Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-09 09:37Z
2026-05-08
2026-05-08 22:16Z
CRIT

CVE-2026-42193 — Plunk: This allows an unauthenticated attacker to spoof SNS events to trigger workflow automations, unsubscribe

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-42193

Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, the /webhooks/sns endpoint accepts Amazon SNS notification payloads from unauthenticated requests without verifying the SNS signature, certificate, or topic ARN, meaning anyone can forge a valid-looking webhook request. This allows an unauthenticated attacker to spoof SNS events to trigger workflow automations, unsubscribe contacts, manipulate email delivery metrics, and potentially exhaus CVSSv3.1 9.1 (CRITICAL)

CWECWE 347VNDPlunkTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-05-08
2026-05-08 22:16Z
HIGH

CVE-2026-41486 — Anyscale Ray: Ray's implementation passes these bytes directly to cloudpickle.loads(), achieving arbitrary code execution during schema

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-41486

Ray is an AI compute engine. From version 2.54.0 to before version 2.55.0, Ray Data registers custom Arrow extension types (ray.data.arrow_tensor, ray.data.arrow_tensor_v2, ray.data.arrow_variable_shaped_tensor) globally in PyArrow. When PyArrow reads a Parquet file containing one of these extension types, it calls __arrow_ext_deserialize__ on the field's metadata bytes. Ray's implementation passes these bytes directly to cloudpickle.loads(), achieving arbitrary code executio CVSSv3.1 8.8 (HIGH)

CWECWE 94CWECWE 502VNDAnyscaleVNDRayTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-08
2026-05-08 21:16Z
HIGH

CVE-2026-44400 — MailEnable: Enterprise Premium 10.55 and earlier contains an improper authorization vulnerability in the WebAdmin

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-44400

MailEnable Enterprise Premium 10.55 and earlier contains an improper authorization vulnerability in the WebAdmin mobile portal that allows attackers to bypass authentication checks by reusing AuthenticationToken cookies generated for low-privileged users. Attackers can obtain a token from the WebMail login endpoint using the PersistentLogin parameter and replay it against the WebAdmin portal to perform highly privileged administrative actions. CVSSv3.1 8.1 (HIGH)

CWECWE 639VNDMailenableTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-05-08
2026-05-08 20:16Z
HIGH

CVE-2026-7807 — SmarterTools: SmarterMail builds prior to 9560 contain a local file inclusion vulnerability in the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7807

SmarterTools SmarterMail builds prior to 9560 contain a local file inclusion vulnerability in the /api/v1/report/summary/{type} API endpoint that allows authenticated users to read arbitrary .json files on the system. Attackers can exploit this vulnerability combined with weak encryption algorithms and hardcoded keys to decrypt and access stored passwords and 2FA secrets for all users. CVSSv3.1 8.1 (HIGH)

CWECWE 22VNDSmartertoolsTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-05-08
2026-05-08 20:16Z
CRIT

CVE-2026-44694 — N8n-mcp N8n-mcp: is an MCP server that provides AI assistants access to n8n node documentation

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-44694

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. From version 2.18.7 to before version 2.50.2, there is an authenticated server-side request forgery vulnerability affecting the webhook trigger tools, the n8n API client (N8N_API_URL), and per-request URLs supplied via the x-n8n-url header in multi-tenant HTTP mode. This issue has been patched in version 2.50.2. CVSSv3.1 9.1 (CRITICAL)

CWECWE 918CWECWE 367VNDMcpVNDN8n McpTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-05-08
2026-05-08 19:16Z
HIGH

CVE-2026-8178 — Amazon: An issue exists in Amazon Redshift JDBC Driver versions prior to 2.2.2.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-8178

An issue exists in Amazon Redshift JDBC Driver versions prior to 2.2.2. Under certain conditions, the driver could load and execute arbitrary classes when processing JDBC connection URL parameters. An actor who can influence the connection URL could potentially execute code in the application context, provided a suitable class is available on the application's classpath. To mitigate this issue, users should upgrade to version 2.2.2 or later. CVSSv3.1 8.1 (HIGH)

CWECWE 470VNDAmazonTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-05-08
2026-05-08 19:16Z
HIGH

CVE-2026-29203 — That can cause DoS or local privilege escalation when an authenticated cPanel user places

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-29203

A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system files or directories. That can cause DoS or local privilege escalation when an authenticated cPanel user places a symlink at a user-controlled legacy Nova path under their home directory. CVSSv3.1 8.8 (HIGH)

CWECWE 61TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-05-08
2026-05-08 19:16Z
HIGH

CVE-2026-29202 — Insufficient input validation of the `plugin` parameter of the `create_user` plugin allows arbitrary Perl

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-29202

Insufficient input validation of the `plugin` parameter of the `create_user` plugin allows arbitrary Perl code execution on behalf of the already authenticated account's system user. CVSSv3.1 8.8 (HIGH)

CWECWE 20TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-08
2026-05-08 19:16Z
HIGH

CVE-2026-29201 — Insufficient input validation of the feature file name in `feature::LOADFEATUREFILE` adminbin call can cause

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-29201

Insufficient input validation of the feature file name in `feature::LOADFEATUREFILE` adminbin call can cause arbitrary file read when a relative file path is passed. CVSSv3.1 8.6 (HIGH)

CWECWE 23TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-05-08
2026-05-08 17:16Z
CRIT

CVE-2026-42072 — Nornicdb: Prior to version 1.0.42-hotfix, the --address CLI flag (and NORNICDB_ADDRESS / server.host config key)

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-42072

Nornicdb is a distributed low-latency, Graph+Vector, Temporal MVCC with all sub-ms HNSW search, graph traversal, and writes. Prior to version 1.0.42-hotfix, the --address CLI flag (and NORNICDB_ADDRESS / server.host config key) is plumbed through to the HTTP server correctly but never reaches the Bolt server config. The Bolt listener therefore always binds to the wildcard address (all interfaces), regardless of what the user configures. On a LAN, this exposes the graph databa CVSSv3.1 9.8 (CRITICAL)

CWECWE 1392VNDNornicdbTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-08
2026-05-08 17:16Z
CRIT

CVE-2026-41889 — Pgx_project Pgx: Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-41889

pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted string literal is used in the SQL query, that string literal contains text that would be would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker. This issue has been patched in version 5.9.2. CVSSv3.1 9.8 (CRITICAL)

CWECWE 89VNDPostgresqlVNDPgx ProjectTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-08
2026-05-08 17:16Z
CRIT

CVE-2026-38360 — Directory: Traversal vulnerability in fohrloop dash-uploader v.0.1.0 through v.0.7.0a2 allows a remote attacker to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-38360

Directory Traversal vulnerability in fohrloop dash-uploader v.0.1.0 through v.0.7.0a2 allows a remote attacker to execute arbitrary code via the dash_uploader/httprequesthandler.py, aseHttpRequestHandler.get_temp_root(), BaseHttpRequestHandler._post() components CVSSv3.1 9.8 (CRITICAL)

CWECWE 22TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-08
2026-05-08 16:16Z
HIGH

CVE-2026-42353 — Depending on which backend is configured, the unvalidated path segments enable either path traversal

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-42353

i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Prior to version 3.9.3, i18next-http-middleware passes the user-controlled lng and ns values from getResourcesHandler directly into i18next.services.backendConnector.load(languages, namespaces, …) without any sanitization. Depending on which backend is configured, the unvalidated path segments enable either path traversal or SSRF. This issue has been patch CVSSv3.1 8.2 (HIGH)

CWECWE 918CWECWE 22TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-05-08
2026-05-08 16:16Z
HIGH

CVE-2026-41883 — OmniFaces: Prior to versions 1.14.2, 2.7.32, 3.14.16, 4.7.5, and 5.2.3, there is a server-side EL

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-41883

OmniFaces is a utility library for Faces. Prior to versions 1.14.2, 2.7.32, 3.14.16, 4.7.5, and 5.2.3, there is a server-side EL injection leading to Remote Code Execution (RCE). This affects applications that use CDNResourceHandler with a wildcard CDN mapping (e.g. libraryName:*=https://cdn.example.com/*). An attacker can craft a resource request URL containing an EL expression in the resource name, which is evaluated server-side. This issue has been patched in versions 1.14 CVSSv3.1 8.1 (HIGH)

CWECWE 917VNDOmnifacesTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-05-08
2026-05-08 16:16Z
HIGH

CVE-2026-41693 — The interpolation is unencoded and unvalidated, so a crafted lng or ns value —

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-41693

i18next-fs-backend is a backend layer for i18next using in Node.js and for Deno to load translations from the filesystem. Prior to version 2.6.4, i18next-fs-backend substitutes the lng and ns options directly into the configured loadPath / addPath templates and then read / write the resulting file from disk. The interpolation is unencoded and unvalidated, so a crafted lng or ns value — containing .., a path separator, a control character, a prototype key, or simply an unexpec CVSSv3.1 8.2 (HIGH)

CWECWE 22CWECWE 73TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-05-08
2026-05-08 16:16Z
HIGH

CVE-2026-41690 — Versions prior to 3.9.3 allow an unauthenticated HTTP client to pollute Object.prototype in the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-41690

18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Versions prior to 3.9.3 allow an unauthenticated HTTP client to pollute Object.prototype in the Node.js process hosting the middleware, via two unvalidated entry points that reach internal object-key writes: getResourcesHandler and missingKeyHandler. This can break authorisation checks (if (user.isAdmin) returning true for any user), cause type-confusion Do CVSSv3.1 8.6 (HIGH)

CWECWE 22CWECWE 1321TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-05-08
2026-05-08 16:16Z
HIGH

CVE-2026-41683 — i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-41683

i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Prior to version 3.9.3, i18next-http-middleware wrote user-controlled language values into the Content-Language response header after passing them through utils.escape(), which is an HTML-entity encoder that does not strip carriage return, line feed, or other control characters. When the application used an older i18next (< 19.5.0) that still exercised the CVSSv3.1 8.6 (HIGH)

CWECWE 79CWECWE 113TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-05-08
2026-05-08 16:16Z
CRIT

CVE-2026-41070 — openvpn-auth-oauth2 is a plugin/management interface client for OpenVPN server to handle an OIDC based

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-41070

openvpn-auth-oauth2 is a plugin/management interface client for OpenVPN server to handle an OIDC based single sign-on (SSO) auth flows. From version 1.26.3 to before version 1.27.3, when openvpn-auth-oauth2 is deployed in the experimental plugin mode (shared library loaded by OpenVPN via the plugin directive), clients that do not support WebAuth/SSO (e.g., the openvpn CLI on Linux) are incorrectly admitted to the VPN despite being denied by the authentication logic. The defau CVSSv3.1 10.0 (CRITICAL)

CWECWE 287TYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2026-05-08
2026-05-08 16:16Z
HIGH

CVE-2026-29972 — nanoMODBUS through v1.22.0 has a stack-based buffer overflow in recv_read_registers_res() in nanomodbus.c.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-29972

nanoMODBUS through v1.22.0 has a stack-based buffer overflow in recv_read_registers_res() in nanomodbus.c. When a client calls nmbs_read_holding_registers() or nmbs_read_input_registers(), the library writes register data from the server response to the caller-provided buffer based on the response's byte_count field before validating that byte_count matches the requested quantity. A malicious Modbus TCP server can send a response with byte_count=250 (125 registers) regardless CVSSv3.1 8.2 (HIGH)

CWECWE 121TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-05-08
2026-05-08 15:17Z
CRIT

CVE-2026-44497 — Zfnd Zebra-script: Prior to zebrad version 4.4.0 and prior to zebra-script version 6.0.0, the fix for

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-44497

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.4.0 and prior to zebra-script version 6.0.0, the fix for CVE-2026-41583 introduced a separate issue due to insufficient error handling of the case where the sighash type is invalid, during sighash computation. Instead of returning an error, the normal flow would resume, and the input sighash buffer would be left untouched. In scenarios where a previous signature validation could leave a valid sighash in CVSSv3.1 9.1 (CRITICAL)

CWECWE 347VNDZfndVNDZebraTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-05-08
2026-05-08 15:16Z
HIGH

CVE-2026-43466 — Linux: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix DMA FIFO

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-43466

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery In case of a TX error CQE, a recovery flow is triggered, mlx5e_reset_txqsq_cc_pc() resets dma_fifo_cc to 0 but not dma_fifo_pc, desyncing the DMA FIFO producer and consumer. After recovery, the producer pushes new DMA entries at the old dma_fifo_pc, while the consumer reads from position 0. This causes us to unmap stale DMA addresses from before the r CVSSv3.1 8.2 (HIGH)

TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-05-08
2026-05-08 15:16Z
CRIT

CVE-2026-43465 — Linux: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: RX, Fix XDP

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-43465

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ XDP multi-buf programs can modify the layout of the XDP buffer when the program calls bpf_xdp_pull_data() or bpf_xdp_adjust_tail(). The referenced commit in the fixes tag corrected the assumption in the mlx5 driver that the XDP buffer layout doesn't change during a program execution. However, this fix introduced another issue: the dropped fragme CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-08
2026-05-08 15:16Z
HIGH

CVE-2026-43452 — Linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: guard option

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-43452

In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: guard option walkers against 1-byte tail reads When the last byte of options is a non-single-byte option kind, walkers that advance with i += op[i + 1] ? : 1 can read op[i + 1] past the end of the option area. Add an explicit i == optlen - 1 check before dereferencing op[i + 1] in xt_tcpudp and xt_dccp option walkers. CVSSv3.1 8.2 (HIGH)

TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-05-08
2026-05-08 15:16Z
CRIT

CVE-2026-43414 — Linux: In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Completely fix

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-43414

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Completely fix fcport double free In qla24xx_els_dcmd_iocb() sp->free is set to qla2x00_els_dcmd_sp_free(). When an error happens, this function is called by qla2x00_sp_release(), when kref_put() releases the first and the last reference. qla2x00_els_dcmd_sp_free() frees fcport by calling qla2x00_free_fcport(). Doing it one more time after kref_put() is a bad idea. CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-08
2026-05-08 15:16Z
CRIT

CVE-2026-43407 — Linux: In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-43407

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() This patch fixes an out-of-bounds access in ceph_handle_auth_reply() that can be triggered by a message of type CEPH_MSG_AUTH_REPLY. In ceph_handle_auth_reply(), the value of the payload_len field of such a message is stored in a variable of type int. A value greater than INT_MAX leads to an integer overflow and is interpreted as a nega CVSSv3.1 9.1 (CRITICAL)

TYPVulnerability
9.1
CVSS v3.1
96
Edit Score