Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-09 23:49Z
2026-05-04
2026-05-04 00:00Z
CRIT

Quasar Linux (QLNX) – A Silent Foothold in the Supply Chain: Inside a Full-Featured Linux RAT With Rootkit, PAM Backdoor, Credential Harvesting Capabilities

Trend Micro Research·trendmicro.comin the wild

Trend Micro researchers disclosed Quasar Linux (QLNX), a previously undocumented, full-featured Linux RAT targeting developer workstations and supply-chain infrastructure. The malware combines fileless execution, eBPF rootkit capabilities, PAM credential interception, SSH key harvesting, and P2P mesh networking to maintain persistent, stealthy access while exfiltrating development credentials (NPM, PyPI, AWS, Kubernetes, Docker, Git tokens). QLNX's primary attack surface is package maintainers and DevOps engineers, enabling supply-chain poisoning of open-source ecosystems.

SRFOsTACTA0004TACTA0005TACTA0001TACTA0006TACTA0007TACTA0003TACTA0008
92
Edit Score
2026-05-03
2026-05-03 07:16Z
HIGH

CVE-2026-7685 — Edimax: Performing a manipulation of the argument pptpDfGateway results in buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7685

A vulnerability was detected in Edimax BR-6208AC up to 1.02. Affected is an unknown function of the file /goform/setWAN. Performing a manipulation of the argument pptpDfGateway  results in buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. CVSSv3.1 8.8 (HIGH)

CWECWE 120CWECWE 119VNDEdimaxTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-03
2026-05-03 07:16Z
HIGH

CVE-2026-7684 — Such manipulation of the argument pptpDfGateway leads to buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7684

A security vulnerability has been detected in Edimax BR-6428nC up to 1.16. This impacts an unknown function of the file /goform/setWAN. Such manipulation of the argument pptpDfGateway  leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. CVSSv3.1 8.8 (HIGH)

CWECWE 120CWECWE 119TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-03
2026-05-03 03:16Z
HIGH

CVE-2026-7675 — The manipulation of the argument Channel/ApCliSsid leads to buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7675

A vulnerability has been found in Shenzhen Libituo Technology LBT-T300-HW1 up to 1.2.8. Impacted is the function start_lan of the file /apply.cgi. The manipulation of the argument Channel/ApCliSsid leads to buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. CVSSv3.1 8.8 (HIGH)

CWECWE 120CWECWE 119TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-03
2026-05-03 02:17Z
HIGH

CVE-2026-7674 — Executing a manipulation of the argument vpn_pptp_server/vpn_l2tp_server can lead to buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7674

A flaw has been found in Shenzhen Libituo Technology LBT-T300-HW1 up to 1.2.8. This issue affects the function start_single_service of the component Web Management Interface. Executing a manipulation of the argument vpn_pptp_server/vpn_l2tp_server can lead to buffer overflow. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way. CVSSv3.1 8.8 (HIGH)

CWECWE 120CWECWE 119TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-02
2026-05-02 14:16Z
HIGH

CVE-2026-2554 — WCFM: The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-2554

The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.25 via the 'wcfm_delete_wcfm_customer' due to missing validation on the 'customerid' user controlled key. This makes it possible for authenticated attackers, with Vendor-level access and above, to delete arbitrary users, including Administrators. CVSSv3.1 8.1 (HIGH)

CWECWE 639VNDWcfmTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-05-02
2026-05-02 10:16Z
HIGH

CVE-2026-7491 — School: App developed by Zyosoft has an Insecure Direct Object Reference vulnerability, allowing authenticated

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7491

School App developed by Zyosoft has an Insecure Direct Object Reference vulnerability, allowing authenticated remote attackers to modify a specific parameter to read and modify other users' data. CVSSv3.1 8.1 (HIGH)

CWECWE 639VNDSchoolTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-05-02
2026-05-02 10:16Z
HIGH

CVE-2026-7489 — CTMS: developed by Sunnet has a SQL Injection vulnerability, allowing authenticated remote attackers to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7489

CTMS developed by Sunnet has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents. CVSSv3.1 8.8 (HIGH)

CWECWE 89VNDCtmsTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-02
2026-05-02 08:16Z
HIGH

CVE-2026-7607 — The manipulation of the argument str leads to buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7607

A security vulnerability has been detected in TRENDnet TEW-821DAP 1.12B01. Impacted is the function auto_update_firmware of the component Firmware Udpate. The manipulation of the argument str leads to buffer overflow. The attack may be initiated remotely. The vendor explains: "That firmware version will only work on our hardware version v1.xR. We have already EOL that product 8 years ago and are no longer selling". This vulnerability only affects products that are no longer s CVSSv3.1 8.8 (HIGH)

CWECWE 120CWECWE 119TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-02
2026-05-02 08:16Z
HIGH

CVE-2026-2052 — Widget: The Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-2052

The Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.2 via the Display Logic feature. This is due to the plugin using eval() on user-supplied Display Logic expressions with an insufficient blocklist/allowlist that can be bypassed using array_map with string concatenation, combined with a lack of authorization enforcement on the extended_ CVSSv3.1 8.8 (HIGH)

CWECWE 94VNDWidgetTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-02
2026-05-02 06:16Z
HIGH

CVE-2026-7647 — Profile: The Profile Builder Pro plugin for WordPress is vulnerable to PHP Object Injection in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7647

The Profile Builder Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.14.5. This is due to the use of PHP's maybe_unserialize() function on the attacker-controlled 'args' POST parameter within the wppb_request_users_pins_action_callback() AJAX handler, which lacked any nonce verification, type checking, or input validation before deserialization. Because the handler was registered with both wp_ajax_ and wp_ajax_nopriv_ hooks, CVSSv3.1 8.1 (HIGH)

CWECWE 502VNDProfileTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-05-02
2026-05-02 05:16Z
HIGH

CVE-2026-7641 — Import: The Import and export users and customers plugin for WordPress is vulnerable to Privilege

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7641

The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 2.0.8 via the `save_extra_user_profile_fields()` function. This is due to an incomplete blocklist that correctly restricts capability meta keys for the primary site (e.g., `wp_capabilities`, `wp_user_level`) but fails to block the equivalent meta keys for any other subsite in a WordPress Multisite network (e.g., `wp_2_capabilities`, `wp_2_us CVSSv3.1 8.8 (HIGH)

CWECWE 269VNDImportTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-02
2026-05-02 05:16Z
CRIT

CVE-2026-7458 — User: The User Verification by PickPlugins plugin for WordPress is vulnerable to authentication bypass in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7458

The User Verification by PickPlugins plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.46. This is due to the use of a loose PHP comparison operator to validate OTP codes in the "user_verification_form_wrap_process_otpLogin" function. This makes it possible for unauthenticated attackers to log in as any user with a verified email address, such as an administrator, by submitting a "true" OTP value. CVSSv3.1 9.8 (CRITICAL)

CWECWE 288TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-02
2026-05-02 05:16Z
HIGH

CVE-2026-6963 — Mail: The WP Mail Gateway plugin for WordPress is vulnerable to unauthorized access due to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-6963

The WP Mail Gateway plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wmg_save_provider_config AJAX action in all versions up to, and including, 1.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update SMTP settings and redirect mail which can be used for privilege escalation by triggering a password reset email and using that to access and administrator's account. CVSSv3.1 8.8 (HIGH)

CWECWE 862VNDMailTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-02
2026-05-02 05:16Z
CRIT

CVE-2026-4882 — User: The User Registration Advanced Fields plugin for WordPress is vulnerable to arbitrary file uploads

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4882

The User Registration Advanced Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'URAF_AJAX::method_upload' function in all versions up to, and including, 1.6.20. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The vulnerability can only be exploited if a "Profile Picture" field is added to the form. CVSSv3.1 9.8 (CRITICAL)

CWECWE 434TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-01
2026-05-01 20:22Z
HIGH

Metasploit Wrap-Up 01/05/2026

Rapid7 Research·rapid7.comCVE-2026-31431

Metasploit Framework 6.4.131 release adds MCP server integration for AI-assisted reconnaissance, ships a local privilege escalation exploit for CVE-2026-31431 (Copy Fail Linux kernel flaw affecting AMD64/AARCH64), and introduces an NTLM HTTP-to-LDAP relay module. The Copy Fail LPE exploits a logic flaw in Linux kernel cryptographic APIs by replacing the 'su' binary in page cache to achieve command execution.

SRFOsTACTA0004OSLinuxSWMetasploitVNDRapid7TYPToolTECT1548EXPLpe
78
Edit Score
2026-05-01
2026-05-01 19:16Z
HIGH

CVE-2026-30363 — flipperzero-firmware commit ad2a80 was discovered to contain a stack overflow in the "Main" function.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-30363

flipperzero-firmware commit ad2a80 was discovered to contain a stack overflow in the "Main" function. CVSSv3.1 8.4 (HIGH)

CWECWE 121TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-05-01
2026-05-01 17:16Z
HIGH

CVE-2026-42469 — Buffer: overflow vulnerability in Open Vehicle Monitoring System 3 (OVMS3) 3.3.005.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-42469

Buffer overflow vulnerability in Open Vehicle Monitoring System 3 (OVMS3) 3.3.005. In canformat_canswitch.cpp the parser does not properly validate a CANswitch DLC value, allowing remote attackers to cause a denial of service or possibly execute arbitrary code via crafted CANswitch frames. CVSSv3.1 8.6 (HIGH)

CWECWE 121VNDBufferTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-05-01
2026-05-01 17:16Z
HIGH

CVE-2026-42468 — Buffer: overflow vulnerability in Open Vehicle Monitoring System 3 (OVMS3) 3.3.005.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-42468

Buffer overflow vulnerability in Open Vehicle Monitoring System 3 (OVMS3) 3.3.005. In canformat_pcap.cpp , the parser's phdr.len field is not properly validated, allowing remote attackers to cause a denial of service or possibly execute arbitrary code via crafted PCAP input. CVSSv3.1 8.8 (HIGH)

CWECWE 121VNDBufferTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-01
2026-05-01 17:16Z
CRIT

CVE-2026-37541 — Buffer: overflow vulnerability in Open Vehicle Monitoring System 3 (OVMS3) 3.3.005.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-37541

Buffer overflow vulnerability in Open Vehicle Monitoring System 3 (OVMS3) 3.3.005. In canformat_gvret.cpp, the length field in GVRET binary data is not properly validated, allowing remote attackers to cause a denial of service or possibly execute arbitrary code via crafted GVRET frames. CVSSv3.1 10.0 (CRITICAL)

VNDBufferTYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2026-05-01
2026-05-01 17:16Z
HIGH

CVE-2026-37540 — OpenAMP: v2025.10.0 ELF loader contains an integer overflow vulnerability in firmware image parsing.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-37540

OpenAMP v2025.10.0 ELF loader contains an integer overflow vulnerability in firmware image parsing. In elf_loader.c, it performs multiplication of two attacker-controlled 16-bit values from the ELF header without overflow checking. On 32-bit embedded systems (STM32MP1, Zynq, i.MX), large values can cause the product to wrap around to a small value. CVSSv3.1 8.4 (HIGH)

VNDOpenampTYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-05-01
2026-05-01 17:16Z
CRIT

CVE-2026-37539 — Buffer: overflow vulnerability in cannelloni v2.0.0 in CAN frame parsing in parser.cpp in function

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-37539

Buffer overflow vulnerability in cannelloni v2.0.0 in CAN frame parsing in parser.cpp in function parseCANFrame, and decoder.cpp in function decodeFrame allowing remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted CAN FD frames. CVSSv3.1 9.8 (CRITICAL)

VNDBufferTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-01
2026-05-01 17:16Z
HIGH

CVE-2026-37537 — SAE: collin80/Open-SAE-J1939 thru commit 744024d4306bc387857dfce439558336806acb06 (2023-03-08) contains an integer underflow leading to out-of-bounds write in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-37537

collin80/Open-SAE-J1939 thru commit 744024d4306bc387857dfce439558336806acb06 (2023-03-08) contains an integer underflow leading to out-of-bounds write in Transport Protocol Data Transfer handling. At line 23: uint8_t index = data[0] - 1. When data[0] (sequence number from CAN frame) is 0, index underflows to 255. Subsequent write at tp_dt->data[255*7 + i-1] reaches offset 1791, exceeding the MAX_TP_DT buffer (1785 bytes) by 6 bytes. CVSSv3.1 8.1 (HIGH)

VNDSaeTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-05-01
2026-05-01 17:16Z
HIGH

CVE-2026-37536 — miaofng/uds-c commit e506334e270d77b20c0bc259ac6c7d8c9b702b7a (2016-10-05) contains a stack buffer overflow in send_diagnostic_request.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-37536

miaofng/uds-c commit e506334e270d77b20c0bc259ac6c7d8c9b702b7a (2016-10-05) contains a stack buffer overflow in send_diagnostic_request. A 6-byte stack buffer (MAX_DIAGNOSTIC_PAYLOAD_SIZE=6) receives memcpy at offset 1+pid_length with payload_length bytes. MAX_UDS_REQUEST_PAYLOAD_LENGTH=7, so 1+2+7=10 exceeds buffer by 4 bytes. No bounds check on payload_length before memcpy. CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-01
2026-05-01 17:16Z
CRIT

CVE-2026-37534 — Integer: underflow vulnerability in Open-SAE-J1939 thru commit b6caf884df46435e539b1ecbf92b6c29b345bdfe (2025-11-30) in SAE_J1939_Read_Transport_Protocol_Data_Transfer,allows attacker

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-37534

Integer underflow vulnerability in Open-SAE-J1939 thru commit b6caf884df46435e539b1ecbf92b6c29b345bdfe (2025-11-30) in SAE_J1939_Read_Transport_Protocol_Data_Transfer,allows attackers to write to arbitrary memory via crafted sequence number from the CAN frame. CVSSv3.1 9.8 (CRITICAL)

CWECWE 191TYPVulnerability
9.8
CVSS v3.1
99
Edit Score