Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-13 00:31Z
2026-03-28
2026-03-28 12:15Z
HIGH

CVE-2016-20041 — Yasr: 0.6.9-5 contains a buffer overflow vulnerability that allows local attackers to crash the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-20041

Yasr 0.6.9-5 contains a buffer overflow vulnerability that allows local attackers to crash the application or execute arbitrary code by supplying an oversized argument to the -p parameter. Attackers can invoke yasr with a crafted payload containing junk data, shellcode, and a return address to overwrite the stack and trigger code execution. CVSSv3.1 8.4 (HIGH) · EPSS 7th percentile

CWECWE 22VNDYasrTYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-03-28
2026-03-28 12:15Z
HIGH

CVE-2016-20040 — TiEmu: 3.03-nogdb+dfsg-3 contains a buffer overflow vulnerability in the ROM parameter handling that allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-20040

TiEmu 3.03-nogdb+dfsg-3 contains a buffer overflow vulnerability in the ROM parameter handling that allows local attackers to crash the application or execute arbitrary code. Attackers can supply an oversized ROM parameter to the tiemu command-line interface to overflow the stack buffer and overwrite the instruction pointer with malicious addresses. CVSSv3.1 8.4 (HIGH) · EPSS 7th percentile

CWECWE 22VNDTiemuTYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-03-28
2026-03-28 12:15Z
HIGH

CVE-2016-20038 — yTree 1.94-1.1 contains a stack-based buffer overflow vulnerability that allows local attackers to execute

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-20038

yTree 1.94-1.1 contains a stack-based buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying an excessively long argument to the application. Attackers can craft a malicious command-line argument containing shellcode and a return address to overwrite the stack and execute code in the application context. CVSSv3.1 8.4 (HIGH) · EPSS 1th percentile

CWECWE 787TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-03-28
2026-03-28 12:15Z
HIGH

CVE-2016-20037 — xwpe 1.5.30a-2.1 and prior contains a stack-based buffer overflow vulnerability that allows local attackers

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-20037

xwpe 1.5.30a-2.1 and prior contains a stack-based buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying overly long input strings that exceed buffer boundaries. Attackers can craft malicious command-line arguments with 262 bytes of junk data followed by shellcode to overwrite the instruction pointer and achieve code execution or denial of service. CVSSv3.1 8.4 (HIGH) · EPSS 4th percentile

CWECWE 787TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-03-28
2026-03-28 11:16Z
CRIT

CVE-2025-9497 — Microchip Timeprovider_4100_firmware: Use of Hard-coded Credentials vulnerability in Microchip Time Provider 4100 allows Malicious Manual Software

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-9497

Use of Hard-coded Credentials vulnerability in Microchip Time Provider 4100 allows Malicious Manual Software Update.This issue affects Time Provider 4100: before 2.5.0. CVSSv3.1 9.8 (CRITICAL) · EPSS 18th percentile

CWECWE 798VNDMicrochipTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-03-27
2026-03-27 23:17Z
HIGH

CVE-2026-4248 — Ultimate: The Ultimate Member plugin for WordPress is vulnerable to Sensitive Information Exposure in all

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4248

The Ultimate Member plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.11.2. This is due to the '{usermeta:password_reset_link}' template tag being processed within post content via the '[um_loggedin]' shortcode, which generates a valid password reset token for the currently logged-in user viewing the page. This makes it possible for authenticated attackers, with Contributor-level access and above, to craft a malicious CVSSv3.1 8.0 (HIGH) · EPSS 10th percentile

CWECWE 285VNDUltimateTYPVulnerability
8.0
CVSS v3.1
90
Edit Score
2026-03-27
2026-03-27 22:16Z
HIGH

CVE-2026-33943 — Capricorn86 Happy_dom: In versions 15.10.0 through 20.8.7, a code injection vulnerability in `ECMAScriptModuleCompiler` allows an attacker

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-33943

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. In versions 15.10.0 through 20.8.7, a code injection vulnerability in `ECMAScriptModuleCompiler` allows an attacker to achieve Remote Code Execution (RCE) by injecting arbitrary JavaScript expressions inside `export { }` declarations in ES module scripts processed by happy-dom. The compiler directly interpolates unsanitized content into generated code as an executable expression, a CVSSv3.1 8.8 (HIGH)

CWECWE 94VNDCapricorn86VNDHappyTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-03-27
2026-03-27 22:16Z
HIGH

CVE-2026-33941 — Handlebarsjs Handlebars: provides the power necessary to let users build semantic templates.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-33941

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the Handlebars CLI precompiler (`bin/handlebars` / `lib/precompiler.js`) concatenates user-controlled strings — template file names and several CLI options — directly into the JavaScript it emits, without any escaping or sanitization. An attacker who can influence template filenames or CLI arguments can inject arbitrary JavaScript that executes when the generated bu CVSSv3.1 8.2 (HIGH)

CWECWE 94CWECWE 79CWECWE 116VNDHandlebarsjsVNDHandlebarsTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-03-27
2026-03-27 22:16Z
HIGH

CVE-2026-33940 — Handlebarsjs Handlebars: In versions 4.0.0 through 4.7.8, a crafted object placed in the template context can

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-33940

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, a crafted object placed in the template context can bypass all conditional guards in `resolvePartial()` and cause `invokePartial()` to return `undefined`. The Handlebars runtime then treats the unresolved partial as a source that needs to be compiled, passing the crafted object to `env.compile()`. Because the object is a valid Handlebars AST containing injected code CVSSv3.1 8.1 (HIGH)

CWECWE 94CWECWE 843VNDHandlebarsjsVNDHandlebarsTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-03-27
2026-03-27 22:16Z
HIGH

CVE-2019-25651 — Ubiquiti: UniFi Network Controller prior to 5.10.12 (excluding 5.6.42), UAP FW prior to 4.0.6

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-25651

Ubiquiti UniFi Network Controller prior to 5.10.12 (excluding 5.6.42), UAP FW prior to 4.0.6, UAP-AC, UAP-AC v2, and UAP-AC Outdoor FW prior to 3.8.17, USW FW prior to 4.0.6, USG FW prior to 4.4.34 uses AES-CBC encryption for device-to-controller communication, which contains cryptographic weaknesses that allow attackers to recover encryption keys from captured traffic. Attackers with adjacent network access can capture sufficient encrypted traffic and exploit AES-CBC mode vu CVSSv3.1 8.3 (HIGH) · EPSS 1th percentile

CWECWE 327VNDUbiquitiTYPVulnerability
8.3
CVSS v3.1
92
Edit Score
2026-03-27
2026-03-27 21:32Z
CRIT

darksword-kexploit — iOS <=26.0.1 DarkSword Kernel Exploit reimplemented in Objective-C

GitHub · kernel exploits·github.comGITHUB POC

opa334 has published darksword-kexploit, a Objective-C reimplementation of a kernel exploit targeting iOS versions up to 26.0.1. The exploit appears to be a public proof-of-concept for kernel-level privilege escalation on Apple's mobile platform.

SRFOsTACTA0004SRFMobileVNDAppleTYPToolTYPExploitSTGPrivescSTGExecution
78
Edit Score
2026-03-27
2026-03-27 21:17Z
HIGH

CVE-2026-34046 — Langflow Langflow: Prior to version 1.5.1, the `_read_flow` helper in `src/backend/base/langflow/api/v1/flows.py` branched on the `AUTO_LOGIN` setting

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-34046

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.5.1, the `_read_flow` helper in `src/backend/base/langflow/api/v1/flows.py` branched on the `AUTO_LOGIN` setting to decide whether to filter by `user_id`. When `AUTO_LOGIN` was `False` (i.e., authentication was enabled), neither branch enforced an ownership check — the query returned any flow matching the given UUID regardless of who owned it. This allowed any authenticated user CVSSv3.1 8.8 (HIGH) · EPSS 9th percentile

CWECWE 862CWECWE 639VNDLangflowTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-03-27
2026-03-27 21:17Z
HIGH

CVE-2026-33938 — Handlebarsjs Handlebars: provides the power necessary to let users build semantic templates.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-33938

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the `@partial-block` special variable is stored in the template data context and is reachable and mutable from within a template via helpers that accept arbitrary objects. When a helper overwrites `@partial-block` with a crafted Handlebars AST, a subsequent invocation of `{{> @partial-block}}` compiles and executes that AST, enabling arbitrary JavaScript execution o CVSSv3.1 8.1 (HIGH)

CWECWE 94CWECWE 843CWECWE 917VNDHandlebarsjsVNDHandlebarsTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-03-27
2026-03-27 21:17Z
CRIT

CVE-2026-33937 — Handlebarsjs Handlebars: An attacker who can supply a crafted AST to `compile()` can therefore inject and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-33937

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pre-parsed AST object in addition to a template string. The `value` field of a `NumberLiteral` AST node is emitted directly into the generated JavaScript without quoting or sanitization. An attacker who can supply a crafted AST to `compile()` can therefore inject and execute arbitrary JavaScript, leading to Remote Code Execution on t CVSSv3.1 9.8 (CRITICAL)

CWECWE 94CWECWE 843VNDHandlebarsjsVNDHandlebarsTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-03-27
2026-03-27 21:17Z
CRIT

CVE-2026-33879 — Aicentre Federated_learning_and_interoperability_platform: Federated Learning and Interoperability Platform (FLIP) is an open-source platform for federated training and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-33879

Federated Learning and Interoperability Platform (FLIP) is an open-source platform for federated training and evaluation of medical imaging AI models across healthcare institutions. The FLIP login page in versions 0.1.1 and prior has no rate limiting or CAPTCHA, enabling brute-force and credential-stuffing attacks. FLIP users are external to the organization, increasing credential reuse risk. As of time of publication, it is unclear if a patch is available. CVSSv3.1 9.8 (CRITICAL)

CWECWE 307VNDAicentreVNDFederatedTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-03-27
2026-03-27 20:16Z
CRIT

CVE-2026-33765 — Pi-hole Web_interface: Versions prior to 6.0 have a critical OS Command Injection vulnerability in the savesettings.php

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-33765

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. Versions prior to 6.0 have a critical OS Command Injection vulnerability in the savesettings.php file. The application takes the user-controlled $_POST['webtheme'] parameter and concatenates it directly into a system command executed via PHP's exec() function. Since the input is neither sanitized nor validated before being passed to the shell, an atta CVSSv3.1 9.8 (CRITICAL)

CWECWE 78VNDPi HoleTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-03-27
2026-03-27 20:16Z
CRIT

CVE-2026-33654 — Nanobot Nanobot: Prior to version 0.1.6, an indirect prompt injection vulnerability exists in the email channel

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-33654

nanobot is a personal AI assistant. Prior to version 0.1.6, an indirect prompt injection vulnerability exists in the email channel processing module (`nanobot/channels/email.py`), allowing a remote, unauthenticated attacker to execute arbitrary LLM instructions (and subsequently, system tools) without any interaction from the bot owner. By sending an email containing malicious prompts to the bot's monitored email address, the bot automatically polls, ingests, and processes th CVSSv3.1 9.8 (CRITICAL)

CWECWE 94CWECWE 290CWECWE 1336VNDNanobotTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-03-27
2026-03-27 19:16Z
CRIT

CVE-2026-34387 — Fleetdm Fleet: Prior to 4.81.1, a command injection vulnerability in Fleet's software installer pipeline allows an

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-34387

Fleet is open source device management software. Prior to 4.81.1, a command injection vulnerability in Fleet's software installer pipeline allows an attacker to achieve arbitrary code execution as root (macOS/Linux) or SYSTEM (Windows) on managed hosts when an uninstall is triggered for a crafted software package. Version 4.81.1 patches the issue. CVSSv3.1 9.8 (CRITICAL)

CWECWE 78VNDFleetdmVNDFleetTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-03-27
2026-03-27 19:16Z
HIGH

CVE-2026-34385 — Fleetdm Fleet: Prior to 4.81.0, a second-order SQL injection vulnerability in Fleet's Apple MDM profile delivery

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-34385

Fleet is open source device management software. Prior to 4.81.0, a second-order SQL injection vulnerability in Fleet's Apple MDM profile delivery pipeline could allow an attacker with a valid MDM enrollment certificate to exfiltrate or modify the contents of the Fleet database, including user credentials, API tokens, and device enrollment secrets. Version 4.81.0 patches the issue. CVSSv3.1 8.1 (HIGH)

CWECWE 89VNDFleetdmVNDFleetTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-03-27
2026-03-27 17:16Z
HIGH

CVE-2026-28369 — Redhat Build_of_apache_camel_-_hawtio: Request smuggling allows an attacker to bypass security mechanisms, access restricted information, or manipulate

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-28369

A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the request by stripping these leading spaces. This behavior, which violates HTTP standards, can be exploited by a remote attacker to perform request smuggling. Request smuggling allows an attacker to bypass security mechanisms, access restricted information, or manipulate web caches, potentially leading to unauthorized acti CVSSv3.1 8.7 (HIGH) · EPSS 15th percentile

CWECWE 444VNDUndertowTYPVulnerability
8.7
CVSS v3.1
94
Edit Score
2026-03-27
2026-03-27 17:16Z
HIGH

CVE-2026-28368 — Redhat Build_of_apache_camel_-_hawtio: This vulnerability allows a remote attacker to construct specially crafted requests where header names

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-28368

A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to launch request smuggling attacks, potentially bypassing security controls and accessing unauthorized resources. CVSSv3.1 8.7 (HIGH) · EPSS 8th percentile

CWECWE 444VNDUndertowTYPVulnerability
8.7
CVSS v3.1
94
Edit Score
2026-03-27
2026-03-27 17:16Z
HIGH

CVE-2026-28367 — Redhat Build_of_apache_camel_-_hawtio: This can be used for request smuggling with certain proxy servers, such as older

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-28367

A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests. CVSSv3.1 8.7 (HIGH)

CWECWE 444VNDUndertowTYPVulnerability
8.7
CVSS v3.1
94
Edit Score
2026-03-27
2026-03-27 15:17Z
HIGH

CVE-2026-5027 — Langflow Langflow: The 'POST /api/v2/files' endpoint does not sanitize the 'filename' parameter from the multipart form

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-5027

The 'POST /api/v2/files' endpoint does not sanitize the 'filename' parameter from the multipart form data, allowing an attacker to write files to arbitrary locations on the filesystem using path traversal sequences ('../'). CVSSv3.1 8.8 (HIGH) · EPSS 98th percentile

CWECWE 22VNDLangflowTYPVulnerability
8.8
CVSS v3.1
100
Edit Score
2026-03-27
2026-03-27 15:17Z
HIGH

CVE-2026-4984 — Twilio: The Twilio integration webhook handler accepts any POST request without validating Twilio's 'X-Twilio-Signature'.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4984

The Twilio integration webhook handler accepts any POST request without validating Twilio's 'X-Twilio-Signature'. When processing media messages, it fetches user-controlled URLs ('MediaUrlN' parameters) using HTTP requests that include the integration's Twilio credentials in the 'Authorization' header. An attacker can forge a webhook payload pointing to their own server and receive the victim's 'accountSID' and 'authToken' in plaintext (base64-encoded Basic Auth), leading t CVSSv3.1 8.2 (HIGH) · EPSS 13th percentile

CWECWE 352CWECWE 345VNDTwilioTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-03-27
2026-03-27 15:16Z
CRIT

CVE-2026-33757 — Openbao Openbao: This allows an attacker to start an authentication request and perform "remote phishing" by

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-33757

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao does not prompt for user confirmation when logging in via JWT/OIDC and a role with `callback_mode` set to `direct`. This allows an attacker to start an authentication request and perform "remote phishing" by having the victim visit the URL and automatically log-in to the session of the attacker. Despite being based on the authorization code flow, the `direct` mode calls back d CVSSv3.1 9.6 (CRITICAL)

CWECWE 384VNDOpenbaoTYPVulnerability
9.6
CVSS v3.1
98
Edit Score