Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-09 22:29Z
2026-05-05
2026-05-05 00:00Z
CRIT

InstallFix and Claude Code: How Fake Install Pages Lead to Real Compromise

Trend Micro Research·trendmicro.comin the wild

Trend Micro disclosed the InstallFix campaign, a multi-stage malware distribution operation leveraging fake Claude AI installer pages promoted via Google Ads to target users across multiple industries and regions. The attack chain uses mshta.exe, obfuscated PowerShell, VBScript COM abuse, AMSI bypass, SSL validation disabling, and victim-unique C&C URLs to achieve persistence and data collection; the final payload exhibits RedLine stealer indicators and collects browser/e-wallet credentials.

SRFApplicationTACTA0005TACTA0001TACTA0002TACTA0006SRFWebTACTA0009OSWindows
82
Edit Score
2026-05-05
2026-05-05 00:00Z
MED

Your UEBA is lying to you: Why entity record quality decides everything

Elastic Security Labs·elastic.co

Elastic Security Labs publishes a technical deep-dive on User and Entity Behavior Analytics (UEBA) entity record quality, arguing that most UEBA implementations fail because they conflate usernames with identities. The post outlines Elastic's two-tier entity governance model: identity-provider-backed entities (Okta, Entra ID, AD) treated as authoritative, and endpoint-observed local host-scoped entities governed with lower confidence; it also describes automatic cross-provider entity resolution to unify fragmented user identities.

SRFApplicationTACTA0001SRFIdentitySWElastic SecurityVNDElasticTYPResearchTECT1087
62
Edit Score
2026-05-04
2026-05-04 22:00Z
HIGH

Paramiko Security Audit

Quarkslab·blog.quarkslab.com

Quarkslab conducted the first public security audit of Paramiko SSH library on behalf of OSTIF, identifying 30 vulnerabilities across Paramiko and its cryptography dependencies: 2 high-severity issues (insecure RSA signature parameters, weak TripleDES key sizes), 6 medium-severity issues (deprecated key exchange methods, weak DH parameters), and 22 lower-severity findings. All identified issues have been remediated with fixes committed to the respective projects.

SRFApplicationSRFNetworkTACTA0006SWCryptographySWParamikoVNDPycaTYPResearchSTGCred Access
72
Edit Score
2026-05-04
2026-05-04 21:16Z
CRIT

CVE-2026-42238 — Nginxui Nginx_ui: Prior to version 2.3.8, nginx-ui exposes a backup restore endpoint (POST /api/restore) that is

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-42238

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, nginx-ui exposes a backup restore endpoint (POST /api/restore) that is completely unauthenticated during the first 10 minutes after process startup on any fresh installation. An unauthenticated remote attacker can upload a crafted backup archive that overwrites the application's configuration file (app.ini) and SQLite database. Because the attacker controls the restored app.ini, they can inject CVSSv3.1 9.8 (CRITICAL)

CWECWE 94VNDNginxVNDNginxuiTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-04
2026-05-04 21:16Z
HIGH

CVE-2026-42222 — Nginx: In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-42222

Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install. At time of publication no public patches are available. CVSSv3.1 8.1 (HIGH)

CWECWE 306CWECWE 284VNDNginxTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-05-04
2026-05-04 21:16Z
HIGH

CVE-2026-42221 — Nginx: From version 2.0.0 to before version 2.3.8, an unauthenticated network attacker can claim the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-42221

Nginx UI is a web user interface for the Nginx web server. From version 2.0.0 to before version 2.3.8, an unauthenticated network attacker can claim the initial administrator account on a fresh nginx-ui instance during the first-run setup window. The public /api/install endpoint is reachable without authentication, and the request-encryption flow only protects payload confidentiality in transit; it does not authenticate who is allowed to perform installation. A remote attacke CVSSv3.1 8.1 (HIGH)

CWECWE 306VNDNginxTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-05-04
2026-05-04 20:16Z
HIGH

CVE-2025-67796 — IKUS: Rdiffweb before 2.10.5 has an improper authorization flaw that allows an attacker with

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-67796

IKUS Rdiffweb before 2.10.5 has an improper authorization flaw that allows an attacker with any valid or stolen access token to act as other users. The API does not enforce binding between the authenticated subject and the targeted user/tenant, so crafted requests can read or modify other users data and, in some cases, perform privileged actions. This issue may enable cross-tenant access. Fixed in version 2.10.6. CVSSv3.1 8.1 (HIGH)

CWECWE 284VNDIkusTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-05-04
2026-05-04 19:16Z
HIGH

CVE-2026-42237 — N8n N8n: Both nodes construct SQL queries by directly interpolating user-controlled table names, column names, and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-42237

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, the fix for GHSA-f3f2-mcxc-pwjx did not cover the Snowflake node or the legacy MySQL v1 node. Both nodes construct SQL queries by directly interpolating user-controlled table names, column names, and update keys into query strings without identifier escaping, enabling SQL injection against the connected database. This issue has been patched in versions 1.123.32, 2.17.4, and 2.1 CVSSv3.1 8.8 (HIGH) · EPSS 9th percentile

CWECWE 89VNDN8nTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-04
2026-05-04 19:16Z
CRIT

CVE-2026-42235 — N8n N8n: Clicking the link would execute arbitrary JavaScript in the victim's authenticated n8n browser session

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-42235

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an unauthenticated attacker could register a malicious MCP OAuth client with a crafted client_name. If a victim user authorized the OAuth consent dialog and a second user subsequently revoked that access, a toast notification would render the injected script. Clicking the link would execute arbitrary JavaScript in the victim's authenticated n8n browser session, enabling credent CVSSv3.1 9.6 (CRITICAL) · EPSS 25th percentile

CWECWE 79CWECWE 87VNDN8nTYPVulnerability
9.6
CVSS v3.1
98
Edit Score
2026-05-04
2026-05-04 19:16Z
HIGH

CVE-2026-42234 — N8n N8n: Prior to versions 1.123.32, 2.17.4, and 2.18.1, an authenticated user with permission to create

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-42234

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an authenticated user with permission to create or modify workflows containing a Python Code Node could escape the sandbox and achieve arbitrary code execution on the task runner container. This issue only affects instances where the Python Task Runner is enabled. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1. CVSSv3.1 8.8 (HIGH) · EPSS 21th percentile

CWECWE 94VNDN8nTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-04
2026-05-04 19:16Z
CRIT

CVE-2026-42233 — N8n N8n: is an open source workflow automation platform.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-42233

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the Oracle Database node's select operation allowed user-controlled input passed into the Limit field via expressions to be interpolated directly into the SQL query without sanitization or parameterization. In workflows where external input is passed into the Limit field (e.g., from a webhook), an attacker could inject arbitrary SQL and exfiltrate data from the connec CVSSv3.1 9.8 (CRITICAL) · EPSS 14th percentile

CWECWE 89VNDN8nTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-04
2026-05-04 19:16Z
HIGH

CVE-2026-42232 — N8n N8n: Prior to versions 1.123.32, 2.17.4, and 2.18.1, an authenticated user with permission to create

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-42232

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an authenticated user with permission to create or modify workflows could achieve global prototype pollution via the XML Node leading to RCE when combined with other nodes exploiting the prototype pollution. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1. CVSSv3.1 8.8 (HIGH) · EPSS 16th percentile

CWECWE 1321VNDN8nTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-04
2026-05-04 19:16Z
HIGH

CVE-2026-42231 — N8n N8n: An authenticated user with permission to create or modify workflows could exploit this to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-42231

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the xml2js library used to parse XML request bodies in n8n's webhook handler allowed prototype pollution via a crafted XML payload. An authenticated user with permission to create or modify workflows could exploit this to pollute the JavaScript object prototype and, by chaining the pollution with the Git node's SSH operations, achieve remote code execution on the n8n CVSSv3.1 8.8 (HIGH) · EPSS 65th percentile

CWECWE 1321VNDN8nTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-04
2026-05-04 19:16Z
HIGH

CVE-2026-42229 — N8n N8n: is an open source workflow automation platform.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-42229

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the SeaTable node's row:search and row:get operations allowed user-controlled input to be concatenated directly into SQL query strings without escaping or parameterization. In workflows where external user input is passed via expressions into the SeaTable node's search or row retrieval parameters, an attacker could manipulate the constructed query to retrieve unintend CVSSv3.1 8.8 (HIGH)

CWECWE 89VNDN8nTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-04
2026-05-04 18:16Z
CRIT

CVE-2026-42796 — Arelle: before 2.39.10 contains an unauthenticated remote code execution vulnerability in the /rest/configure REST

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-42796

Arelle before 2.39.10 contains an unauthenticated remote code execution vulnerability in the /rest/configure REST endpoint that accepts a plugins query parameter and forwards it to the plugin manager without authentication or authorization. Attackers can supply a URL to a malicious Python file through the plugins parameter, causing the Arelle webserver to download and execute the attacker-controlled code within the Arelle process with its privileges. CVSSv3.1 9.8 (CRITICAL)

CWECWE 306VNDArelleTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-04
2026-05-04 18:16Z
CRIT

CVE-2026-42088 — OpenC3: Prior to version 7.0.0-rc3, the Script Runner widget allows users to execute Python and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-42088

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to version 7.0.0-rc3, the Script Runner widget allows users to execute Python and Ruby scripts directly from the openc3-COSMOS-script-runner-api container. Because all the docker containers share a network, users can execute specially crafted scripts to bypass the API permissions check and perform administrative actions, including reading and modifying CVSSv3.1 9.6 (CRITICAL)

CWECWE 250VNDOpenc3TYPVulnerability
9.6
CVSS v3.1
98
Edit Score
2026-05-04
2026-05-04 18:16Z
CRIT

CVE-2026-42087 — OpenC3: From version 6.7.0 to before version 7.0.0-rc3, a SQL injection vulnerability exists in the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-42087

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From version 6.7.0 to before version 7.0.0-rc3, a SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS. The tsdb_lookup function in the cvt_model.rb file directly places user-supplied input into a SQL query without sanitizing the input. As a result, a user can break out of the initial SQL statement and execute arbitrary S CVSSv3.1 9.6 (CRITICAL)

CWECWE 89VNDOpenc3TYPVulnerability
9.6
CVSS v3.1
98
Edit Score
2026-05-04
2026-05-04 18:16Z
HIGH

CVE-2026-42084 — OpenC3: Prior to versions 6.10.5 and 7.0.0-rc3, the OpenC3 password change functionality allows a user

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-42084

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and 7.0.0-rc3, the OpenC3 password change functionality allows a user to change their password without providing the old password, by accepting a valid session token instead. In assumed breach scenarios, this behaviour can be exploited by an attacker who has already obtained a valid session token, to gain persistence in hijacked acco CVSSv3.1 8.1 (HIGH)

CWECWE 620VNDOpenc3TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-05-04
2026-05-04 18:16Z
CRIT

CVE-2026-41571 — Note: In version 0.19.2, IsPasswordMatch in backend/db/models.go falls back to a hard-coded bcrypt("null") placeholder whenever

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-41571

Note Mark is an open-source note-taking application. In version 0.19.2, IsPasswordMatch in backend/db/models.go falls back to a hard-coded bcrypt("null") placeholder whenever a user has no stored password. OIDC-registered users are created with an empty password, so anyone who submits password: "null" to the internal login endpoint receives a valid session for that user. The bypass is unauthenticated and requires no user interaction. This issue has been patched in version 0.1 CVSSv3.1 9.4 (CRITICAL)

CWECWE 287TYPVulnerability
9.4
CVSS v3.1
97
Edit Score
2026-05-04
2026-05-04 18:16Z
HIGH

CVE-2026-29004 — BusyBox: before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-29004

BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client (udhcpc6) DNS_SERVERS option handler in networking/udhcp/d6_dhcpc.c that allows network-adjacent attackers to trigger memory corruption by sending a crafted DHCPv6 response with a malformed D6_OPT_DNS_SERVERS option. Attackers can exploit incorrect heap buffer allocation calculations in the option_to_env() function to cause denial of service or achieve arbitrary code execution on CVSSv3.1 8.1 (HIGH)

CWECWE 122VNDBusyboxTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-05-04
2026-05-04 18:16Z
HIGH

CVE-2026-0073 — In adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual authentication

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-0073

In adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual authentication due to a logic error in the code. This could lead to remote (proximal/adjacent) code execution as the shell user with no additional execution privileges needed. User interaction is not needed for exploitation. CVSSv3.1 8.8 (HIGH)

CWECWE 303TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-04
2026-05-04 17:16Z
CRIT

CVE-2026-42812 — Apache: The full persisted / credential-vending variant requires the affected catalog to have `polaris.config.allow.unstructured.table.location=true`, with

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-42812

In Apache Iceberg, the table's metadata files are control files: they tell readers which data files belong to the table and which table version to read. `write.metadata.path` is an optional table property that tells Polaris where to write those metadata files. For a table already registered in a Polaris-managed catalog, changing only that property through an `ALTER TABLE`-style settings change (not a row-level `INSERT`, `SELECT`, `UPDATE`, or `DELETE`) bypasses the commit CVSSv3.1 9.9 (CRITICAL)

CWECWE 284CWECWE 863CWECWE 20CWECWE 732VNDApacheTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-05-04
2026-05-04 17:16Z
CRIT

CVE-2026-42811 — Apache: In plain terms, Apache Polaris is supposed to issue short-lived GCS credentials that only

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-42811

In plain terms, Apache Polaris is supposed to issue short-lived GCS credentials that only work for one table's files, but a crafted namespace or table name can cause those credentials to work across the configured bucket instead. Apache Polaris builds Google Cloud Storage downscoped credentials by creating a Credential Access Boundary (CAB) with CEL conditions that are intended to restrict access to the requested table's storage path. The relevant CEL string is built fro CVSSv3.1 9.9 (CRITICAL)

CWECWE 20CWECWE 917VNDApacheTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-05-04
2026-05-04 17:16Z
CRIT

CVE-2026-42810 — Apache: A control case using ordinary different names did not allow the same cross-table access.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-42810

Apache Polaris accepts literal `*` characters in namespace and table names. When it later builds temporary S3 access policies for delegated table access, those same characters appear to be reused unescaped in S3 IAM resource patterns and `s3:prefix` conditions. In S3 IAM policy matching, `*` is treated as a wildcard rather than as ordinary text. That means temporary credentials issued for one crafted table can match the storage path of a different table. In private test CVSSv3.1 9.9 (CRITICAL)

CWECWE 20CWECWE 116VNDApacheTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-05-04
2026-05-04 17:16Z
CRIT

CVE-2026-42809 — Apache: Polaris can issue broad temporary ("vended") storage credentials during staged table creation before

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-42809

Apache Polaris can issue broad temporary ("vended") storage credentials during staged table creation before the effective table location has been validated or durably reserved. Those temporary credentials are meant to limit the scope of accessible table data and metadata, but this scope limitation becomes attacker- directed because the attacker can choose a reachable target location. In the confirmed variant, if the caller supplies a custom `location` during stage create CVSSv3.1 9.9 (CRITICAL)

CWECWE 862CWECWE 20VNDApacheTYPVulnerability
9.9
CVSS v3.1
100
Edit Score