Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-09-16 01:16Z
1w ago
2026-09-05 00:17Z
CRIT

CVE-2026-52766 — YesWiki: Combined with YesWiki's allow-by-default action ACL model, any user who has page write access

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-52766

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the {{erasespamedcomments}} wiki action (actions/EraseSpamedCommentsAction.php) accepts a suppr[] array from POST and deletes every wiki page whose tag appears in that array, with no authorization check anywhere in the action body or in the page-deletion path it invokes. Combined with YesWiki's allow-by-default action ACL model, any user who has page write access, which is the default for everyone (default_write CVSSv3.1 9.1 (CRITICAL)

CWECWE 862CWECWE 276VNDYeswikiTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
1w ago
2026-09-04 23:17Z
HIGH

CVE-2026-48019 — Laravel: Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-48019

Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied addresses. This issue has been patched in versions 12.60.0 and 13.10.0. CVSSv3.1 8.9 (HIGH)

CWECWE 93VNDLaravelTYPVulnerability
8.9
CVSS v3.1
95
Edit Score
1w ago
2026-09-04 22:17Z
HIGH

CVE-2026-82684 — Tycon: Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a Missing Authorization vulnerability.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-82684

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a Missing Authorization vulnerability. This could allow an attacker to extract system credentials, configurations, or flash contents. CVSSv3.1 8.1 (HIGH)

CWECWE 862VNDTyconTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
1w ago
2026-09-04 22:17Z
HIGH

CVE-2026-77393 — Ignition: In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shipped blank, which

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-77393

In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shipped blank, which permitted any authenticated user to create projects (if they can execute gateway scripts). Ignition 8.1.54 restricts project creation to Designer sessions and no longer relies on this setting. The 8.3 series is not affected. CVSSv3.1 8.8 (HIGH)

CWECWE 276VNDIgnitionTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
1w ago
2026-09-04 22:17Z
CRIT

CVE-2026-75925 — CRLF: Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-75925

Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an attacker to execute commands as root or SYSTEM. Configuration values accepted by the local service are written to a file later consumed by a privileged subprocess, without line-ending sequences being neutralized, which allows additional directives to be introduced into that file. The configuration interface accepts changes without authenticating or verifying the origin of the requester CVSSv3.1 9.6 (CRITICAL)

CWECWE 93VNDCrlfTYPVulnerability
9.6
CVSS v3.1
98
Edit Score
1w ago
2026-09-04 21:17Z
HIGH

CVE-2026-82712 — Tycon: Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a cross-site request forgery

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-82712

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a cross-site request forgery vulnerability. This could allow an attacker to perform state changing operations on the device. CVSSv3.1 8.8 (HIGH)

CWECWE 352VNDTyconTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
1w ago
2026-09-04 21:17Z
HIGH

CVE-2026-79423 — RCE: An authenticated remote code execution (RCE) vulnerability in the admin_config.php component of seacms v13.6

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-79423

An authenticated remote code execution (RCE) vulnerability in the admin_config.php component of seacms v13.6 allows attackers to execute arbitrary code via a crafted POST request. CVSSv3.1 8.8 (HIGH) · EPSS 15th percentile

CWECWE 78VNDRceTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
728 × 90 / responsive · programmatic ad slot
1w ago
2026-09-04 21:17Z
CRIT

CVE-2026-50894 — easyadmin v2.0.2.2 is vulnerable to Unrestricted Upload of File with Dangerous Type in the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-50894

easyadmin v2.0.2.2 is vulnerable to Unrestricted Upload of File with Dangerous Type in the background management interface which allows authenticated remote attackers to execute arbitrary code and gain server privileges via a crafted file upload. CVSSv3.1 9.8 (CRITICAL) · EPSS 15th percentile

CWECWE 434TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
1w ago
2026-09-04 21:17Z
CRIT

CVE-2025-67066 — SQL: Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker to execute

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-67066

SQL Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker to execute arbitrary code via the outtype parameter in the /outaddresspaging path CVSSv3.1 9.8 (CRITICAL) · EPSS 10th percentile

CWECWE 89TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
1w ago
2026-09-04 20:17Z
CRIT

CVE-2026-79391 — MQTT: The MQTT broker accepts client connections on TCP port 1883 without requiring authentication, allowing

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-79391

No authentication exists in the MQTT service of Trueview 6.0.23.4. The MQTT broker accepts client connections on TCP port 1883 without requiring authentication, allowing a remote attacker with network access to establish an MQTT session and perform unauthorized publish or subscribe operations. CVSSv3.1 9.8 (CRITICAL) · EPSS 11th percentile

CWECWE 306VNDMqttTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
1w ago
2026-09-04 20:17Z
CRIT

CVE-2026-71625 — An issue in slimkit plus ThinkSNS+ v.2.4 allows a remote attacker to escalate privileges

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-71625

An issue in slimkit plus ThinkSNS+ v.2.4 allows a remote attacker to escalate privileges via the ResetPasswordController.php component CVSSv3.1 9.8 (CRITICAL) · EPSS 11th percentile

CWECWE 269CWECWE 640TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
1w ago
2026-09-04 20:17Z
CRIT

CVE-2026-71624 — An issue in esoTalk v.1.0.0g4 allows a remote attacker to execute arbitrary code via

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-71624

An issue in esoTalk v.1.0.0g4 allows a remote attacker to execute arbitrary code via the core/models/ETMemberModel.class.php, core/controllers/ETMemberController.class.php, and core/lib/ET.class.php components CVSSv3.1 9.8 (CRITICAL) · EPSS 9th percentile

CWECWE 94TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
1w ago
2026-09-04 20:17Z
HIGH

CVE-2026-61699 — nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-61699

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.7.1, revocation is the only in-band mechanism that isolates a compromised/offboarded host from a Nebula mesh. Because the blocklist never reaches any peer's config.yml, a Blocked host retains full overlay reachability to every peer under its CA (and internal services on the mesh) for up to 30d (agent) / 365d (mobile). An attacker who exfiltrates host.key+host.crt can run stock slackhq/neb CVSSv3.1 8.1 (HIGH)

CWECWE 672CWECWE 299TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
1w ago
2026-09-04 20:17Z
HIGH

CVE-2026-53932 — Prior to version 1.9.4, a crafted backup archive can trigger OS command injection during

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-53932

laravel-backup-restore restores database backups made with spatie/laravel-backup. Prior to version 1.9.4, a crafted backup archive can trigger OS command injection during database restore. This issue has been patched in version 1.9.4. CVSSv3.1 8.0 (HIGH)

CWECWE 77CWECWE 78TYPVulnerability
8.0
CVSS v3.1
90
Edit Score
1w ago
2026-09-04 19:17Z
HIGH

CVE-2026-85781 — Unverified: ownership of a storage access point in the volume deletion component of the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-85781

Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized to access, via a crafted PersistentVolume volumeHandle that pairs an access point from one filesystem with a different target filesystem. To remediate this issue, users should upg CVSSv3.1 8.7 (HIGH)

CWECWE 283VNDUnverifiedTYPVulnerability
8.7
CVSS v3.1
94
Edit Score
1w ago
2026-09-04 19:17Z
CRIT

CVE-2026-81939 — Zip: A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-81939

A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing functionality allows an attacker to extract files outside the intended destination directory using a specially crafted archive. CVSSv3.1 9.1 (CRITICAL)

CWECWE 22VNDZipTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
1w ago
2026-09-04 19:17Z
HIGH

CVE-2026-78839 — An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-78839

An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar file. CVSSv3.1 8.1 (HIGH) · EPSS 17th percentile

CWECWE 434TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
1w ago
2026-09-04 19:17Z
CRIT

CVE-2026-78328 — A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-78328

A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged Admin user to escalate privileges to SuperAdmin. CVSSv3.1 9.1 (CRITICAL)

CWECWE 862TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
1w ago
2026-09-04 19:17Z
CRIT

CVE-2026-78327 — Neutralization: An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-78327

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands that are executed on the underlying host, resulting in remote code execution. CVSSv3.1 9.1 (CRITICAL)

CWECWE 78TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
1w ago
2026-09-04 19:17Z
HIGH

CVE-2026-71620 — File: Upload vulnerability in Zhao-github ApiAdmin v.5.0.1 allows a remote attacker to execute arbitrary

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-71620

File Upload vulnerability in Zhao-github ApiAdmin v.5.0.1 allows a remote attacker to execute arbitrary code via a crafted .php file CVSSv3.1 8.1 (HIGH) · EPSS 11th percentile

CWECWE 434TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
1w ago
2026-09-04 18:18Z
HIGH

CVE-2026-9317 — Nango: before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-9317

Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests to the unauthenticated start procedure, bypassing the unenforced RUNNER_SECRET_KEY environment variable, to achieve remote code execution within the runner process. CVSSv3.1 8.1 (HIGH)

CWECWE 306VNDNangoTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
1w ago
2026-09-04 18:18Z
HIGH

CVE-2026-82538 — ILIAS: before versions 9.22, 10.10, and 11.3 contains a SQL injection vulnerability in the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-82538

ILIAS before versions 9.22, 10.10, and 11.3 contains a SQL injection vulnerability in the repository trash table where the table navigation sort field from HTTP requests is passed directly into the ORDER BY clause of a SQL query without validation against declared sortable columns. Authenticated users with write permission on any container can inject arbitrary SQL through the sort parameter, and because multi-statement execution is enabled in the database layer, stacked queri CVSSv3.1 8.8 (HIGH)

CWECWE 89VNDIliasTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
1w ago
2026-09-04 18:17Z
CRIT

CVE-2026-57163 — Teluu Pjsip: Prior to commit c4a151a, a stack buffer overflow exists in the GnuTLS TLS backend

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-57163

PJSIP is a free and open source multimedia communication library written in C. Prior to commit c4a151a, a stack buffer overflow exists in the GnuTLS TLS backend when parsing the Subject Alternative Name extension of a peer certificate (tls_cert_get_info() in ssl_sock_gtls.c). Only GnuTLS builds are affected (--with-gnutls); OpenSSL and Apple SecureTransport/Network.framework builds are not affected. While extracting certificate information after a TLS handshake, an incorrect CVSSv3.1 9.1 (CRITICAL) · EPSS 17th percentile

CWECWE 121VNDPjsipVNDTeluuTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
1w ago
2026-09-04 18:17Z
CRIT

CVE-2026-57162 — Teluu Pjsip: Prior to commit a1b707c, a stack buffer overflow exists in the SRTP/SDES media transport

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-57162

PJSIP is a free and open source multimedia communication library written in C. Prior to commit a1b707c, a stack buffer overflow exists in the SRTP/SDES media transport when processing a=crypto attributes during SDP offer/answer (sdes_encode_sdp() in transport_srtp_sdes.c). This affects applications with SRTP enabled (use_srtp optional or mandatory, using SDES keying). During media negotiation, the crypto attributes from the remote SDP are collected into a fixed-size array wit CVSSv3.1 9.1 (CRITICAL) · EPSS 28th percentile

CWECWE 121VNDPjsipVNDTeluuTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
1w ago
2026-09-04 18:17Z
HIGH

CVE-2026-57161 — Teluu Pjsip: Prior to commit acc03b5, a stack buffer overflow exists in PJSUA when processing Service-Route

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-57161

PJSIP is a free and open source multimedia communication library written in C. Prior to commit acc03b5, a stack buffer overflow exists in PJSUA when processing Service-Route headers in a registration response (update_service_route() in pjsua_acc.c). This affects applications that register using the PJSUA/PJSUA2 account API (the default registration path). The Service-Route URIs from a 2xx response to REGISTER are stored into a fixed-size array without bounding the number of h CVSSv3.1 8.2 (HIGH) · EPSS 21th percentile

CWECWE 121VNDPjsipVNDTeluuTYPVulnerability
8.2
CVSS v3.1
91
Edit Score