Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-12 20:46Z
2026-03-31
2026-03-31 13:00Z
HIGH

Initial Access Brokers have Shifted to High-Value Targets and Premium Pricing

Rapid7 Research·rapid7.comCVE-2025-61882

Rapid7's analysis of H2 2025 cybercrime forum activity (Exploit, XSS, BreachForums, DarkForums, RAMP) reveals Initial Access Brokers have shifted toward high-value targets with dramatically increased pricing (4055% average base price increase YoY) and prioritized high-privilege access (Domain Admin/User at 75% of offerings). RDP, VPN, and RDWeb remain dominant vectors; Government, Retail, and IT sectors are primary targets; U.S. organizations represent 30.9% of global listings, with DarkForums and RAMP now dominating older forums like XSS.

TACTA0001SRFNetworkTACTA0007SRFIdentityVNDFortinetVNDOracleTYPResearchTYPThreat Intel
78
Edit Score
2026-03-31
2026-03-31 12:16Z
HIGH

CVE-2026-32920 — Openclaw Openclaw: before 2026.3.12 automatically discovers and loads plugins from .OpenClaw/extensions/ without explicit trust verification

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-32920

OpenClaw before 2026.3.12 automatically discovers and loads plugins from .OpenClaw/extensions/ without explicit trust verification, allowing arbitrary code execution. Attackers can execute malicious code by including crafted workspace plugins in cloned repositories that execute when users run OpenClaw from the directory. CVSSv3.1 8.4 (HIGH) · EPSS 25th percentile

CWECWE 829VNDOpenclawTYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-03-31
2026-03-31 12:16Z
CRIT

CVE-2026-32917 — Openclaw Openclaw: before 2026.3.13 contains a remote command injection vulnerability in the iMessage attachment staging

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-32917

OpenClaw before 2026.3.13 contains a remote command injection vulnerability in the iMessage attachment staging flow that allows attackers to execute arbitrary commands on configured remote hosts. The vulnerability exists because unsanitized remote attachment paths containing shell metacharacters are passed directly to the SCP remote operand without validation, enabling command execution when remote attachment staging is enabled. CVSSv3.1 9.8 (CRITICAL) · EPSS 78th percentile

CWECWE 78VNDOpenclawTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2026-03-31
2026-03-31 12:16Z
CRIT

CVE-2026-32916 — Openclaw Openclaw: versions 2026.3.7 before 2026.3.11 contain an authorization bypass vulnerability where plugin subagent routes

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-32916

OpenClaw versions 2026.3.7 before 2026.3.11 contain an authorization bypass vulnerability where plugin subagent routes execute gateway methods through a synthetic operator client with broad administrative scopes. Remote unauthenticated requests to plugin-owned routes can invoke runtime.subagent methods to perform privileged gateway actions including session deletion and agent execution. CVSSv3.1 9.4 (CRITICAL) · EPSS 37th percentile

CWECWE 266VNDOpenclawTYPVulnerability
9.4
CVSS v3.1
97
Edit Score
2026-03-31
2026-03-31 12:16Z
HIGH

CVE-2024-14031 — Yves Sereal\: Sereal::Encoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-14031

Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library. Sereal::Encoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922. This is a race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used. CVSSv3.1 8.1 (HIGH)

CWECWE 787VNDYvesVNDSerealTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-03-31
2026-03-31 12:16Z
HIGH

CVE-2024-14030 — Yves Sereal\: Sereal::Decoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-14030

Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library. Sereal::Decoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922. This is a race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used. CVSSv3.1 8.1 (HIGH)

CWECWE 787VNDYvesVNDSerealTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-03-31
2026-03-31 11:16Z
CRIT

CVE-2025-15618 — Mock Business\: Business::OnlinePayment::StoredTransaction versions through 0.01 for Perl uses an insecure secret key.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-15618

Business::OnlinePayment::StoredTransaction versions through 0.01 for Perl uses an insecure secret key. Business::OnlinePayment::StoredTransaction generates a secret key by using a MD5 hash of a single call to the built-in rand function, which is unsuitable for cryptographic use. This key is intended for encrypting credit card transaction data. CVSSv3.1 9.1 (CRITICAL)

CWECWE 693CWECWE 338VNDMockVNDBusinessTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-03-31
2026-03-31 11:10Z
CRIT

Nuclei Templates v10.4.1 – Release Notes

Nuclei templates·github.comCVE-2026-32596CVE-2026-31816CVE-2026-27483CVE-2026-24477CVE-2026-22739CVE-2026-21445CVE-2026-3055CVE-2026-1581CVE-2025-71260CVE-2025-68043CVE-2025-32463CVE-2025-14437CVE-2025-6984CVE-2025-5947CVE-2024-43144CVE-2023-34092CVE-2026-33868CVE-2026-32583CVE-2026-30928CVE-2026-28288CVE-2026-2025CVE-2026-1557CVE-2026-1405CVE-2026-1306CVE-2026-1296CVE-2026-1277CVE-2026-0926CVE-2025-71259CVE-2025-71258CVE-2025-71257CVE-2025-68602CVE-2025-62512CVE-2025-62126CVE-2025-59716CVE-2025-58044CVE-2025-54793CVE-2025-46565CVE-2025-13920CVE-2025-4576CVE-2024-57241CVE-2022-1692CVE-2020-15718

Nuclei Templates v10.4.1 adds 76 new detection templates covering 42 CVEs, including critical RCE, authentication bypass, and SQL injection vulnerabilities across AI/ML platforms (MindsDB, Langflow, Budibase), WordPress plugins, and enterprise software (Citrix NetScaler, BMC FootPrints). The release includes bug fixes reducing false positives/negatives and improved detection accuracy across existing templates.

SRFApplicationTACTA0001SRFNetworkSRFWebTACTA0043VNDProjectdiscoveryTYPToolTYPVulnerability
9.8
CVSS v3.1
72
Edit Score
2026-03-31
2026-03-31 09:16Z
HIGH

CVE-2025-10553 — 3ds 3dexperience: A Stored Cross-site Scripting (XSS) vulnerability affecting Factory Resource Management in DELMIA Factory Resource

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-10553

A Stored Cross-site Scripting (XSS) vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session. CVSSv3.1 8.7 (HIGH)

CWECWE 79VND3dsVNDStoredTYPVulnerability
8.7
CVSS v3.1
94
Edit Score
2026-03-31
2026-03-31 09:16Z
HIGH

CVE-2025-10551 — 3ds 3dexperience: A Stored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-10551

A Stored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session. CVSSv3.1 8.7 (HIGH)

CWECWE 79VND3dsVNDStoredTYPVulnerability
8.7
CVSS v3.1
94
Edit Score
2026-03-31
2026-03-31 03:15Z
CRIT

CVE-2026-34060 — Shopify Ruby_lsp: Prior to Shopify.ruby-lsp version 0.10.2 and ruby-lsp version 0.26.9, the rubyLsp.branch VS Code workspace

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-34060

Ruby LSP is an implementation of the language server protocol for Ruby. Prior to Shopify.ruby-lsp version 0.10.2 and ruby-lsp version 0.26.9, the rubyLsp.branch VS Code workspace setting was interpolated without sanitization into a generated Gemfile, allowing arbitrary Ruby code execution when a user opens a project containing a malicious .vscode/settings.json. This issue has been patched in Shopify.ruby-lsp version 0.10.2 and ruby-lsp version 0.26.9. CVSSv3.1 9.8 (CRITICAL) · EPSS 9th percentile

CWECWE 94VNDShopifyTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-03-31
2026-03-31 03:15Z
CRIT

CVE-2026-34041 — Nektos Act: is a project which allows for local running of github actions.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-34041

act is a project which allows for local running of github actions. Prior to version 0.2.86, act unconditionally processes the deprecated ::set-env:: and ::add-path:: workflow commands, which was disabled due to environment injection risks. When a workflow step echoes untrusted data to stdout, an attacker can inject these commands to set arbitrary environment variables or modify the PATH for all subsequent steps in the job. This issue has been patched in version 0.2.86. CVSSv3.1 9.8 (CRITICAL)

CWECWE 74VNDNektosTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-03-31
2026-03-31 03:15Z
HIGH

CVE-2026-34040 — Docker Engine: Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-34040

Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1. CVSSv3.1 8.8 (HIGH) · EPSS 94th percentile

CWECWE 288VNDDockerVNDMobyTYPVulnerability
8.8
CVSS v3.1
96
Edit Score
2026-03-31
2026-03-31 03:03Z
INFO

v1.7.5

Sliver releases·github.com

Sliver v1.7.5 release published on GitHub. The release page content is largely inaccessible due to rendering errors, providing no visibility into changelog, features, or bug fixes included in this version.

SWSliverTYPTool
15
Edit Score
2026-03-31
2026-03-31 02:15Z
CRIT

CVE-2026-3300 — Everest: The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-3300

The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and including, 1.9.12. This is due to the Calculation Addon's process_filter() function concatenating user-submitted form field values into a PHP code string without proper escaping before passing it to eval(). The sanitize_text_field() function applied to input does not escape single quotes or other PHP code context characters. This makes it possibl CVSSv3.1 9.8 (CRITICAL) · EPSS 52th percentile

CWECWE 94VNDEverestTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-03-31
2026-03-31 00:00Z
HIGH

Fake Installers to Monero: A Multi-Tool Mining Operation

Elastic Security Labs·elastic.coin the wild

Elastic Security Labs documents REF1695, a financially motivated operation active since late 2023 deploying RATs (PureRAT, CNB Bot), cryptominers (XMRig, PureMiner, SilentCryptoMiner), and CPA fraud through fake installer ISO packages. The operator uses consistent Themida/WinLicense + .NET Reactor packing, overlapping C2 infrastructure, and social engineering lures to bypass SmartScreen, with tracked Monero payouts exceeding 27.88 XMR across four wallets. The report documents previously unreported CNB Bot (.NET implant with RSA-2048 task authentication), custom XMRig loaders with evasion timers that kill miners when analysis tools are detected, and SilentCryptoMiner's use of direct syscalls and parent process spoofing for injection.

SRFApplicationSRFOsTACTA0005TACTA0001TACTA0002TACTA0003TACTA0011VNDElastic
78
Edit Score
2026-03-31
2026-03-31 00:00Z
CRIT

Axios npm package compromised to deploy malware

Sophos X-Ops·news.sophos.comin the wild

On March 30, 2026, the Axios npm package (versions 1.14.1 and 0.30.4) was compromised via maintainer account takeover, injecting a malicious dependency that deploys a cross-platform RAT during installation. The attack is attributed to NICKEL GLADSTONE, a North Korean state-sponsored group, based on forensic metadata, C2 patterns, and malware signatures. The malware executes on Windows, macOS, and Linux systems, communicates with C2 infrastructure, and attempts to evade detection by removing artifacts and replacing package metadata.

SRFApplicationTACTA0001TACTA0002TACTA0011SRFSupply ChainVNDAxiosTYPThreat IntelTYPAdvisory
95
Edit Score
2026-03-31
2026-03-31 00:00Z
HIGH

The Real Risk of Vibecoding

Trend Micro Research·trendmicro.com

Trend Micro research examines how AI-driven code generation ("vibecoding") accelerates software development while outpacing traditional security review, governance, and ownership models. The analysis identifies that rapid AI-generated code introduces unintended dependencies, risky defaults, weak secret handling, and fragmented accountability—not because AI writes insecure code, but because the volume and speed of change overwhelm existing security controls.

SRFApplicationTACTA0005SRFAiTYPResearchTYPTechniqueSTGDefense EvasionEXPSupply Chain
72
Edit Score
2026-03-31
2026-03-31 00:00Z
CRIT

Axios NPM Package Compromised: Supply Chain Attack Hits JavaScript HTTP Client with 100M+ Weekly Downloads

Trend Micro Research·trendmicro.comin the wild

Axios npm package (100M+ weekly downloads) was compromised on March 30, 2026 when attackers hijacked the lead maintainer's npm account and published malicious versions 1.14.1 and 0.30.4 containing a phantom dependency (plain-crypto-js@4.2.1) that deployed a cross-platform RAT with postinstall hooks. The malware executed platform-specific payloads (AppleScript on macOS, VBScript+PowerShell on Windows, Python on Linux), established C&C callbacks to sfrclak[.]com, and performed anti-forensics by self-destructing and replacing evidence with clean decoys. The attack bypassed GitHub Actions OIDC Trusted Publisher safeguards by using a stolen npm token for manual publication, and npm removed the packages within ~3.5 hours of detection.

SRFApplicationTACTA0005TACTA0001TACTA0002TACTA0003TACTA0011SRFSupply ChainVNDAxios
95
Edit Score
2026-03-31
2026-03-31 00:00Z
HIGH

Fake Installers to Monero: A Multi-Tool Mining Operation

Elastic Security Labs·elastic.coin the wild

Elastic Security Labs documents REF1695, a financially motivated operation active since late 2023 that deploys RATs (PureRAT, CNB Bot), cryptominers (PureMiner, SilentCryptoMiner), and XMRig loaders via fake installer ISO packages. The operator monetizes infections through both Monero/Ethereum mining and CPA fraud, using consistent Themida/WinLicense + .NET Reactor packing, overlapping C2 infrastructure, and social engineering lures. Analysis reveals four campaign variants with evolving payloads, custom evasion techniques (analysis tool detection, direct syscalls, WinRing0x64 driver abuse), and tracked Monero payouts exceeding 27.88 XMR across four wallets.

SRFApplicationSRFOsTACTA0005TACTA0001TACTA0002TACTA0003TACTA0011OSWindows
82
Edit Score
2026-03-30
2026-03-30 23:17Z
HIGH

CVE-2026-5154 — Tenda Ch22_firmware: The manipulation of the argument funcname leads to stack-based buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-5154

A vulnerability has been found in Tenda CH22 1.0.0.1/1.If. The impacted element is the function fromSetCfm of the file /goform/setcfm of the component Parameter Handler. The manipulation of the argument funcname leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. CVSSv3.1 8.8 (HIGH) · EPSS 15th percentile

CWECWE 121CWECWE 119VNDTendaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-03-30
2026-03-30 23:17Z
HIGH

CVE-2026-5130 — Debugger: The Debugger & Troubleshooter plugin for WordPress was vulnerable to Unauthenticated Privilege Escalation in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-5130

The Debugger & Troubleshooter plugin for WordPress was vulnerable to Unauthenticated Privilege Escalation in versions up to and including 1.3.2. This was due to the plugin accepting the wp_debug_troubleshoot_simulate_user cookie value directly as a user ID without any cryptographic validation or authorization checks. The cookie value was used to override the determine_current_user filter, which allowed unauthenticated attackers to impersonate any user by simply setting the co CVSSv3.1 8.8 (HIGH) · EPSS 6th percentile

CWECWE 565VNDDebuggerTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-03-30
2026-03-30 22:16Z
CRIT

CVE-2026-4257 — Contact: The Contact Form by Supsystic plugin for WordPress is vulnerable to Server-Side Template Injection

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4257

The Contact Form by Supsystic plugin for WordPress is vulnerable to Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in all versions up to, and including, 1.7.36. This is due to the plugin using the Twig `Twig_Loader_String` template engine without sandboxing, combined with the `cfsPreFill` prefill functionality that allows unauthenticated users to inject arbitrary Twig expressions into form field values via GET parameters. This makes it possible f CVSSv3.1 9.8 (CRITICAL) · EPSS 96th percentile

CWECWE 94VNDContactTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2026-03-30
2026-03-30 22:00Z
INFO

QBDI vs TritonDSE against a VM: who will be the fastest?

Quarkslab·blog.quarkslab.com

Quarkslab researchers demonstrate using QBDI and TritonDSE symbolic execution engines to reverse-engineer and solve a custom VM challenge from the Jeanne d'Hack CTF 2026. The writeup covers dynamic binary instrumentation via coredump loading, symbolic execution to track flag validation logic, and practical workarounds for unsupported CPU instructions during emulation.

SRFApplicationVNDQbdiVNDQuarkslabVNDTritonTYPResearchTYPToolTYPWriteupSTGDiscovery
62
Edit Score
2026-03-30
2026-03-30 21:17Z
CRIT

CVE-2026-34558 — Ci4-cms-erp Ci4ms: These stored values are later rendered directly into administrative interfaces and global navigation components

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-34558

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input within the Methods Management functionality when creating or managing application methods/pages. Multiple input fields accept attacker-controlled JavaScript payloads that are stored server-side without sanitization or output encoding. These store CVSSv3.1 9.1 (CRITICAL)

CWECWE 79VNDCi4 Cms ErpVNDCi4msTYPVulnerability
9.1
CVSS v3.1
96
Edit Score