Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-12 13:10Z
2026-04-02
2026-04-02 19:21Z
HIGH

CVE-2026-34759 — Hackerbay Oneuptime: Combined with a projectId leak from the public Status Page API, an unauthenticated attacker

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-34759

OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, multiple notification API endpoints are registered without authentication middleware, while sibling endpoints in the same codebase correctly use ClusterKeyAuthorization.isAuthorizedServiceMiddleware. These endpoints are externally reachable via the Nginx proxy at /notification/. Combined with a projectId leak from the public Status Page API, an unauthenticated attacker can purchase ph CVSSv3.1 8.1 (HIGH)

CWECWE 862VNDHackerbayVNDOneuptimeTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-04-02
2026-04-02 19:21Z
CRIT

CVE-2026-34758 — Hackerbay Oneuptime: Prior to version 10.0.42, unauthenticated access to Notification test and Phone Number management endpoints

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-34758

OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, unauthenticated access to Notification test and Phone Number management endpoints allows SMS/Call/Email/WhatsApp abuse and phone number purchase. This issue has been patched in version 10.0.42. CVSSv3.1 9.1 (CRITICAL) · EPSS 27th percentile

CWECWE 306VNDHackerbayVNDOneuptimeTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-04-02
2026-04-02 19:21Z
CRIT

CVE-2026-34745 — Shaneisrael Fireshare: facilitates self-hosted media and link sharing.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-34745

Fireshare facilitates self-hosted media and link sharing. Prior to version 1.5.3, the fix for CVE-2026-33645 was applied to the authenticated /api/uploadChunked endpoint but was not applied to the unauthenticated /api/uploadChunked/public endpoint in the same file (app/server/fireshare/api.py). An unauthenticated attacker can exploit the checkSum parameter to write arbitrary files with attacker-controlled content to any writable path on the server filesystem. This issue has b CVSSv3.1 9.1 (CRITICAL) · EPSS 46th percentile

CWECWE 22VNDShaneisraelVNDFireshareTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-04-02
2026-04-02 19:21Z
HIGH

CVE-2026-34742 — Lfprojects Mcp_go_sdk: Prior to version 1.4.0, the Model Context Protocol (MCP) Go SDK does not enable

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-34742

The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.0, the Model Context Protocol (MCP) Go SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication with StreamableHTTPHandler or SSEHandler, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tool CVSSv3.1 8.1 (HIGH)

CWECWE 1188VNDLfprojectsVNDMcpTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-04-02
2026-04-02 19:21Z
HIGH

CVE-2026-34581 — Goshs Goshs: From version 1.1.0 to before version 2.0.0-beta.2, when using the Share Token it is

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-34581

goshs is a SimpleHTTPServer written in Go. From version 1.1.0 to before version 2.0.0-beta.2, when using the Share Token it is possible to bypass the limited selected file download with all the gosh functionalities, including code exec. This issue has been patched in version 2.0.0-beta.2. CVSSv3.1 8.1 (HIGH) · EPSS 32th percentile

CWECWE 288VNDGoshsVNDSimplehttpserverTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-04-02
2026-04-02 19:20Z
HIGH

CVE-2025-43264 — Apple Macos: The issue was addressed with improved memory handling.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-43264

The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6. Processing a maliciously crafted image may corrupt process memory. CVSSv3.1 8.8 (HIGH) · EPSS 32th percentile

CWECWE 119VNDAppleTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-04-02
2026-04-02 19:20Z
HIGH

CVE-2025-43257 — Apple Macos: This issue was addressed with improved handling of symlinks.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-43257

This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.6. An app may be able to break out of its sandbox. CVSSv3.1 8.7 (HIGH) · EPSS 8th percentile

CWECWE 59VNDAppleTYPVulnerability
8.7
CVSS v3.1
94
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-04-02
2026-04-02 19:20Z
HIGH

CVE-2025-43219 — Apple Macos: The issue was addressed with improved memory handling.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-43219

The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6. Processing a maliciously crafted image may corrupt process memory. CVSSv3.1 8.8 (HIGH) · EPSS 35th percentile

CWECWE 787VNDAppleTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-04-02
2026-04-02 19:20Z
HIGH

CVE-2025-43202 — Apple Ipados: Processing a file may lead to memory corruption.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-43202

This issue was addressed with improved memory handling. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6. Processing a file may lead to memory corruption. CVSSv3.1 8.8 (HIGH) · EPSS 33th percentile

CWECWE 787VNDAppleTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-04-02
2026-04-02 19:18Z
HIGH

CVE-2024-44250 — Apple Macos: An app may be able to execute arbitrary code out of its sandbox or

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-44250

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1. An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges. CVSSv3.1 8.2 (HIGH) · EPSS 5th percentile

CWECWE 269VNDAppleTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-04-02
2026-04-02 19:16Z
HIGH

CVE-2023-7342 — HiSecOS: web server versions 03.4.00 prior to 04.1.00 contains a privilege escalation vulnerability that

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-7342

HiSecOS web server versions 03.4.00 prior to 04.1.00 contains a privilege escalation vulnerability that allows authenticated users with operator or auditor roles to escalate privileges to the administrator role by sending specially crafted packets to the web server. Attackers can exploit this flaw to gain full administrative access to the affected device. CVSSv3.1 8.8 (HIGH) · EPSS 18th percentile

CWECWE 269VNDHisecosTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-04-02
2026-04-02 18:16Z
HIGH

CVE-2026-34725 — DbGate: From version 7.0.0 to before version 7.1.5, a stored XSS vulnerability exists in DbGate

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-34725

DbGate is cross-platform database manager. From version 7.0.0 to before version 7.1.5, a stored XSS vulnerability exists in DbGate because attacker-controlled SVG icon strings are rendered as raw HTML without sanitization. In the web UI this allows script execution in another user's browser; in the Electron desktop app this can escalate to local code execution because Electron is configured with nodeIntegration: true and contextIsolation: false. This issue has been patched in CVSSv3.1 8.2 (HIGH) · EPSS 6th percentile

CWECWE 94CWECWE 79VNDDbgateTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-04-02
2026-04-02 18:16Z
CRIT

CVE-2026-34717 — Openproject Openproject: Prior to version 17.2.3, the =n operator in modules/reporting/lib/report/operator.rb:177 embeds user input directly into

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-34717

OpenProject is an open-source, web-based project management software. Prior to version 17.2.3, the =n operator in modules/reporting/lib/report/operator.rb:177 embeds user input directly into SQL WHERE clauses without parameterization. This issue has been patched in version 17.2.3. CVSSv3.1 9.9 (CRITICAL) · EPSS 19th percentile

CWECWE 89VNDOpenprojectTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-04-02
2026-04-02 18:16Z
HIGH

CVE-2026-34577 — Gitroom Postiz: The endpoint requires no authentication and has no SSRF protections, allowing an unauthenticated attacker

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-34577

Postiz is an AI social media scheduling tool. Prior to version 2.21.3, the GET /public/stream endpoint in PublicController accepts a user-supplied url query parameter and proxies the full HTTP response back to the caller. The only validation is url.endsWith('mp4'), which is trivially bypassable by appending .mp4 as a query parameter value or URL fragment. The endpoint requires no authentication and has no SSRF protections, allowing an unauthenticated attacker to read response CVSSv3.1 8.6 (HIGH)

CWECWE 918VNDGitroomVNDPostizTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-04-02
2026-04-02 18:16Z
HIGH

CVE-2026-34524 — Sillytavern Sillytavern: Prior to version 1.17.0, a path traversal vulnerability in chat endpoints allows an authenticated

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-34524

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to version 1.17.0, a path traversal vulnerability in chat endpoints allows an authenticated attacker to read and delete arbitrary files under their user data root (for example secrets.json and settings.json) by supplying avatar_url="..". This issue has been patched in version 1.17.0. CVSSv3.1 8.3 (HIGH)

CWECWE 22VNDSillytavernTYPVulnerability
8.3
CVSS v3.1
92
Edit Score
2026-04-02
2026-04-02 18:16Z
HIGH

CVE-2026-34522 — Sillytavern Sillytavern: Prior to version 1.17.0, a path traversal vulnerability in /api/chats/import allows an authenticated attacker

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-34522

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to version 1.17.0, a path traversal vulnerability in /api/chats/import allows an authenticated attacker to write attacker-controlled files outside the intended chats directory by injecting traversal sequences into character_name. This issue has been patched in version 1.17.0. CVSSv3.1 8.1 (HIGH)

CWECWE 22CWECWE 73VNDSillytavernTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-04-02
2026-04-02 18:16Z
HIGH

CVE-2026-34121 — Tp-link Tapo_c520ws_firmware: An authentication bypass vulnerability within the HTTP handling of the DS configuration service in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-34121

An authentication bypass vulnerability within the HTTP handling of the DS configuration service in TP-Link Tapo C520WS v2.6 was identified, due to inconsistent parsing and authorization logic in JSON requests during authentication check. An unauthenticated attacker can append an authentication-exempt action to a request containing privileged DS do actions, bypassing authorization checks. Successful exploitation allows unauthenticated execution of restricted configuration ac CVSSv3.1 8.8 (HIGH)

CWECWE 287VNDTp LinkTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-04-02
2026-04-02 17:16Z
CRIT

CVE-2026-34877 — Arm Mbed_tls: Insufficient protection of serialized SSL context or session structures allows an attacker who can

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-34877

An issue was discovered in Mbed TLS versions from 2.19.0 up to 3.6.5, Mbed TLS 4.0.0. Insufficient protection of serialized SSL context or session structures allows an attacker who can modify the serialized structures to induce memory corruption, leading to arbitrary code execution. This is caused by Incorrect Use of Privileged APIs. CVSSv3.1 9.8 (CRITICAL)

CWECWE 502CWECWE 250VNDArmVNDMbedTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-04-02
2026-04-02 17:16Z
CRIT

CVE-2026-33950 — Signalk Signal_k_server: Prior to version 2.24.0-beta.4, there is a privilege escalation vulnerability by Admin Role Injection

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-33950

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0-beta.4, there is a privilege escalation vulnerability by Admin Role Injection via /enableSecurity. An unauthenticated attacker can gain full Administrator access to the SignalK server at any time, allowing them to modify sensitive vessel routing data, alter server configurations, and access restricted endpoints. This issue has been patched in version 2.24.0-beta.4. CVSSv3.1 9.4 (CRITICAL)

CWECWE 862CWECWE 288CWECWE 285VNDSignalVNDSignalkTYPVulnerability
9.4
CVSS v3.1
97
Edit Score
2026-04-02
2026-04-02 17:16Z
CRIT

CVE-2026-25212 — Percona Monitoring_and_management: An issue was discovered in Percona PMM before 3.7.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-25212

An issue was discovered in Percona PMM before 3.7. Because an internal database user retains specific superuser privileges, an attacker with pmm-admin rights can abuse the "Add data source" feature to break out of the database context and execute shell commands on the underlying operating system. CVSSv3.1 9.9 (CRITICAL) · EPSS 21th percentile

CWECWE 250VNDPerconaTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-04-02
2026-04-02 16:16Z
HIGH

CVE-2026-5350 — Trendnet Tew-657brm_firmware: The manipulation of the argument mac_pc_dba results in stack-based buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-5350

A security flaw has been discovered in Trendnet TEW-657BRM 1.00.1. The impacted element is the function update_pcdb of the file /setup.cgi. The manipulation of the argument mac_pc_dba results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor confirms, that "[t]he product in question (...) has been discontinued and end of life since June 23, 2011, that is more than 14 years a CVSSv3.1 8.8 (HIGH)

CWECWE 121CWECWE 119VNDTrendnetTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-04-02
2026-04-02 16:16Z
HIGH

CVE-2026-5349 — Trendnet Tew-657brm_firmware: The manipulation of the argument mac_pc_dba leads to stack-based buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-5349

A vulnerability was identified in Trendnet TEW-657BRM 1.00.1. The affected element is the function add_apcdb of the file /setup.cgi. The manipulation of the argument mac_pc_dba leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor confirms, that "[t]he product in question (...) has been discontinued and end of life since June 23, 2011, that is more than 14 years ago. We no longer provide sup CVSSv3.1 8.8 (HIGH)

CWECWE 121CWECWE 119VNDTrendnetTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-04-02
2026-04-02 16:16Z
CRIT

CVE-2026-33746 — Convoypanel Convoy: From version 3.9.0-beta to before version 4.5.1, the JWTService::decode() method did not verify the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-33746

Convoy is a KVM server management panel for hosting businesses. From version 3.9.0-beta to before version 4.5.1, the JWTService::decode() method did not verify the cryptographic signature of JWT tokens. While the method configured a symmetric HMAC-SHA256 signer via lcobucci/jwt, it only validated time-based claims (exp, nbf, iat) using the StrictValidAt constraint. The SignedWith constraint was not included in the validation step. This means an attacker could forge or tamper CVSSv3.1 9.8 (CRITICAL) · EPSS 22th percentile

CWECWE 287CWECWE 347VNDConvoypanelVNDConvoyTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-04-02
2026-04-02 16:00Z
HIGH

ghostsurf: From NTLM Relay to Browser Session Hijacking

SpecterOps·specterops.io

SpecterOps released ghostsurf, a tool that enables browser-based NTLM relay attacks against web applications by fixing fundamental design flaws in ntlmrelayx's HTTP SOCKS proxy. The research identifies and circumvents undocumented Windows kernel-mode authentication behavior in IIS that causes authenticated sessions to reset when accessing unauthenticated resources, enabling attackers to browse enterprise password managers and other NTLM-protected web apps as relayed users.

SRFNetworkTACTA0006SRFWebTACTA0008VNDMicrosoftVNDImpacketTYPResearchTYPTool
87
Edit Score
2026-04-02
2026-04-02 15:16Z
CRIT

CVE-2026-35002 — Agno Agno: versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-35002

Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component that allows attackers to execute arbitrary Python code by manipulating the field_type parameter passed to eval(). Attackers can influence the field_type value in a FunctionCall to achieve remote code execution. CVSSv3.1 9.8 (CRITICAL) · EPSS 54th percentile

CWECWE 95VNDAgnoTYPVulnerability
9.8
CVSS v3.1
99
Edit Score