Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-11 06:23Z
2026-04-15
2026-04-15 09:16Z
HIGH

CVE-2025-40899 — Stored: A Stored Cross-Site Scripting vulnerability was discovered in the Assets and Nodes functionality due

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-40899

A Stored Cross-Site Scripting vulnerability was discovered in the Assets and Nodes functionality due to improper validation of an input parameter. An authenticated user with custom fields privileges can define a malicious custom field containing a JavaScript payload. When the victim views the Assets or Nodes pages, the XSS executes in their browser context, allowing the attacker to perform unauthorized actions as the victim, such as modify application data, disrupt applicatio CVSSv3.1 8.9 (HIGH) · EPSS 10th percentile

CWECWE 79VNDStoredTYPVulnerability
8.9
CVSS v3.1
95
Edit Score
2026-04-15
2026-04-15 09:16Z
HIGH

CVE-2025-40897 — An access control vulnerability was discovered in the Threat Intelligence functionality due to a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-40897

An access control vulnerability was discovered in the Threat Intelligence functionality due to a specific access restriction not being properly enforced for users with view-only privileges. An authenticated user with view-only privileges for the Threat Intelligence functionality can perform administrative actions on it, altering the rules configuration, and/or affecting their availability. CVSSv3.1 8.1 (HIGH) · EPSS 12th percentile

CWECWE 863TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-04-15
2026-04-15 04:17Z
HIGH

CVE-2026-40104 — Xwiki Xwiki: Versions 1.8-rc-1, 17.0.0-rc-1 and 17.5.0-rc-1 and prior include a resource exhaustion vulnerability in REST

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-40104

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 1.8-rc-1, 17.0.0-rc-1 and 17.5.0-rc-1 and prior include a resource exhaustion vulnerability in REST API endpoints such as /xwiki/rest/wikis/xwiki/spaces/AnnotationCode/pages/AnnotationConfig/objects/AnnotationCode.AnnotationConfig/0/properties, which list all available pages as part of the metadata for database list properties without applying query limits. On lar CVSSv3.1 8.2 (HIGH)

CWECWE 770VNDXwikiTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-04-15
2026-04-15 04:17Z
HIGH

CVE-2026-39884 — Suyogs Mcp-server-kubernetes: Versions 3.4.0 and prior contain an argument injection vulnerability in the port_forward tool in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-39884

mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Versions 3.4.0 and prior contain an argument injection vulnerability in the port_forward tool in src/tools/port_forward.ts, where a kubectl command is constructed via string concatenation with user-controlled input and then naively split on spaces before being passed to spawn(). Unlike all other tools in the codebase which correctly use array-based argument passing with execFileSync(), CVSSv3.1 8.3 (HIGH)

CWECWE 88VNDModelVNDSuyogsTYPVulnerability
8.3
CVSS v3.1
92
Edit Score
2026-04-15
2026-04-15 04:17Z
CRIT

CVE-2026-39842 — Openremote Openremote: Versions 1.21.0 and below contain two interrelated expression injection vulnerabilities in the rules engine

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-39842

OpenRemote is an open-source IoT platform. Versions 1.21.0 and below contain two interrelated expression injection vulnerabilities in the rules engine that allow arbitrary code execution on the server. The JavaScript rules engine executes user-supplied scripts via Nashorn's ScriptEngine.eval() without sandboxing, class filtering, or access restrictions, and the authorization check in RulesResourceImpl only restricts Groovy rules to superusers while leaving JavaScript rules un CVSSv3.1 9.9 (CRITICAL)

CWECWE 94CWECWE 917VNDOpenremoteTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-04-15
2026-04-15 04:17Z
HIGH

CVE-2025-54550 — Apache Airflow: The example example_xcom that was included in airflow documentation implemented unsafe pattern of reading

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-54550

The example example_xcom that was included in airflow documentation implemented unsafe pattern of reading value from xcom in the way that could be exploited to allow UI user who had access to modify XComs to perform arbitrary execution of code on the worker. Since the UI users are already highly trusted, this is a Low severity vulnerability. It does not affect Airflow release - example_dags are not supposed to be enabled in production environment, however users following the CVSSv3.1 8.1 (HIGH) · EPSS 45th percentile

CWECWE 94VNDApacheTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-04-14
2026-04-14 23:16Z
CRIT

CVE-2026-39399 — NuGet: An attacker can supply a crafted nuspec file with malicious metadata, leading to cross

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-39399

NuGet Gallery is a package repository that powers nuget.org. A security vulnerability exists in the NuGetGallery backend job’s handling of .nuspec files within NuGet packages. An attacker can supply a crafted nuspec file with malicious metadata, leading to cross package metadata injection that may result in remote code execution (RCE) and/or arbitrary blob writes due to insufficient input validation. The issue is exploitable via URI fragment injection using unsanitized packag CVSSv3.1 9.6 (CRITICAL)

CWECWE 22CWECWE 20VNDNugetTYPVulnerability
9.6
CVSS v3.1
98
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-04-14
2026-04-14 23:16Z
HIGH

CVE-2026-35589 — Nanobot Nanobot: Versions prior to 0.1.5 contain a Cross-Site WebSocket Hijacking (CSWSH) vulnerability exists in the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-35589

nanobot is a personal AI assistant. Versions prior to 0.1.5 contain a Cross-Site WebSocket Hijacking (CSWSH) vulnerability exists in the bridge's WebSocket server in bridge/src/server.ts, resulting from an incomplete remediation of CVE-2026-2577. The original fix changed the binding from 0.0.0.0 to 127.0.0.1 and added an optional BRIDGE_TOKEN parameter, but token authentication is disabled by default and the server does not validate the Origin header during the WebSocket hand CVSSv3.1 8.0 (HIGH)

CWECWE 1385VNDNanobotTYPVulnerability
8.0
CVSS v3.1
90
Edit Score
2026-04-14
2026-04-14 23:16Z
CRIT

CVE-2026-35033 — Jellyfin Jellyfin: Versions prior to 10.11.7 contain an unauthenticated arbitrary file read vulnerability via ffmpeg argument

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-35033

Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain an unauthenticated arbitrary file read vulnerability via ffmpeg argument injection through the StreamOptions query parameter parsing mechanism. The ParseStreamOptions method in StreamingHelpers.cs adds any lowercase query parameter to a dictionary without validation, bypassing the RegularExpression attribute on the level controller parameter, and the unsanitized value is concatenated direct CVSSv3.1 9.1 (CRITICAL)

CWECWE 862CWECWE 88VNDJellyfinTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-04-14
2026-04-14 23:16Z
HIGH

CVE-2026-35032 — Jellyfin Jellyfin: Versions prior to 10.11.7 contain a vulnerability chain in the LiveTV M3U tuner endpoint

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-35032

Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the LiveTV M3U tuner endpoint (POST /LiveTv/TunerHosts), where the tuner URL is not validated, allowing local file read via non-HTTP paths and Server-Side Request Forgery (SSRF) via HTTP URLs. This is exploitable by any authenticated user because the EnableLiveTvManagement permission defaults to true for all new users. An attacker can chain these vulnerabilities by CVSSv3.1 8.1 (HIGH)

CWECWE 918CWECWE 73VNDJellyfinTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-04-14
2026-04-14 23:16Z
CRIT

CVE-2026-35031 — Jellyfin Jellyfin: Versions prior to 10.11.7 contain a vulnerability chain in the subtitle upload endpoint (POST

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-35031

Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the subtitle upload endpoint (POST /Videos/{itemId}/Subtitles), where the Format field is not validated, allowing path traversal via the file extension and enabling arbitrary file write. This arbitrary file write can be chained into arbitrary file read via .strm files, database extraction, admin privilege escalation, and ultimately remote code execution as root via CVSSv3.1 9.9 (CRITICAL)

CWECWE 22CWECWE 20CWECWE 187VNDJellyfinTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-04-14
2026-04-14 23:16Z
CRIT

CVE-2026-34457 — Oauth2_proxy_project Oauth2_proxy: Versions prior to 7.15.2 contain a configuration-dependent authentication bypass in deployments where OAuth2 Proxy

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-34457

OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions prior to 7.15.2 contain a configuration-dependent authentication bypass in deployments where OAuth2 Proxy is used with an auth_request-style integration (such as nginx auth_request) and either --ping-user-agent is set or --gcp-healthchecks is enabled. In affected configurations, OAuth2 Proxy treats any request with the configured health check User-Agent value as a successful health c CVSSv3.1 9.1 (CRITICAL)

CWECWE 290VNDOauth2VNDOauth2 Proxy ProjectTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-04-14
2026-04-14 23:16Z
HIGH

CVE-2026-27290 — Adobe: Framemaker versions 2022.8 and earlier are affected by an Untrusted Search Path vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-27290

Adobe Framemaker versions 2022.8 and earlier are affected by an Untrusted Search Path vulnerability that might allow attackers to execute arbitrary code in the context of the current user. If the application uses a search path to locate critical resources such as programs, then an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. Exploitation of this issue does not require user interaction. CVSSv3.1 8.6 (HIGH)

CWECWE 426VNDAdobeTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-04-14
2026-04-14 22:16Z
HIGH

CVE-2026-40291 — Chamilo: In versions prior to 2.0.0-RC.3, an insecure direct object modification vulnerability in the PUT

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-40291

Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, an insecure direct object modification vulnerability in the PUT /api/users/{id} endpoint allows any authenticated user with ROLE_STUDENT to escalate their privileges to ROLE_ADMIN by modifying the roles field on their own user record. The API Platform security expression is_granted('EDIT', object) only verifies record ownership, and the roles field is included in the writable serializat CVSSv3.1 8.8 (HIGH)

CWECWE 269CWECWE 863VNDChamiloTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-04-14
2026-04-14 22:16Z
CRIT

CVE-2026-39907 — Unisys Webperfect_image_suite: WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose an unauthenticated WCF SOAP endpoint

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-39907

Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose an unauthenticated WCF SOAP endpoint on TCP port 1208 that accepts unsanitized file paths in the ReadLicense action's LFName parameter, allowing remote attackers to trigger SMB connections and leak NTLMv2 machine-account hashes. Attackers can submit crafted SOAP requests with UNC paths to force the server to initiate outbound SMB connections, exposing authentication credentials that may be relayed CVSSv3.1 10.0 (CRITICAL)

CWECWE 73VNDUnisysTYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2026-04-14
2026-04-14 22:16Z
CRIT

CVE-2026-39906 — Unisys Webperfect_image_suite: WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose a deprecated .NET Remoting TCP

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-39906

Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose a deprecated .NET Remoting TCP channel that allows remote unauthenticated attackers to leak NTLMv2 machine-account hashes by supplying a Windows UNC path as a target file argument through object-unmarshalling techniques. Attackers can capture the leaked NTLMv2 hash and relay it to other hosts to achieve privilege escalation or lateral movement depending on network configuration and patch level. CVSSv3.1 10.0 (CRITICAL)

CWECWE 441VNDUnisysTYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2026-04-14
2026-04-14 22:16Z
HIGH

CVE-2026-35196 — Chamilo: In versions prior to 2.0.0-RC.3, an OS Command Injection vulnerability exists in the main/inc/ajax/gradebook.ajax.php

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-35196

Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, an OS Command Injection vulnerability exists in the main/inc/ajax/gradebook.ajax.php endpoint within the export_all_certificates action, where the course code retrieved from the session variable $_SESSION['_cid'] via api_get_course_id() is concatenated directly into a shell_exec() command string without sanitization or escaping using escapeshellarg(). If an attacker can manipulate or po CVSSv3.1 8.8 (HIGH)

CWECWE 78VNDChamiloTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-04-14
2026-04-14 22:16Z
HIGH

CVE-2026-27306 — ColdFusion: versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-27306

ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Attacker requires elevated privileges. Exploitation of this issue requires user interaction in that a victim must open a malicious file. CVSSv3.1 8.4 (HIGH)

CWECWE 20VNDColdfusionTYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-04-14
2026-04-14 22:16Z
HIGH

CVE-2026-27305 — ColdFusion: versions 2023.18, 2025.6 and earlier are affected by an Improper Limitation of a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-27305

ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. CVSSv3.1 8.6 (HIGH)

CWECWE 22VNDColdfusionTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-04-14
2026-04-14 22:16Z
CRIT

CVE-2026-27304 — ColdFusion: versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-27304

ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. CVSSv3.1 9.3 (CRITICAL)

CWECWE 20VNDColdfusionTYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2026-04-14
2026-04-14 22:00Z
INFO

v9.0.1-rc1

BloodHound releases·github.com

BloodHound v9.0.1-rc1 release candidate published with dependency updates and DAWGS library bump to 0.4.16. This is a routine maintenance release addressing identified vulnerabilities in upstream dependencies.

SRFApplicationVNDSpecter OpsTYPToolSTGDiscoverySTGRecon
25
Edit Score
2026-04-14
2026-04-14 21:48Z
CRIT

Patch Tuesday - April 2026

Rapid7 Research·rapid7.comCVE-2026-33824CVE-2026-33825CVE-2026-32201CVE-2026-33826CVE-2026-33827CVE-2026-32225CVE-2026-27913CVE-2026-32070CVE-2026-32093CVE-2026-27909CVE-2026-32162CVE-2026-32154CVE-2026-27914CVE-2026-26151CVE-2026-0390in the wild

Microsoft released 167 vulnerabilities in April 2026 Patch Tuesday, including a critical unauthenticated RCE in Windows IKE (CVE-2026-33824, CVSS 9.8) with pre-auth network exposure, a local privilege escalation in Microsoft Defender (CVE-2026-33825) with public disclosure, and a SharePoint spoofing zero-day (CVE-2026-32201) already exploited in the wild. The patch batch reflects a significant industry-wide surge in vulnerability reporting driven by expanding AI capabilities, with 80 browser vulnerabilities patched separately.

SRFApplicationSRFOsTACTA0004TACTA0001VNDMicrosoftTYPVulnerabilityTYPAdvisorySTGPrivesc
9.8
CVSS v3.1
82
Edit Score
2026-04-14
2026-04-14 21:16Z
HIGH

CVE-2026-34160 — Chamilo Chamilo_lms: In versions prior to 2.0.0-RC.3, the PENS (Package Exchange Notification Services) plugin endpoint at

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-34160

Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the PENS (Package Exchange Notification Services) plugin endpoint at public/plugin/Pens/pens.php is accessible without authentication and accepts a user-controlled package-url parameter that the server fetches using curl without filtering private or internal IP addresses, enabling unauthenticated Server-Side Request Forgery (SSRF). An attacker can exploit this to probe internal network CVSSv3.1 8.6 (HIGH)

CWECWE 306CWECWE 918VNDChamiloTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-04-14
2026-04-14 21:16Z
HIGH

CVE-2026-24893 — openITCOCKPIT Community Edition prior to version 5.5.2 contains a command injection vulnerability that allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-24893

openITCOCKPIT is an open source monitoring tool built for different monitoring engines. openITCOCKPIT Community Edition prior to version 5.5.2 contains a command injection vulnerability that allows an authenticated user with permission to add or modify hosts to execute arbitrary OS commands on the monitoring backend. The vulnerability arises because user-controlled host attributes (specifically the host address) are expanded into monitoring command templates without validatio CVSSv3.1 8.8 (HIGH)

CWECWE 20CWECWE 78TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-04-14
2026-04-14 18:17Z
HIGH

Hack the AI agent: Build agentic AI security skills with the GitHub Secure Code Game

GitHub Security·github.blogCVE-2026-25253

GitHub released Season 4 of the Secure Code Game, a free interactive training platform focused on agentic AI security vulnerabilities. The game simulates a deliberately vulnerable AI assistant (ProdBot) across five progressive levels, teaching developers to identify and exploit real-world attack patterns including prompt injection, tool misuse, and sandbox escapes. The release addresses a critical gap: 83% of organizations plan agentic AI deployment but only 29% feel secure doing so.

TACTA0005TACTA0002SRFAiTYPResearchTYPToolSTGDefense EvasionSTGExecutionTECT1566
72
Edit Score