Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-09-16 00:17Z
1w ago
2026-09-05 11:16Z
HIGH

CVE-2026-86177 — Pterodactyl: Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-86177

Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console commands, control server power state, or create backups without proper authorization checks. CVSSv3.1 8.8 (HIGH)

CWECWE 862VNDPterodactylTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
1w ago
2026-09-05 11:16Z
HIGH

CVE-2026-86169 — Axolotl: through 0.18.0 contains a remote code execution vulnerability in the multipack patch path

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-86169

Axolotl through 0.18.0 contains a remote code execution vulnerability in the multipack patch path where trust_remote_code defaults to None instead of False, causing the security guard to be bypassed. Attackers can execute arbitrary Python code by crafting a malicious Hugging Face model repository selected as base_model, which is loaded with hardcoded trust_remote_code=True during AutoModelForCausalLM.from_pretrained. CVSSv3.1 8.8 (HIGH)

CWECWE 829VNDAxolotlTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
1w ago
2026-09-05 10:16Z
CRIT

CVE-2026-86124 — AutoAgent: contains an unauthenticated remote code execution vulnerability in the TCP server that binds

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-86124

AutoAgent contains an unauthenticated remote code execution vulnerability in the TCP server that binds to all interfaces and executes attacker-supplied commands as root. Attackers can connect to the exposed communication port and execute arbitrary bash commands within the container, gaining access to bind-mounted host workspace directories. CVSSv3.1 9.8 (CRITICAL)

CWECWE 306VNDAutoagentTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
1w ago
2026-09-05 10:16Z
HIGH

CVE-2026-86123 — SQL: Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-86123

SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters and execute arbitrary SQL queries against attacker-specified hosts. Attackers can connect to internal databases, execute SQL commands, enumerate schemas, and pivot into the server's network without authentication. CVSSv3.1 8.7 (HIGH)

CWECWE 918TYPVulnerability
8.7
CVSS v3.1
94
Edit Score
1w ago
2026-09-05 10:16Z
CRIT

CVE-2026-86121 — Cua: computer-server versions before 0.3.42 skip authentication when the CONTAINER_NAME environment variable is unset

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-86121

Cua computer-server versions before 0.3.42 skip authentication when the CONTAINER_NAME environment variable is unset and bind to all interfaces by default, allowing unauthenticated attackers to execute arbitrary commands. Attackers can reach TCP port 8000 to run shell commands via the run_command endpoint, read and write arbitrary files through file operation endpoints, and access interactive PTY shells without authentication. CVSSv3.1 9.8 (CRITICAL)

CWECWE 306VNDCuaTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
1w ago
2026-09-05 10:16Z
HIGH

CVE-2026-86119 — Webstudio: through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-86119

Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZE_ORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, access internal services, and perform network reconnaissance on the instance infrastructure. CVSSv3.1 8.6 (HIGH)

CWECWE 918VNDWebstudioTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
1w ago
2026-09-05 10:16Z
HIGH

CVE-2026-86117 — Coolify: through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-86117

Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users into existing accounts based solely on email address without verifying provider assertions or binding OAuth identities. Attackers can register a victim's email address on any enabled OAuth provider to obtain authenticated sessions as that user, bypassing password requirements and two-factor authentication. CVSSv3.1 8.1 (HIGH)

CWECWE 287VNDCoolifyTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
728 × 90 / responsive · programmatic ad slot
1w ago
2026-09-05 09:16Z
CRIT

CVE-2024-11080 — Post: The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-11080

The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several functions in the ~/includes/blocks/form-wrap/function.php file. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress, granted no other security controls are present in the function. CVSSv3.1 9.8 (CRITICAL)

CWECWE 94VNDPostTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
1w ago
2026-09-05 08:16Z
HIGH

CVE-2026-81543 — Abandoned: The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-81543

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.7.1. This is due to missing capability checks and nonce verification on multiple AJAX actions including wcap_save_connector_settings, wcap_send_manual_email, wcap_abandoned_cart_info, and wcap_change_manual_email_data. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify SMTP connector setti CVSSv3.1 8.8 (HIGH)

CWECWE 269VNDAbandonedTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
1w ago
2026-09-05 07:17Z
HIGH

CVE-2026-84935 — Menu: The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-84935

The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigation menu-item settings, and does not escape those stored settings when the menu is rendered, allowing users with minimal permissions such as Subscribers to store JavaScript that executes in the browser of any visitor, administrators included, who views the affected menu. CVSSv3.1 8.0 (HIGH) · EPSS 5th percentile

CWECWE 79VNDMenuTYPVulnerability
8.0
CVSS v3.1
90
Edit Score
1w ago
2026-09-05 07:17Z
HIGH

CVE-2026-84934 — JCH: The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-84934

The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX actions and lets the request choose which internal action runs, allowing any authenticated users such as Subscribers to import arbitrary JCH Optimize WordPress plugin before 6.0.1 settings and store a script that executes in the browser of any visitor or administrator viewing the site. CVSSv3.1 8.0 (HIGH) · EPSS 5th percentile

CWECWE 79VNDJchTYPVulnerability
8.0
CVSS v3.1
90
Edit Score
1w ago
2026-09-05 07:17Z
HIGH

CVE-2026-82304 — Music: The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user input

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-82304

The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user input before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users. CVSSv3.1 8.6 (HIGH) · EPSS 9th percentile

CWECWE 89VNDMusicTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
1w ago
2026-09-05 07:17Z
CRIT

CVE-2026-78362 — SEO: The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-78362

The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its API requests, allowing unauthenticated users to be served as the administrator who configured the SEO Flow by LupsOnline WordPress plugin before 3.0.3 and take over the site. Exploitation requires the SEO Flow by LupsOnline WordPress plugin before 3.0.3 to have been configured, which is its normal operating state. CVSSv3.1 9.8 (CRITICAL) · EPSS 4th percentile

CWECWE 269VNDSeoTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
1w ago
2026-09-05 07:17Z
HIGH

CVE-2026-77826 — RegistrationMagic: The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-77826

The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new account even when user registration is disabled. CVSSv3.1 8.8 (HIGH) · EPSS 4th percentile

CWECWE 287VNDRegistrationmagicTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
1w ago
2026-09-05 07:17Z
HIGH

CVE-2026-19887 — Welcart: The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-19887

The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback (usces_action_acting_transaction). Unauthenticated attackers can store arbitrary 'reserve' key/value pairs as order metadata during a public checkout, then invoke the callback with an attacker-chosen 'option' parameter to select and unserialize that metadata without any provide CVSSv3.1 8.8 (HIGH)

CWECWE 502VNDWelcartTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
1w ago
2026-09-05 06:17Z
HIGH

CVE-2026-86145 — PCRE2: before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-86145

PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API). CVSSv3.1 8.2 (HIGH)

CWECWE 424VNDPcre2TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
1w ago
2026-09-05 06:17Z
CRIT

CVE-2026-83627 — Hummingbird: The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-83627

The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.21.0 via the log_msg() function in core/modules/class-page-cache.php. The page-cache debug log is written to wp-content/wphb-logs/page-caching-log.php, a directly web-accessible PHP file that is supposed to be protected by a leading '<?php die(); ?>' header. That header is guarded by class_exists( 'Filesystem CVSSv3.1 9.8 (CRITICAL)

CWECWE 94VNDHummingbirdTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
1w ago
2026-09-05 06:17Z
CRIT

CVE-2026-13447 — Mstore: The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-13447

The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verify_id_token() function, which decodes and validates Firebase ID token claims (alg, kid, aud, iss) but never calls openssl_verify() or any equivalent to validate the JWT signature against Google's actual public key certificates. This makes it possible f CVSSv3.1 9.8 (CRITICAL)

CWECWE 287VNDMstoreTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
1w ago
2026-09-05 05:17Z
HIGH

CVE-2026-86140 — In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-86140

In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow. CVSSv3.1 8.0 (HIGH)

CWECWE 121TYPVulnerability
8.0
CVSS v3.1
90
Edit Score
1w ago
2026-09-05 00:17Z
HIGH

CVE-2026-52775 — YesWiki: Prior to version 4.6.6, YesWiki through the latest development branch contains a SQL injection

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-52775

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki through the latest development branch contains a SQL injection vulnerability in ReactionManager::deleteUserReaction() that allows any authenticated user to inject arbitrary SQL via the {idreaction} and {id} URL path parameters. The parameters are concatenated directly into a SQL LIKE clause without escaping or parameterization. This issue has been patched in version 4.6.6. CVSSv3.1 8.8 (HIGH)

CWECWE 89VNDYeswikiTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
1w ago
2026-09-05 00:17Z
HIGH

CVE-2026-52771 — YesWiki: From version 4.2.0 to before version 4.6.6, ApiController::deletePage() interpolates a page tag retrieved from

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-52771

YesWiki is a wiki system written in PHP. From version 4.2.0 to before version 4.6.6, ApiController::deletePage() interpolates a page tag retrieved from the database into a DELETE FROM …_links WHERE to_tag = '$tag' query without escaping. The page tag is attacker-controlled — the POST /api/pages/{tag} API accepts arbitrary URL-encoded values, including single quotes, and stores them. A low-privilege authenticated user can therefore create a page whose tag is a SQL fragment, ma CVSSv3.1 8.3 (HIGH)

CWECWE 89VNDYeswikiTYPVulnerability
8.3
CVSS v3.1
92
Edit Score
1w ago
2026-09-05 00:17Z
HIGH

CVE-2026-52769 — YesWiki: From version 4.6.2 to before version 4.6.6, the POST /api/forms/{formId}/actor/inbox route - exposed publicly

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-52769

YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, the POST /api/forms/{formId}/actor/inbox route - exposed publicly with acl:"public" - accepts an HTTP Signature header whose keyId parameter is a URL. HttpSignatureService::verifySignature() parses the header and immediately makes a server-side HTTP GET to that URL, before any cryptographic verification or URL validation. An unauthenticated remote attacker can therefore make YesWiki issue arb CVSSv3.1 8.3 (HIGH)

CWECWE 918VNDYeswikiTYPVulnerability
8.3
CVSS v3.1
92
Edit Score
1w ago
2026-09-05 00:17Z
HIGH

CVE-2026-52767 — YesWiki: The -1 row is the bypass: PHP's truthiness rules make -1 a truthy value

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-52767

YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, HttpSignatureService::verifySignature() checks the result of PHP's openssl_verify() with a loose boolean negation - if (!openssl_verify(...)) { throw ... }. PHP's openssl_verify has four possible return values: 1, 0, -1, and "false". The -1 row is the bypass: PHP's truthiness rules make -1 a truthy value, so !(-1) === false, the throw is skipped, and the controller proceeds to processActivity CVSSv3.1 8.2 (HIGH)

CWECWE 347VNDYeswikiTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
1w ago
2026-09-05 00:17Z
CRIT

CVE-2026-52766 — YesWiki: Combined with YesWiki's allow-by-default action ACL model, any user who has page write access

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-52766

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the {{erasespamedcomments}} wiki action (actions/EraseSpamedCommentsAction.php) accepts a suppr[] array from POST and deletes every wiki page whose tag appears in that array, with no authorization check anywhere in the action body or in the page-deletion path it invokes. Combined with YesWiki's allow-by-default action ACL model, any user who has page write access, which is the default for everyone (default_write CVSSv3.1 9.1 (CRITICAL)

CWECWE 862CWECWE 276VNDYeswikiTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
1w ago
2026-09-04 23:17Z
HIGH

CVE-2026-48019 — Laravel: Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-48019

Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied addresses. This issue has been patched in versions 12.60.0 and 13.10.0. CVSSv3.1 8.9 (HIGH)

CWECWE 93VNDLaravelTYPVulnerability
8.9
CVSS v3.1
95
Edit Score