Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-10 01:06Z
2026-05-01
2026-05-01 14:16Z
HIGH

CVE-2026-31712 — Linux: In the Linux kernel, the following vulnerability has been resolved: ksmbd: require minimum ACE

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-31712

In the Linux kernel, the following vulnerability has been resolved: ksmbd: require minimum ACE size in smb_check_perm_dacl() Both ACE-walk loops in smb_check_perm_dacl() only guard against an under-sized remaining buffer, not against an ACE whose declared `ace->size` is smaller than the struct it claims to describe: if (offsetof(struct smb_ace, access_req) > aces_size) break; ace_size = le16_to_cpu(ace->size); if (ace_size > aces_size) break; The first c CVSSv3.1 8.3 (HIGH)

TYPVulnerability
8.3
CVSS v3.1
92
Edit Score
2026-05-01
2026-05-01 14:16Z
HIGH

CVE-2026-31709 — Linux: In the Linux kernel, the following vulnerability has been resolved: smb: client: validate the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-31709

In the Linux kernel, the following vulnerability has been resolved: smb: client: validate the whole DACL before rewriting it in cifsacl build_sec_desc() and id_mode_to_cifs_acl() derive a DACL pointer from a server-supplied dacloffset and then use the incoming ACL to rebuild the chmod/chown security descriptor. The original fix only checked that the struct smb_acl header fits before reading dacl_ptr->size or dacl_ptr->num_aces. That avoids the immediate header-field OOB r CVSSv3.1 8.8 (HIGH) · EPSS 5th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-01
2026-05-01 14:16Z
HIGH

CVE-2026-31708 — Linux: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-31708

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path smb2_ioctl_query_info() has two response-copy branches: PASSTHRU_FSCTL and the default QUERY_INFO path. The QUERY_INFO branch clamps qi.input_buffer_length to the server-reported OutputBufferLength and then copies qi.input_buffer_length bytes from qi_rsp->Buffer to userspace, but it never verifies that the flexible-array payload actually fi CVSSv3.1 8.1 (HIGH) · EPSS 5th percentile

TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-05-01
2026-05-01 14:16Z
HIGH

CVE-2026-31706 — Linux: In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate num_aces and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-31706

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl() smb_inherit_dacl() trusts the on-disk num_aces value from the parent directory's DACL xattr and uses it to size a heap allocation: aces_base = kmalloc(sizeof(struct smb_ace) * num_aces * 2, ...); num_aces is a u16 read from le16_to_cpu(parent_pdacl->num_aces) without checking that it is consistent with the declared pdacl_size. An authent CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-01
2026-05-01 14:16Z
CRIT

CVE-2026-31705 — Linux: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds write

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-31705

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment smb2_get_ea() applies 4-byte alignment padding via memset() after writing each EA entry. The bounds check on buf_free_len is performed before the value memcpy, but the alignment memset fires unconditionally afterward with no check on remaining space. When the EA value exactly fills the remaining buffer (buf_free_len == 0 after value subtraction), CVSSv3.1 9.8 (CRITICAL) · EPSS 5th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-01
2026-05-01 12:16Z
HIGH

CVE-2026-3772 — Editor: The WP Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-3772

The WP Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.9.2. This is due to missing nonce verification in the 'add_plugins_page' and 'add_themes_page' functions. This makes it possible for unauthenticated attackers to overwrite arbitrary plugin and theme PHP files with attacker-controlled code via a forged request, granted they can trick a site administrator into performing an action such as clicking a link. CVSSv3.1 8.8 (HIGH)

CWECWE 352VNDEditorTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-01
2026-05-01 11:16Z
CRIT

CVE-2026-42779 — CVE: Here was the original issue description: Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-42779

The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description: Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypassing the classname allowlist and allowing arbitrary code to be executed. The fix checks if the class is present in the accepted class filter before calling Class.forName(). Affected CVSSv3.1 9.8 (CRITICAL)

CWECWE 502VNDCveTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-05-01
2026-05-01 11:16Z
CRIT

CVE-2026-42778 — CVE: The fix for CVE-2026-41409 was not applied to the 2.1.X and 2.2.X branches.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-42778

The fix for CVE-2026-41409 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description: The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname allowlist of classes allowed to be deserialized was applied too late after a static initializer in a class to be read might already have been executed. Affected versions are Apache MINA 2.1.0 <= 2.1.11, and 2.2.0 <= 2.2.6. The problem is resolved in CVSSv3.1 9.8 (CRITICAL)

CWECWE 502VNDCveTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-01
2026-05-01 10:15Z
CRIT

CVE-2026-7567 — Temporary: The Temporary Login plugin for WordPress is vulnerable to Authentication Bypass in versions up

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7567

The Temporary Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to and including 1.0.0. This is due to improper input validation in the maybe_login_temporary_user() function, which fails to verify that the 'temp-login-token' GET parameter is a scalar string before processing it. When the parameter is supplied as an array, PHP's empty() check is bypassed and sanitize_key() returns an empty string, which is then passed as the meta_value to get_use CVSSv3.1 9.8 (CRITICAL)

CWECWE 288VNDTemporaryTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-01
2026-05-01 09:16Z
HIGH

CVE-2026-43003 — OpenStack: An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-43003

An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading to code execution in the case of a malicious image. CVSSv3.1 8.0 (HIGH)

CWECWE 829VNDOpenstackTYPVulnerability
8.0
CVSS v3.1
90
Edit Score
2026-05-01
2026-05-01 05:16Z
CRIT

CVE-2026-42994 — Bitwarden Cli: 2026.4.0 from 2026-04-22T21:57Z to 2026-04-22T23:30Z, when obtained from npm, had embedded malicious

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-42994

Bitwarden CLI 2026.4.0 from 2026-04-22T21:57Z to 2026-04-22T23:30Z, when obtained from npm, had embedded malicious code. This is related to a Checkmarx supply chain incident. CVSSv3.1 9.8 (CRITICAL) · EPSS 14th percentile

CWECWE 94CWECWE 78VNDBitwardenTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-01
2026-05-01 03:16Z
HIGH

CVE-2026-7548 — Totolink: Performing a manipulation of the argument setUssd results in command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7548

A vulnerability was detected in Totolink NR1800X 9.1.0u.6279_B20210910. This affects the function sub_41A68C of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument setUssd results in command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. CVSSv3.1 8.8 (HIGH)

CWECWE 74CWECWE 77VNDTotolinkTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-01
2026-05-01 03:16Z
CRIT

CVE-2026-7546 — Such manipulation of the argument Host leads to stack-based buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7546

A security vulnerability has been detected in Totolink NR1800X 9.1.0u.6279_B20210910. The impacted element is the function find_host_ip of the component lighttpd. Such manipulation of the argument Host leads to stack-based buffer overflow. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. CVSSv3.1 9.8 (CRITICAL)

CWECWE 121CWECWE 119TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-01
2026-05-01 02:16Z
CRIT

CVE-2026-7538 — Totolink: The manipulation of the argument proto leads to os command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7538

A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function Vulnerability of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument proto leads to os command injection. The attack may be initiated remotely. The exploit is publicly available and might be used. CVSSv3.1 9.8 (CRITICAL)

CWECWE 77CWECWE 78VNDTotolinkTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-01
2026-05-01 00:16Z
HIGH

CVE-2026-7513 — The manipulation leads to buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7513

A vulnerability has been found in UTT HiPER 1200GW up to 2.5.3-170306. The impacted element is the function strcpy of the file /goform/formRemoteControl. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. CVSSv3.1 8.8 (HIGH)

CWECWE 120CWECWE 119TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-01
2026-05-01 00:16Z
HIGH

CVE-2026-7512 — Executing a manipulation can lead to buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7512

A flaw has been found in UTT HiPER 1200GW up to 2.5.3-1703. The affected element is the function strcpy of the file /goform/formUser. Executing a manipulation can lead to buffer overflow. The attack can be launched remotely. The exploit has been published and may be used. CVSSv3.1 8.8 (HIGH)

CWECWE 120CWECWE 119TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-01
2026-05-01 00:00Z
INFO

DFIR: From alert to root cause using Osquery without leaving Elastic Security

Elastic Security Labs·elastic.co

Elastic Security Labs published a comprehensive guide on performing distributed Digital Forensics and Incident Response (DFIR) using Osquery integrated within Elastic Security. The article demonstrates how to move from traditional disk-imaging forensics to real-time, query-driven investigation across fleet-scale environments, with a detailed walkthrough of reconstructing a phishing-to-Mimikatz attack chain using Osquery artifacts (Prefetch, Shimcache, UserAssist, Shellbags, browser history).

SRFApplicationSRFOsTACTA0007SWElasticsearchSWOsqueryVNDElasticTYPResearchSTGDiscovery
72
Edit Score
2026-05-01
2026-05-01 00:00Z
HIGH

Proof-of-concept exploit available for Linux 'Copy Fail' vulnerability (CVE-2026-31431)

Sophos X-Ops·news.sophos.comCVE-2026-31431

CVE-2026-31431 ('Copy Fail') is a high-severity (CVSS 7.8) Linux privilege escalation vulnerability affecting distributions since 2017, allowing unprivileged local users to gain root access by corrupting the kernel's in-memory page cache of privileged binaries. Public proof-of-concept exploit code has been released and is reported to be reliable across major Linux distributions. Sophos and multiple Linux vendors (AWS, Arch, Debian, Red Hat, SUSE, Ubuntu, CloudLinux, Gentoo) have published advisories and patches.

SRFOsTACTA0004OSLinuxVNDSophosTYPVulnerabilityTYPAdvisorySTGPrivescTECT1548
78
Edit Score
2026-05-01
2026-05-01 00:00Z
INFO

DFIR: From alert to root cause using Osquery without leaving Elastic Security

Elastic Security Labs·elastic.co

Elastic Security Labs publishes a comprehensive guide on performing distributed Digital Forensics and Incident Response (DFIR) using Osquery integrated with Elastic Security, demonstrating live query-driven forensics across fleet-scale environments without disk imaging. The article walks through a practical phishing-to-Mimikatz execution scenario, showing how to reconstruct attack timelines using Prefetch, Shimcache, UserAssist, and Shellbags artifacts queried directly from endpoints in real time.

SRFApplicationSRFOsTACTA0007SWElasticsearchSWOsqueryVNDElasticTYPResearchSTGDiscovery
72
Edit Score
2026-04-30
2026-04-30 22:16Z
HIGH

CVE-2026-7551 — HKUDS: OpenHarness contains a remote code execution vulnerability in the /bridge slash command that

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7551

HKUDS OpenHarness contains a remote code execution vulnerability in the /bridge slash command that allows remote senders accepted by configuration to execute arbitrary operating system commands. Attackers can invoke the /bridge spawn command with attacker-controlled command text that is forwarded to the bridge session manager and executed through the shared shell subprocess helper, allowing them to spawn shell sessions as the OpenHarness process user and access local files, c CVSSv3.1 8.8 (HIGH)

CWECWE 78VNDHkudsTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-04-30
2026-04-30 22:16Z
HIGH

CVE-2026-7503 — The manipulation of the argument wepkey2 results in buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7503

A vulnerability was detected in code-projects for Plugin 4.1.2cu.5137. The impacted element is the function setWiFiMultipleConfig in the library /lib/cste_modules/wireless.so of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument wepkey2 results in buffer overflow. The attack can be launched remotely. The exploit is now public and may be used. CVSSv3.1 8.8 (HIGH)

CWECWE 120CWECWE 119TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-04-30
2026-04-30 22:16Z
HIGH

CVE-2026-6543 — IBM: Langflow Desktop 1.0.0 through 1.8.4 Langflow allows an attacker to execute arbitrary commands

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-6543

IBM Langflow Desktop 1.0.0 through 1.8.4 Langflow allows an attacker to execute arbitrary commands with the privileges of the process running Langflow. This allows reading sensitive environment variables (API keys, DB credentials), modifying files, or launching further attacks on the internal network. CVSSv3.1 8.8 (HIGH)

CWECWE 94VNDIbmTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-04-30
2026-04-30 22:16Z
HIGH

CVE-2026-6389 — IBM: Turbonomic prometurbo agent 8.16.0 through 8.17.6 IBM Turbonomic Application Resource Management grants excessive

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-6389

IBM Turbonomic prometurbo agent 8.16.0 through 8.17.6 IBM Turbonomic Application Resource Management grants excessive cluster‑wide permissions, including unrestricted read access to all secrets. An attacker that compromises the operator or its service account can exfiltrate sensitive credentials, escalate privileges, and potentially achieve full cluster compromise. CVSSv3.1 8.8 (HIGH)

CWECWE 269VNDIbmTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-04-30
2026-04-30 21:43Z
INFO

v9.1.0-rc5

BloodHound releases·github.com

BloodHound v9.1.0-rc5 release candidate published. Single bug fix addressing RadioGroup label background color styling (BED-8171).

SWBloodhoundVNDSpecteropsTYPTool
25
Edit Score
2026-04-30
2026-04-30 21:16Z
HIGH

CVE-2026-40912 — Traefik Traefik: Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a high severity authentication bypass

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-40912

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a high severity authentication bypass vulnerability in Traefik's StripPrefixRegex middleware when used in combination with ForwardAuth, BasicAuth, or DigestAuth. The middleware matches the regex against the decoded URL path but uses the resulting byte length to slice the percent-encoded raw path. When a dot (or multiple dots) appears in the prefix portion of the URL CVSSv3.1 8.2 (HIGH)

CWECWE 706VNDTraefikTYPVulnerability
8.2
CVSS v3.1
91
Edit Score