Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-10 08:27Z
2026-04-27
2026-04-27 21:16Z
CRIT

CVE-2026-7154 — Executing a manipulation of the argument tty_server can lead to os command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7154

A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setAdvancedInfoShow of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument tty_server can lead to os command injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. CVSSv3.1 9.8 (CRITICAL)

CWECWE 77CWECWE 78TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-04-27
2026-04-27 21:16Z
CRIT

CVE-2024-46636 — NASA: Earth Observing System Data and Information System (EOSDIS) MODAPS v8.1 was discovered to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-46636

NASA Earth Observing System Data and Information System (EOSDIS) MODAPS v8.1 was discovered to contain a SQL injection vulnerability in the category parameter CVSSv3.1 9.4 (CRITICAL)

CWECWE 89VNDNasaTYPVulnerability
9.4
CVSS v3.1
97
Edit Score
2026-04-27
2026-04-27 20:16Z
CRIT

CVE-2026-7153 — Performing a manipulation of the argument sys_info results in os command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7153

A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setMiniuiHomeInfoShow of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument sys_info results in os command injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. CVSSv3.1 9.8 (CRITICAL)

CWECWE 77CWECWE 78TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-04-27
2026-04-27 20:16Z
CRIT

CVE-2026-7152 — Totolink: Such manipulation of the argument telnet_enabled leads to os command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7152

A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument telnet_enabled leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. CVSSv3.1 9.8 (CRITICAL)

CWECWE 77CWECWE 78VNDTotolinkTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-04-27
2026-04-27 20:16Z
HIGH

CVE-2026-7151 — Tenda: This manipulation of the argument destNet causes stack-based buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7151

A vulnerability was determined in Tenda HG3 2.0. Impacted is the function formUploadConfig of the file /boaform/formIPv6Routing. This manipulation of the argument destNet causes stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. CVSSv3.1 8.8 (HIGH)

CWECWE 121CWECWE 119VNDTendaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-04-27
2026-04-27 20:16Z
HIGH

CVE-2026-6741 — LatePoint: The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-6741

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 5.4.1. This is due to a missing authorization check in the execute() method of the connect-customer-to-wp-user ability, which only requires the customer__edit capability granted to the latepoint_agent role by default, without verifying whether the target WordPress user ID belongs to a privileged account. This makes it p CVSSv3.1 8.8 (HIGH)

CWECWE 269VNDLatepointTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-04-27
2026-04-27 19:16Z
CRIT

CVE-2026-35903 — MERCURY: This allows an attacker with network access to reuse session parameters and issue unauthorized

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-35903

MERCURY MIPC252W IP camera 1.0.5 Build 230306 Rel.79931n contains an improper authentication vulnerability in the RTSP service. After successful Digest authentication in an initial DESCRIBE request, the device does not verify the Digest response parameter in subsequent RTSP requests within the same session. As a result, RTSP methods such as SETUP, PLAY, and TEARDOWN can be processed even when the Authorization header contains an empty or invalid response value, as long as the CVSSv3.1 9.8 (CRITICAL)

CWECWE 287VNDMercuryTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-04-27
2026-04-27 19:16Z
CRIT

CVE-2026-31255 — Tenda Ac18_firmware: A command injection vulnerability exists in Tenda AC18 V15.03.05.05_multi.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-31255

A command injection vulnerability exists in Tenda AC18 V15.03.05.05_multi. The vulnerability is located in the /goform/SetSambaCfg interface, where improper handling of the guestuser parameter allows attackers to execute arbitrary system commands. CVSSv3.1 9.8 (CRITICAL)

CWECWE 77VNDTendaTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-04-27
2026-04-27 18:16Z
HIGH

CVE-2025-69689 — Fan: The Fan Control application V251 contains an improper privilege handling vulnerability in its Open

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-69689

The Fan Control application V251 contains an improper privilege handling vulnerability in its Open File Dialog. The dialog processes user-supplied paths with elevated permissions, which can be exploited by a local attacker to perform actions with administrator-level privileges. CVSSv3.1 8.8 (HIGH)

CWECWE 269VNDFanTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-04-27
2026-04-27 17:16Z
CRIT

CVE-2026-7140 — Such manipulation of the argument HTTP leads to os command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7140

A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function CsteSystem of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument HTTP leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. CVSSv3.1 9.8 (CRITICAL)

CWECWE 77CWECWE 78TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-04-27
2026-04-27 17:16Z
CRIT

CVE-2026-7139 — This manipulation of the argument mode causes os command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7139

A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument mode causes os command injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. CVSSv3.1 9.8 (CRITICAL)

CWECWE 77CWECWE 78TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-04-27
2026-04-27 17:16Z
HIGH

CVE-2026-38934 — Site: Cross Site Request Forgery vulnerability in diskoverdata diskover-community v.2.3.5.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-38934

Cross Site Request Forgery vulnerability in diskoverdata diskover-community v.2.3.5. and before allows a remote attacker to escalate privileges and obtain sensitive information via the public/settings_process.php CVSSv3.1 8.8 (HIGH)

CWECWE 352TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-04-27
2026-04-27 16:16Z
CRIT

CVE-2026-7138 — Totolink: The manipulation of the argument tz results in os command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7138

A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setNtpCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument tz results in os command injection. The attack can be executed remotely. The exploit is now public and may be used. CVSSv3.1 9.8 (CRITICAL)

CWECWE 77CWECWE 78VNDTotolinkTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-04-27
2026-04-27 16:16Z
CRIT

CVE-2026-7137 — The manipulation of the argument sambaEnabled leads to os command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7137

A security vulnerability has been detected in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setStorageCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument sambaEnabled leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. CVSSv3.1 9.8 (CRITICAL)

CWECWE 77CWECWE 78TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-04-27
2026-04-27 16:16Z
CRIT

CVE-2026-7136 — Executing a manipulation of the argument wanIdx can lead to os command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7136

A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. Affected by this issue is the function setDmzCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument wanIdx can lead to os command injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. CVSSv3.1 9.8 (CRITICAL)

CWECWE 77CWECWE 78TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-04-27
2026-04-27 16:16Z
HIGH

CVE-2026-41463 — ProjeQtor: versions 7.0 through 12.4.3 contain a ZipSlip path traversal vulnerability in the plugin

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-41463

ProjeQtor versions 7.0 through 12.4.3 contain a ZipSlip path traversal vulnerability in the plugin upload functionality that allows authenticated attackers with upload permissions to write files outside the intended extraction directory by crafting ZIP archives with directory traversal sequences. Attackers can exploit unvalidated archive extraction to write a PHP webshell to a web-accessible directory and achieve remote code execution with the privileges of the web server pro CVSSv3.1 8.8 (HIGH)

CWECWE 22VNDProjeqtorTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-04-27
2026-04-27 16:16Z
CRIT

CVE-2026-41462 — ProjeQtor: versions 7.0 through 12.4.3 contain an unauthenticated SQL injection vulnerability in the login

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-41462

ProjeQtor versions 7.0 through 12.4.3 contain an unauthenticated SQL injection vulnerability in the login functionality where the login variable is directly concatenated into a SQL query without parameterization or sanitization. Attackers can inject arbitrary SQL expressions through the username field at the authentication endpoint to create privileged accounts, read sensitive data, and execute operating system commands if the database user has elevated permissions. CVSSv3.1 9.8 (CRITICAL)

CWECWE 89VNDProjeqtorTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-04-27
2026-04-27 16:16Z
CRIT

CVE-2026-30352 — RCE: A remote code execution (RCE) vulnerability in the /devserver/start endpoint of leonvanzyl autocoder commit

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-30352

A remote code execution (RCE) vulnerability in the /devserver/start endpoint of leonvanzyl autocoder commit 79d02a allows attackers to execute arbitrary code via providing a crafted command parameter. CVSSv3.1 9.8 (CRITICAL)

CWECWE 77VNDRceTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-04-27
2026-04-27 14:16Z
HIGH

CVE-2026-6265 — Cerberusftp Ftp_server: Insecure preserved inherited permissions vulnerability in Cerberus FTP Server on Windows allows Privilege Escalation.This

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-6265

Insecure preserved inherited permissions vulnerability in Cerberus FTP Server on Windows allows Privilege Escalation.This issue has been resolved in Cerberus FTP Server: 2026.1 CVSSv3.1 8.8 (HIGH) · EPSS 2th percentile

CWECWE 278VNDCerberusftpTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-04-27
2026-04-27 14:00Z
HIGH

Bypassing Windows authentication reflection mitigations for SYSTEM shells - Part 1

Synacktiv·synacktiv.comCVE-2025-33073CVE-2026-24294CVE-2026-26119

Synacktiv researchers disclose CVE-2026-24294, a local privilege escalation vulnerability that bypasses Microsoft's mitigation for CVE-2025-33073 (authentication reflection). The attack abuses a new Windows 11 24H2/Server 2025 feature allowing SMB connections to arbitrary TCP ports, combined with SMB connection multiplexing, to force privileged services into local NTLM reflection attacks. The vulnerability achieves SYSTEM-level code execution on Windows Server 2025 by default and was patched in March 2026.

SRFOsTACTA0004TACTA0003OSWindowsVNDMicrosoftTYPResearchTYPVulnerabilitySTGPrivesc
82
Edit Score
2026-04-27
2026-04-27 13:16Z
CRIT

CVE-2026-7125 — Totolink: The manipulation of the argument merge leads to os command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7125

A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. Affected by this issue is the function setWiFiEasyCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument merge leads to os command injection. The attack may be initiated remotely. The exploit is publicly available and might be used. CVSSv3.1 9.8 (CRITICAL)

CWECWE 77CWECWE 78VNDTotolinkTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-04-27
2026-04-27 13:16Z
CRIT

CVE-2026-7124 — Totolink: Executing a manipulation of the argument addrPrefixLen can lead to os command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7124

A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. Affected by this vulnerability is the function setIpv6LanCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument addrPrefixLen can lead to os command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. CVSSv3.1 9.8 (CRITICAL)

CWECWE 77CWECWE 78VNDTotolinkTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-04-27
2026-04-27 13:16Z
CRIT

CVE-2026-7123 — Totolink: Performing a manipulation of the argument setIptvCfg results in os command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7123

A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function setIptvCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument setIptvCfg results in os command injection. The attack can be initiated remotely. The exploit has been made public and could be used. CVSSv3.1 9.8 (CRITICAL)

CWECWE 77CWECWE 78VNDTotolinkTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-04-27
2026-04-27 12:16Z
CRIT

CVE-2026-7122 — Such manipulation of the argument enable leads to os command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7122

A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. This impacts the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument enable leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. CVSSv3.1 9.8 (CRITICAL)

CWECWE 77CWECWE 78TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-04-27
2026-04-27 12:16Z
CRIT

CVE-2026-7121 — This manipulation of the argument wizard causes os command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-7121

A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument wizard causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. CVSSv3.1 9.8 (CRITICAL)

CWECWE 77CWECWE 78TYPVulnerability
9.8
CVSS v3.1
99
Edit Score