Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-09 11:23Z
2026-05-08
2026-05-08 14:16Z
HIGH

CVE-2026-43334 — Linux: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SMP: force responder

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-43334

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SMP: force responder MITM requirements before building the pairing response smp_cmd_pairing_req() currently builds the pairing response from the initiator auth_req before enforcing the local BT_SECURITY_HIGH requirement. If the initiator omits SMP_AUTH_MITM, the response can also omit it even though the local side still requires MITM. tk_request() then sees an auth value without SMP_AUTH_MITM an CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-08
2026-05-08 14:16Z
HIGH

CVE-2026-43322 — Linux: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix UAF

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-43322

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix UAF in le_read_features_complete This fixes the following backtrace caused by hci_conn being freed before le_read_features_complete but after hci_le_read_remote_features_sync so hci_conn_del -> hci_cmd_sync_dequeue is not able to prevent it: ================================================================== BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/lin CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-08
2026-05-08 14:16Z
CRIT

CVE-2026-43304 — Linux: In the Linux kernel, the following vulnerability has been resolved: libceph: define and enforce

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-43304

In the Linux kernel, the following vulnerability has been resolved: libceph: define and enforce CEPH_MAX_KEY_LEN When decoding the key, verify that the key material would fit into a fixed-size buffer in process_auth_done() and generally has a sane length. The new CEPH_MAX_KEY_LEN check replaces the existing check for a key with no key material which is a) not universal since CEPH_CRYPTO_NONE has to be excluded and b) doesn't provide much value since a smaller than needed k CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-08
2026-05-08 14:16Z
HIGH

CVE-2026-43291 — Linux: In the Linux kernel, the following vulnerability has been resolved: net: nfc: nci: Fix

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-43291

In the Linux kernel, the following vulnerability has been resolved: net: nfc: nci: Fix parameter validation for packet data Since commit 9c328f54741b ("net: nfc: nci: Add parameter validation for packet data") communication with nci nfc chips is not working any more. The mentioned commit tries to fix access of uninitialized data, but failed to understand that in some cases the data packet is of variable length and can therefore not be compared to the maximum packet length CVSSv3.1 8.3 (HIGH)

TYPVulnerability
8.3
CVSS v3.1
92
Edit Score
2026-05-08
2026-05-08 14:16Z
CRIT

CVE-2026-41512 — From version 1.0.0 to before version 1.4.1, there is a remote code execution vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-41512

ai-scanner is an AI model safety scanner built on NVIDIA garak. From version 1.0.0 to before version 1.4.1, there is a remote code execution vulnerability via JavaScript injection in `BrowserAutomation::PlaywrightService`. This issue has been patched in version 1.4.1. CVSSv3.1 9.9 (CRITICAL)

CWECWE 94TYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-05-08
2026-05-08 14:16Z
CRIT

CVE-2026-41509 — Cross-crypto Cross-implementation: Prior to commit fc6b7e7, there is a buffer overflow in crypto_sign_open() caused by an

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-41509

CROSS implementation contains reference and optimized implementations of the CROSS post-quantum signature algorithm. Prior to commit fc6b7e7, there is a buffer overflow in crypto_sign_open() caused by an underflow of the integer mlen. This issue has been patched via commit fc6b7e7. CVSSv3.1 9.8 (CRITICAL)

CWECWE 122CWECWE 121VNDCross CryptoVNDCrossTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-08
2026-05-08 14:16Z
CRIT

CVE-2026-41507 — This allows an attacker to execute arbitrary system commands when user-controlled input reaches the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-41507

math-codegen generates code from mathematical expressions. Prior to version 0.4.3, string literal content passed to cg.parse() is injected verbatim into a new Function() body without sanitization. This allows an attacker to execute arbitrary system commands when user-controlled input reaches the parser. Any application exposing a math evaluation endpoint where user input flows into cg.parse() is vulnerable to full RCE. This issue has been patched in version 0.4.3. CVSSv3.1 9.8 (CRITICAL)

CWECWE 94TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-05-08
2026-05-08 14:16Z
CRIT

CVE-2026-41497 — PraisonAI: Prior to version 4.6.9, the fix for PraisonAI's MCP command handling does not add

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-41497

PraisonAI is a multi-agent teams system. Prior to version 4.6.9, the fix for PraisonAI's MCP command handling does not add a command allowlist or argument validation to parse_mcp_command(), allowing arbitrary executables like bash, python, or /bin/sh with inline code execution flags to pass through to subprocess execution. This issue has been patched in version 4.6.9. CVSSv3.1 9.8 (CRITICAL)

CWECWE 77CWECWE 78VNDPraisonaiTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-08
2026-05-08 14:16Z
HIGH

CVE-2026-41496 — PraisonAI: 52 unvalidated injection points across the codebase.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-41496

PraisonAI is a multi-agent teams system. Prior to praisonai version 4.6.9 and praisonaiagents version 1.6.9, the fix for CVE-2026-40315 added input validation to SQLiteConversationStore only. Nine sibling backends — MySQL, PostgreSQL, async SQLite/MySQL/PostgreSQL, Turso, SingleStore, Supabase, SurrealDB — pass table_prefix straight into f-string SQL. Same root cause, same code pattern, same exploitation. 52 unvalidated injection points across the codebase. postgres.py additi CVSSv3.1 8.1 (HIGH)

CWECWE 89VNDPraisonaiTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-05-08
2026-05-08 14:16Z
HIGH

CVE-2026-41491 — Dapr: From versions 1.3.0 to before 1.15.14, 1.16.0-rc.1 to before 1.16.14, and 1.17.0-rc.1 to before

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-41491

Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. From versions 1.3.0 to before 1.15.14, 1.16.0-rc.1 to before 1.16.14, and 1.17.0-rc.1 to before 1.17.5, a vulnerability has been found in Dapr that allows bypassing access control policies for service invocation using reserved URL characters and path traversal sequences in method paths. The ACL normalized the method path independently from the dispatch layer, so the ACL eval CVSSv3.1 8.1 (HIGH)

CWECWE 284CWECWE 22VNDDaprTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-05-08
2026-05-08 14:16Z
HIGH

CVE-2026-39816 — Apache Nifi: The missing Restricted annotation allows users without the Execute Code Permission to configure the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-39816

The optional extension component TinkerpopClientService is missing the Restricted annotation with the Execute Code Required Permission in Apache NiFi 2.0.0-M1 through 2.8.0. The TinkerpopClientService supports configuration of ByteCode Submission for the Script Submission Type, enabling Groovy Script execution in the service prior to submitting the query. The missing Restricted annotation allows users without the Execute Code Permission to configure the Service in installatio CVSSv3.1 8.8 (HIGH)

CWECWE 862VNDApacheVNDTinkerpopclientserviceTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-08
2026-05-08 13:16Z
CRIT

CVE-2026-25199 — Instances: deployed via the Proxmox extension allow unauthorized access to instances belonging to other

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-25199

Instances deployed via the Proxmox extension allow unauthorized access to instances belonging to other tenants. This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.0.0. The Proxmox extension for CloudStack improperly uses a user-editable instance setting, proxmox_vmid, to associate CloudStack instances with Proxmox virtual machines. Because this value is not restricted or validated against tenant ownership and Proxmox VM IDs are predictable, a non-privile CVSSv3.1 9.1 (CRITICAL)

CWECWE 200VNDInstancesTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-05-08
2026-05-08 13:16Z
HIGH

CVE-2026-25077 — Apache Cloudstack: Due to missing file name sanitization, an attacker can register malicious templates to execute

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-25077

Account users are allowed by default to register templates to be downloaded directly to the primary storage for deploying instances using the KVM hypervisor. Due to missing file name sanitization, an attacker can register malicious templates to execute arbitrary code on the KVM hosts. This can result in the compromise of resource integrity and confidentiality, data loss, denial of service, and availability of the KVM-based infrastructure managed by CloudStack. Users are rec CVSSv3.1 8.8 (HIGH)

CWECWE 94VNDApacheVNDAccountTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-08
2026-05-08 13:16Z
HIGH

CVE-2025-66467 — MinIO: Missing MinIO policy cleanup on bucket deletion via Apache CloudStack allows users to retain

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-66467

Missing MinIO policy cleanup on bucket deletion via Apache CloudStack allows users to retain access to buckets which they previously owned. If another user creates a new bucket with the same name, the previous owners can gain unauthorized read and write access to it by using the previously generated access and secret keys. Users are recommended to upgrade to Apache CloudStack versions 4.20.3.0 or 4.22.0.1, or later, which fixes this issue. CVSSv3.1 8.0 (HIGH)

CWECWE 459VNDMinioTYPVulnerability
8.0
CVSS v3.1
90
Edit Score
2026-05-08
2026-05-08 13:16Z
HIGH

CVE-2025-66172 — CloudStack: The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-66172

The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0.0+ environments, where this plugin is enabled and have access to specific APIs can restore a volume from any other user's backups and attach the volume to their own VMs. Backup plugin users using CloudStack 4.21.0.0+ are recommended to upgrade to CloudStack version 4.22.0.1, which fixes this issue. CVSSv3.1 8.1 (HIGH)

CWECWE 359VNDCloudstackTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-05-08
2026-05-08 13:16Z
HIGH

CVE-2022-50994 — DrayTek: Vigor 2960 firmware versions prior to 1.5.1.4 contain an OS command injection vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-50994

DrayTek Vigor 2960 firmware versions prior to 1.5.1.4 contain an OS command injection vulnerability in the CGI login handler that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the formpassword parameter. Attackers can exploit unsanitized input passed to the otp_check.sh script to achieve remote code execution with web server privileges. Exploitation requires knowledge of a valid username and that the target accoun CVSSv3.1 8.1 (HIGH)

CWECWE 78VNDDraytekTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-05-08
2026-05-08 13:00Z
HIGH

Otto Support - The Confused Deputy

Bishop Fox Labs·bishopfox.comin the wild

Bishop Fox Labs publishes a technical deep-dive on confused deputy attacks against AI agents with tool access, demonstrating how attackers embed malicious instructions in attacker-controlled content (emails, calendar invites, support tickets) that agents execute using their own elevated privileges. The research documents real-world incidents including Microsoft Copilot calendar manipulation (January 2026), ConfusedPilot email exfiltration (August 2024), and June 2025 Microsoft 365 Copilot data theft, then presents layered mitigations including prompt separation, per-task tool registration with least privilege, and network egress controls.

SRFApplicationTACTA0001TACTA0002SRFAiTYPResearchSTGExecutionSTGInitial AccessSTGCred Access
82
Edit Score
2026-05-08
2026-05-08 12:16Z
CRIT

CVE-2026-8153 — Dashboard: OS command injection in Dashboard Server interface in Universal Robots PolyScope versions prior to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-8153

OS command injection in Dashboard Server interface in Universal Robots PolyScope versions prior to 5.21.1 allows unauthenticated attacker to craft commands that will execute code on the robot's OS. CVSSv3.1 9.8 (CRITICAL)

CWECWE 78VNDDashboardTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-08
2026-05-08 09:16Z
HIGH

CVE-2026-5127 — User: The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-5127

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Deserialization of Untrusted Data in versions up to, and including, 4.3.1 This is due to insufficient input validation and type checking on the wpuf_files parameter during form submission, combined with unconditional deserialization via maybe_unserialize() when displaying post content. This makes it possible for authenticated attackers, CVSSv3.1 8.8 (HIGH)

CWECWE 502TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-08
2026-05-08 08:16Z
HIGH

CVE-2026-43284 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-43284

In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), so later paths that may modify packet data can first make a private copy. The IPv4/IPv6 datagram append paths did not set this flag when splicing pages into UDP skbs. That leaves an ESP-in-UDP packet made from shared CVSSv3.1 8.8 (HIGH)

CWECWE 123TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-08
2026-05-08 08:16Z
CRIT

CVE-2013-10075 — Chorny Apache\: This can lead to sessions being revived, potentially with data that was to be

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2013-10075

Apache::Session versions through 1.94 for Perl re-creates deleted sessions. The session stores Apache::Session::Store::File and Apache::Session::Store::DB_File will create a session that does not exist. This can lead to sessions being revived, potentially with data that was to be deleted. CVSSv3.1 9.1 (CRITICAL)

CWECWE 672VNDApacheVNDChornyTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-05-08
2026-05-08 08:00Z
CRIT

CVE-2025-68670: discovering an RCE vulnerability in xrdp

Kaspersky Securelist·securelist.comCVE-2025-68670

Kaspersky disclosed CVE-2025-68670, a stack buffer overflow in xrdp's domain name parsing that allows unauthenticated remote code execution. The vulnerability exists in xrdp_wm_parse_domain_information(), which fails to properly bounds-check a 512-byte UTF-8 domain string into a 256-byte stack buffer. Exploitation requires no credentials and occurs before authentication, with a working PoC provided using crafted RDP files with oversized domain names containing specific Unicode characters.

TACTA0001SRFNetworkSWXrdpTYPVulnerabilitySTGInitial AccessTECT1190EXPRceEXPStack Overflow
82
Edit Score
2026-05-08
2026-05-08 07:16Z
HIGH

CVE-2026-4935 — OttoKit: The OttoKit: All-in-One Automation Platform WordPress plugin before 1.1.23 does not properly sanitize user

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4935

The OttoKit: All-in-One Automation Platform WordPress plugin before 1.1.23 does not properly sanitize user input before using it in a SQL statement, which could allow unauthenticated attackers to perform SQL injection attacks. CVSSv3.1 8.6 (HIGH)

CWECWE 89VNDOttokitTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-05-08
2026-05-08 07:16Z
CRIT

CVE-2025-69691 — Netgate: pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-69691

Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php. NOTE: the Supplier disputes this because the API call is only available to admins and they are intentionally allowed to execute PHP code. CVSSv3.1 9.9 (CRITICAL)

CWECWE 284CWECWE 915VNDNetgateTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-05-08
2026-05-08 07:16Z
CRIT

CVE-2025-69690 — Netgate: pfSense CE 2.7.2 allows code execution by using the module installer with a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-69690

Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the post_reboot_commands property. NOTE: the Supplier disputes this because this installer is only available to admins and they are intentionally allowed to execute PHP code. CVSSv3.1 9.1 (CRITICAL)

CWECWE 502CWECWE 915VNDNetgateTYPVulnerability
9.1
CVSS v3.1
96
Edit Score