerability
8.3
CVSS v3.1
92
Edit Score
2026-05-14
2026-05-14 20:17Z
HIGH

CVE-2026-8573 — Integer: overflow in Codecs in Google Chrome on Windows prior to 148.0.7778.168 allowed a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-8573

Integer overflow in Codecs in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: Medium) CVSSv3.1 8.3 (HIGH)

CWECWE 472TYPVulnerability
8.3
CVSS v3.1
92
Edit Score
2026-05-14
2026-05-14 20:17Z
HIGH

CVE-2026-8571 — GPU: Insufficient policy enforcement in GPU in Google Chrome on Android prior to 148.0.7778.168 allowed

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-8571

Insufficient policy enforcement in GPU in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) CVSSv3.1 8.3 (HIGH)

CWECWE 693VNDGpuTYPVulnerability
8.3
CVSS v3.1
92
Edit Score
2026-05-14
2026-05-14 20:17Z
HIGH

CVE-2026-8569 — Out: of bounds write in Codecs in Google Chrome on Mac prior to 148.0.7778.168

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-8569

Out of bounds write in Codecs in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: Medium) CVSSv3.1 8.3 (HIGH)

CWECWE 787TYPVulnerability
8.3
CVSS v3.1
92
Edit Score