Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-08 22:49Z
2026-05-13
2026-05-13 21:16Z
HIGH

CVE-2026-21821 — HCL: Since jQuery 1.x has reached end-of-life and no longer receives security updates, it may

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-21821

The HCL BigFix SCM Reporting site contains an outdated and unsupported version of the jQuery 1.x library. Since jQuery 1.x has reached end-of-life and no longer receives security updates, it may expose the application to publicly known security weaknesses and increase the risk of client-side attacks such as Cross-Site Scripting (XSS) or manipulation through vulnerable third-party components. CVSSv3.1 8.3 (HIGH)

CWECWE 1104VNDHclTYPVulnerability
8.3
CVSS v3.1
92
Edit Score
2026-05-13
2026-05-13 21:16Z
CRIT

CVE-2025-27851 — The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0)

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-27851

The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a cross-site origin WebSocket hijacking attack. Among other uses, the WDU utilizes WebSockets to control settings, including administrative settings. This allows a network attacker to take full control of a WDU. To initiate an exploit of this vulnerability, the victim must (1) be utilizing a web browser on a multihomed host that has local interfaces on the Garmin Marine Network as well as another netwo CVSSv3.1 9.3 (CRITICAL)

CWECWE 352TYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2026-05-13
2026-05-13 20:16Z
CRIT

CVE-2026-44351 — JSON: Prior to 6.2.4, a critical authentication-bypass vulnerability in fast-jwt's async key-resolver flow allows any

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-44351

fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.2.4, a critical authentication-bypass vulnerability in fast-jwt's async key-resolver flow allows any unauthenticated attacker to forge arbitrary JWTs that are accepted as authentic. When the application's key resolver returns an empty string (''), for example via the common keys[decoded.header.kid] || '' JWKS-style fallback, fast-jwt converts it to a zero-length Buffer, hands it to crypto.createSecretKey, CVSSv3.1 9.1 (CRITICAL)

CWECWE 287CWECWE 1391CWECWE 326TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-05-13
2026-05-13 20:16Z
HIGH

CVE-2026-42550 — Flight: Prior to 3.18.1, SimplePdo::insert(), SimplePdo::update(), and SimplePdo::delete() build SQL statements by concatenating the $table

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-42550

Flight is an extensible micro-framework for PHP. Prior to 3.18.1, SimplePdo::insert(), SimplePdo::update(), and SimplePdo::delete() build SQL statements by concatenating the $table argument and the keys of the $data array directly into the query, with no identifier quoting and no validation. When an application forwards user-controlled data shapes to these helpers — a common and documented pattern, e.g. $db->insert('users', $request->data->getData()) — an attacker can inject CVSSv3.1 8.8 (HIGH)

CWECWE 89VNDFlightTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-13
2026-05-13 19:17Z
CRIT

CVE-2026-42032 — Okfn Ckan: Prior to 2.10.10 and 2.11.5, a vulnerability in datastore_search_sql allowed attackers to bypass authorization

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-42032

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, a vulnerability in datastore_search_sql allowed attackers to bypass authorization in order to gain access to private resources and PostgreSQL system information This vulnerability is fixed in 2.10.10 and 2.11.5. CVSSv3.1 9.1 (CRITICAL)

CWECWE 863VNDOkfnVNDCkanTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-05-13
2026-05-13 19:17Z
CRIT

CVE-2026-42031 — Okfn Ckan: Prior to 2.10.10 and 2.11.5, a vulnerability in datastore_search_sql allowed attackers to inject SQL

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-42031

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, a vulnerability in datastore_search_sql allowed attackers to inject SQL in order to gain access to private resources and PostgreSQL system information This vulnerability is fixed in 2.10.10 and 2.11.5. CVSSv3.1 9.8 (CRITICAL)

CWECWE 89VNDOkfnVNDCkanTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-13
2026-05-13 19:17Z
HIGH

CVE-2026-33583 — Exposure: of the QKEY (used as input into the ‘OTA-Quantum’ device registration process) and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-33583

Exposure of the QKEY (used as input into the ‘OTA-Quantum’ device registration process) and internal system keys via an unauthenticated and unencrypted HTTP GET method in the Arqit Symmetric Key Agreement Platform. This issue affects Symmetric Key Agreement Platform: before 26.03. CVSSv3.1 8.7 (HIGH)

CWECWE 749TYPVulnerability
8.7
CVSS v3.1
94
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-05-13
2026-05-13 19:17Z
HIGH

CVE-2026-0259 — Paloaltonetworks Pan-os: An arbitrary File Read and Delete Vulnerability in Palo Alto Networks WildFire® WF-500 and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-0259

An arbitrary File Read and Delete Vulnerability in Palo Alto Networks WildFire® WF-500 and WF-500-B appliances enables users to read sensitive information and delete arbitrary files. This vulnerability affects WF-500 and WF-500-B appliances running in the default non-FIPS configuration mode. The WildFire Appliance (WF-500, WF-500-B) software update is now available to customers that use the WildFire Appliance (WF-500, WF-500-B) for on-premise sandboxing. Please note tha CVSSv3.1 8.8 (HIGH) · EPSS 20th percentile

CWECWE 73VNDPaloaltonetworksTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-13
2026-05-13 19:17Z
CRIT

CVE-2026-0258 — Paloaltonetworks Pan-os: A server-side request forgery (SSRF) vulnerability in the IKEv2 implementation of Palo Alto Networks

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-0258

A server-side request forgery (SSRF) vulnerability in the IKEv2 implementation of Palo Alto Networks PAN-OS® software allows an unauthenticated attacker to cause the firewall to send network requests to unintended destinations or cause a denial of service (DoS) condition. Panorama, Cloud NGFW and Prisma® Access are not impacted by these vulnerabilities. CVSSv3.1 9.1 (CRITICAL) · EPSS 24th percentile

CWECWE 918VNDPaloaltonetworksVNDSsrfTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-05-13
2026-05-13 19:17Z
CRIT

CVE-2026-0257 — Paloaltonetworks Pan-os: Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS®

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-0257

Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues. CVSSv3.1 9.1 (CRITICAL)

CWECWE 565VNDPaloaltonetworksTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-05-13
2026-05-13 19:16Z
HIGH

CVE-2026-0250 — Paloaltonetworks Globalprotect: A buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect™ app that enables

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-0250

A buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect™ app that enables a man in the middle attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges. This vulnerability is triggered during the processing of requests and responses exchanged between Portal and Gateway. The GlobalProtect app on iOS is not affected. CVSSv3.1 8.1 (HIGH) · EPSS 11th percentile

CWECWE 787VNDPaloaltonetworksTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-05-13
2026-05-13 19:16Z
HIGH

CVE-2026-0244 — Paloaltonetworks Prisma_sd-wan: An improper certificate validation vulnerability in the Palo Alto Networks Prisma SD-WAN ION enables

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-0244

An improper certificate validation vulnerability in the Palo Alto Networks Prisma SD-WAN ION enables man-in-the-middle (MitM) attacker to impersonate the controller. CVSSv3.1 8.1 (HIGH) · EPSS 1th percentile

CWECWE 295VNDPaloaltonetworksTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-05-13
2026-05-13 19:16Z
HIGH

CVE-2026-0240 — Paloaltonetworks Trust_protection_foundation: An information disclosure vulnerability in Trust Protection Foundation enables an authenticated attacker to obtain

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-0240

An information disclosure vulnerability in Trust Protection Foundation enables an authenticated attacker to obtain sensitive information from the server's vault. Successful exploitation of this issue allows the attacker to impersonate any user within the environment and arbitrarily modify configuration settings. CVSSv3.1 8.7 (HIGH) · EPSS 11th percentile

CWECWE 497VNDPaloaltonetworksVNDTrustTYPVulnerability
8.7
CVSS v3.1
94
Edit Score
2026-05-13
2026-05-13 18:16Z
CRIT

CVE-2026-45411 — This allows attackers to write code which can escape from the VM2 sandbox and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-45411

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.3, it is possible to catch a host exception using the yield* expression inside an async generator. When the generator is closed using the return function, the value is awaited on and exceptions thrown in the then call will be caught by the runtime and passed to the yield* iterator as the next value. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host sy CVSSv3.1 9.8 (CRITICAL)

CWECWE 668TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-13
2026-05-13 18:16Z
HIGH

CVE-2026-44578 — Next: From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-44578

Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vu CVSSv3.1 8.6 (HIGH)

CWECWE 918TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-05-13
2026-05-13 18:16Z
CRIT

CVE-2026-44009 — vm2 is an open source vm/sandbox for Node.js.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-44009

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2, This vulnerability is fixed in 3.11.2. CVSSv3.1 9.8 (CRITICAL)

CWECWE 668TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-13
2026-05-13 18:16Z
CRIT

CVE-2026-44008 — This allows attackers to write code which can escape from the VM2 sandbox and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-44008

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2, the new method neutralizeArraySpeciesBatch works with objects from the other side but can call into this side via getter on the array prototype exposing objects of the wrong side into the sandbox. This can be used to get host objects and get the host Function object. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This vulnerability is fi CVSSv3.1 9.8 (CRITICAL)

CWECWE 668TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-13
2026-05-13 18:16Z
CRIT

CVE-2026-44007 — vm2 is an open source vm/sandbox for Node.js.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-44007

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.1, when a NodeVM is created with nesting: true, sandbox code can unconditionally require('vm2') regardless of the outer VM's require configuration — including require: false. With access to vm2, the sandbox constructs a new inner NodeVM with its own unrestricted require settings and executes arbitrary OS commands on the host. Any application that runs untrusted code inside a NodeVM with nesting: true is fully comprom CVSSv3.1 9.1 (CRITICAL)

CWECWE 284TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-05-13
2026-05-13 18:16Z
CRIT

CVE-2026-44006 — vm2 is an open source vm/sandbox for Node.js.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-44006

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, It is possible to reach BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypes. This vulnerability is fixed in 3.11.0. CVSSv3.1 10.0 (CRITICAL)

CWECWE 94TYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2026-05-13
2026-05-13 18:16Z
CRIT

CVE-2026-44005 — vm2 is an open source vm/sandbox for Node.js.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-44005

vm2 is an open source vm/sandbox for Node.js. From 3.9.6 to 3.10.5, vm2's bridge exposes mutable proxies for real host-realm intrinsic prototypes and then forwards sandbox writes into the underlying host objects with otherReflectSet() and otherReflectDefineProperty(), which lets attacker-controlled JavaScript running in a default VM or inherited NodeVM mutate shared host Object.prototype, Array.prototype, and Function.prototype from inside the sandbox This vulnerability is fi CVSSv3.1 10.0 (CRITICAL)

CWECWE 94CWECWE 1321TYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2026-05-13
2026-05-13 18:16Z
HIGH

CVE-2026-44001 — Prior to 3.11.0, a sandbox escape vulnerability in vm2 v3.10.5 allows any sandboxed code

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-44001

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox escape vulnerability in vm2 v3.10.5 allows any sandboxed code to crash the host Node.js process via a single Promise constructor that triggers an unhandled rejection propagating to the host. The fix for CVE-2026-22709 (v3.10.2) only sanitized the onRejected callback in .then() and .catch() overrides and did not address the executor-to-unhandledRejection path. This vulnerability is fixed in 3.11.0. CVSSv3.1 8.6 (HIGH)

CWECWE 248TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-05-13
2026-05-13 18:16Z
CRIT

CVE-2026-43999 — This allows sandboxed code to load excluded builtins like child_process and achieve remote code

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-43999

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, NodeVM's builtin allowlist can be bypassed when the module builtin is allowed (including via the '*' wildcard). The module builtin exposes Node's Module._load(), which loads any module by name directly in the host context, completely bypassing vm2's builtin restriction. This allows sandboxed code to load excluded builtins like child_process and achieve remote code execution. This vulnerability is fixed in 3.11.0. CVSSv3.1 9.9 (CRITICAL)

CWECWE 863TYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-05-13
2026-05-13 18:16Z
HIGH

CVE-2026-43998 — Because path validation uses path.resolve() (which does not dereference symlinks) but module loading uses

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-43998

vm2 is an open source vm/sandbox for Node.js. In 3.10.5, NodeVM's require.root path restriction can be bypassed using filesystem symlinks, allowing sandboxed code to load modules from outside the allowed root directory in host context. Because path validation uses path.resolve() (which does not dereference symlinks) but module loading uses Node's native require() (which does), an attacker can load arbitrary host-realm modules and achieve remote code execution. This vulnerabil CVSSv3.1 8.5 (HIGH)

CWECWE 59TYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2026-05-13
2026-05-13 18:16Z
CRIT

CVE-2026-43997 — vm2 is an open source vm/sandbox for Node.js.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-43997

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, it is possible to obtain the host Object. There are various ways to use the host Object, to escape the sandbox, one example would be using HostObject.getOwnPropertySymbols to obtain Symbol(nodejs.util.inspect.custom). This vulnerability is fixed in 3.11.0. CVSSv3.1 10.0 (CRITICAL)

CWECWE 94TYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2026-05-13
2026-05-13 18:16Z
HIGH

CVE-2026-0265 — Paloaltonetworks Pan-os: An authentication bypass vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-0265

An authentication bypass vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to bypass authentication controls when Cloud Authentication Service (CAS) is enabled. The risk is higher if CAS is enabled on the management interface and lower when any other login interfaces are used. The risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted intern CVSSv3.1 8.1 (HIGH) · EPSS 35th percentile

CWECWE 347VNDPaloaltonetworksVNDPaloTYPVulnerability
8.1
CVSS v3.1
91
Edit Score