opsecsafe — cyber intelligence

2026-03-20

2026-03-20 23:16Z

CRIT

CVE-2026-33228 — Webreflection Flatted: is a circular JSON parser.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-33228

flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with the key "__proto__" returns Array.prototype via the inherited getter. This object is then treated as a legitimate parsed value and assigned as a property of the output object, effecti CVSSv3.1 9.8 (CRITICAL) · EPSS 45th percentile

CWECWE 1321CWECWE 915VNDWebreflectionTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-03-20

2026-03-20 23:16Z

HIGH

CVE-2026-33226 — Budibase Budibase: On GCP this leads to OAuth2 token theft with cloud-platform scope (full GCP access).

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-33226

Budibase is a low code platform for creating internal tools, workflows, and admin panels. In versions from 3.30.6 and prior, the REST datasource query preview endpoint (POST /api/queries/preview) makes server-side HTTP requests to any URL supplied by the user in fields.path with no validation. An authenticated admin can reach internal services that are not exposed to the internet — including cloud metadata endpoints (AWS/GCP/Azure), internal databases, Kubernetes APIs, and ot CVSSv3.1 8.7 (HIGH) · EPSS 32th percentile

CWECWE 918VNDBudibaseTYPVulnerability

8.7

CVSS v3.1

Edit Score

2026-03-20

2026-03-20 23:16Z

CRIT

CVE-2026-33210 — Ruby-lang Json: From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-33210

Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2. CVSSv3.1 9.1 (CRITICAL)

CWECWE 134VNDRuby LangTYPVulnerability

9.1

CVSS v3.1

Edit Score

2026-03-20

2026-03-20 23:16Z

CRIT

CVE-2026-33186 — Grpc Grpc: Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-33186

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (includin CVSSv3.1 9.1 (CRITICAL)

CWECWE 285VNDGrpcTYPVulnerability

9.1

CVSS v3.1

Edit Score

2026-03-20

2026-03-20 23:16Z

CRIT

CVE-2026-29796 — Igl Eparking.fi: WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-29796

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructu CVSSv3.1 9.4 (CRITICAL) · EPSS 16th percentile

CWECWE 306VNDWebsocketVNDIglTYPVulnerability

9.4

CVSS v3.1

Edit Score

2026-03-20

2026-03-20 23:16Z

CRIT

CVE-2026-25192 — Ctek Charge_portal: WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-25192

CWECWE 306VNDWebsocketVNDCtekTYPVulnerability

9.4

CVSS v3.1

Edit Score

2026-03-20

2026-03-20 23:03Z

INFO

v3.4.0.49

Mythic releases·github.com

Mythic v3.4.0.49 released with a Dockerfile tag bump to match the release version. No detailed changelog or feature information is provided in the GitHub release page.

VNDMythicTYPTool

Edit Score

2026-03-20

2026-03-20 22:16Z

HIGH

CVE-2026-33166 — Qameta Allure_report: The Allure report generator prior to version 2.38.0 is vulnerable to an arbitrary file

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-33166

Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. The Allure report generator prior to version 2.38.0 is vulnerable to an arbitrary file read via path traversal when processing test results. An attacker can craft a malicious result file (-result.json, -container.json, or .plist) that points an attachment source to a sensitive file on the host system. During report generation, Allure will resolve these paths and include the sensitive fi CVSSv3.1 8.6 (HIGH)

CWECWE 22VNDQametaVNDAllureTYPVulnerability

8.6

CVSS v3.1

Edit Score

2026-03-20

2026-03-20 21:17Z

HIGH

CVE-2026-33142 — Hackerbay Oneuptime: Prior to version 10.0.34, the fix for CVE-2026-32306 (ClickHouse SQL injection via aggregate query

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-33142

OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.34, the fix for CVE-2026-32306 (ClickHouse SQL injection via aggregate query parameters) added column name validation to the _aggregateBy method but did not apply the same validation to three other query construction paths in StatementGenerator. The toSortStatement, toSelectStatement, and toGroupByStatement methods accept user-controlled object keys from API request bodies and interpola CVSSv3.1 8.1 (HIGH)

CWECWE 89VNDHackerbayVNDOneuptimeTYPVulnerability

8.1

CVSS v3.1

Edit Score

2026-03-20

2026-03-20 19:54Z

INFO

v2.11.0

AzureHound releases·github.com

AzureHound v2.11.0 released with maintenance updates including CLA workflow fixes, Windows resource generation tooling via winres, tenant info corrections for application fixture naming, and removal of Trivy from CI/CD actions. This is a routine point release with no security fixes or feature additions.

SRFIdentitySRFCloudVNDSpecteropsVNDMicrosoft AzureTYPToolSTGDiscoverySTGRecon

Edit Score

2026-03-20

2026-03-20 19:16Z

HIGH

CVE-2026-33010 — Doobidoo Mcp-memory-service: The wildcard Access-Control-Allow-Origin: * header permits any website to read API responses cross-origin.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-33010

mcp-memory-service is an open-source memory backend for multi-agent systems. Prior to version 10.25.1, when the HTTP server is enabled (MCP_HTTP_ENABLED=true), the application configures FastAPI's CORSMiddleware with allow_origins=['*'], allow_credentials=True, allow_methods=["*"], and allow_headers=["*"]. The wildcard Access-Control-Allow-Origin: * header permits any website to read API responses cross-origin. When combined with anonymous access (MCP_ALLOW_ANONYMOUS_ACCESS=t CVSSv3.1 8.1 (HIGH)

CWECWE 942VNDDoobidooTYPVulnerability

8.1

CVSS v3.1

Edit Score

2026-03-20

2026-03-20 17:16Z

CRIT

CVE-2026-22898 — Qnap Qvr_pro: A missing authentication for critical function vulnerability has been reported to affect QVR Pro.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-22898

A missing authentication for critical function vulnerability has been reported to affect QVR Pro. The remote attackers can then exploit the vulnerability to gain access to the system. We have already fixed the vulnerability in the following version: QVR Pro 2.7.4.14 and later CVSSv3.1 9.8 (CRITICAL)

CWECWE 306VNDQnapTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-03-20

2026-03-20 17:16Z

CRIT

CVE-2025-59383 — Qnap Media_streaming_add-on: A buffer overflow vulnerability has been reported to affect Media Streaming Add-On.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-59383

A buffer overflow vulnerability has been reported to affect Media Streaming Add-On. The remote attackers can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: Media Streaming Add-on 500.1.1 and later CVSSv3.1 9.1 (CRITICAL)

CWECWE 121VNDQnapTYPVulnerability

9.1

CVSS v3.1

Edit Score

2026-03-20

2026-03-20 17:16Z

CRIT

CVE-2025-15608 — Tp-link Archer_ax53_firmware: This vulnerability in AX53 v1, AX55 v4 and AX55 v4.6 results from insufficient input

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-15608

This vulnerability in AX53 v1, AX55 v4 and AX55 v4.6 results from insufficient input sanitization in the device’s probe handling logic, where unvalidated parameters can trigger a stack-based buffer overflow that causes the affected service to crash and, under specific conditions, may enable remote code execution through complex heap-spray techniques. Successful exploitation may result in repeated service unavailability and, in certain scenarios, allow an attacker to gain c CVSSv3.1 9.8 (CRITICAL) · EPSS 41th percentile

CWECWE 121VNDTp LinkVNDAx53TYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-03-20

2026-03-20 16:16Z

HIGH

CVE-2025-67260 — Aster-te Terrapack_tkservercgi: The Terrapack software, from ASTER TEC / ASTER S.p.A., with the indicated components and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-67260

The Terrapack software, from ASTER TEC / ASTER S.p.A., with the indicated components and versions has a file upload vulnerability that may allow attackers to execute arbitrary code. Vulnerable components include Terrapack TkWebCoreNG:: 1.0.20200914, Terrapack TKServerCGI 2.5.4.150, and Terrapack TpkWebGIS Client 1.0.0. CVSSv3.1 8.8 (HIGH)

CWECWE 434VNDAster TeVNDTerrapackTYPVulnerability

8.8

CVSS v3.1

Edit Score

2026-03-20

2026-03-20 14:16Z

CRIT

CVE-2024-44722 — Anolis Sysak: v2.0 and before is vulnerable to command execution via aaa;cat /etc/passwd.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-44722

SysAK v2.0 and before is vulnerable to command execution via aaa;cat /etc/passwd. CVSSv3.1 9.8 (CRITICAL)

CWECWE 94VNDAnolisVNDSysakTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-03-20

2026-03-20 13:15Z

INFO

linux-exploit-suggester — Linux privilege escalation auditing tool

GitHub · LPE exploits·github.comGITHUB POCCVE-2017-16995 CVE-2017-1000112 CVE-2016-8655

Linux Exploit Suggester (LES) is a shell-based auditing tool that identifies Linux kernel privilege escalation vulnerabilities on a target system by matching kernel version, distro, and configuration against a curated database of public exploits. The tool also performs kernel hardening assessment via checksec-style analysis of compile-time and runtime security configurations.

SRFOsTACTA0004TYPResearchTYPToolSTGDiscoverySTGPrivescTECT1068EXPLpe

Edit Score

2026-03-20

2026-03-20 10:16Z

HIGH

CVE-2026-22324 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-22324

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Melania melania allows PHP Local File Inclusion.This issue affects Melania: from n/a through <= 2.5.0. CVSSv3.1 8.1 (HIGH)

CWECWE 98TYPVulnerability

8.1

CVSS v3.1

Edit Score

2026-03-20

2026-03-20 07:16Z

HIGH

CVE-2026-4475 — Such manipulation leads to hard-coded credentials.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4475

A vulnerability has been found in Yi Technology YI Home Camera 2 2.1.1_20171024151200. The affected element is an unknown function of the file home/web/ipc. Such manipulation leads to hard-coded credentials. Access to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. CVSSv3.1 8.8 (HIGH) · EPSS 11th percentile

CWECWE 798CWECWE 259TYPVulnerability

8.8

CVSS v3.1

Edit Score

2026-03-20

2026-03-20 06:16Z

CRIT

CVE-2026-32768 — Ctfer-io Chall-manager: In versions prior to 0.6.5, due to a miswritten NetworkPolicy, a malicious actor can

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-32768

Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. In versions prior to 0.6.5, due to a miswritten NetworkPolicy, a malicious actor can pivot from an instance to any Pod out of the origin namespace. This breaks the security-by-default property expected as part of the deployment program, leading to a potential lateral movement. In the specific case of sdk/kubernetes.Kompose it does not isolate the instances. This issue has been fixed in CVSSv3.1 9.9 (CRITICAL)

CWECWE 284VNDCtfer IoVNDChallTYPVulnerability

9.9

CVSS v3.1

100

Edit Score

2026-03-20

2026-03-20 05:16Z

CRIT

CVE-2026-33017 — Langflow Langflow: In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows without

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-33017in the wild

Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows without requiring authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow data (containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to exec() with zero sandboxing, CVSSv3.1 9.8 (CRITICAL) · EPSS 97th percentile

CWECWE 94CWECWE 306CWECWE 95VNDLangflowTYPVulnerabilitySTAitw exploited

9.8

CVSS v3.1

100

Edit Score

2026-03-20

2026-03-20 03:15Z

HIGH

CVE-2026-32888 — Opensourcepos Open_source_point_of_sale: Versions contain an SQL Injection in the Items search functionality.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-32888

Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Versions contain an SQL Injection in the Items search functionality. When the custom attribute search feature is enabled (search_custom filter), user-supplied input from the search GET parameter is interpolated directly into a HAVING clause without parameterization or sanitization. This allows an authenticated attacker with basic item search permissions to execute ar CVSSv3.1 8.8 (HIGH)

CWECWE 89VNDOpensourceposTYPVulnerability

8.8

CVSS v3.1

Edit Score

2026-03-20

2026-03-20 02:16Z

HIGH

CVE-2026-4447 — Google Chrome: Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.153 allowed a remote attacker

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4447

Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) CVSSv3.1 8.8 (HIGH) · EPSS 13th percentile

CWECWE 693VNDGoogleVNDInappropriateTYPVulnerability

8.8

CVSS v3.1

Edit Score

2026-03-20

2026-03-20 00:16Z

HIGH

CVE-2026-32763 — Kysely Kysely: Versions up to and including 0.28.11 has a SQL injection vulnerability in JSON path

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-32763

Kysely is a type-safe TypeScript SQL query builder. Versions up to and including 0.28.11 has a SQL injection vulnerability in JSON path compilation for MySQL and SQLite dialects. The `visitJSONPathLeg()` function appends user-controlled values from `.key()` and `.at()` directly into single-quoted JSON path string literals (`'$.key'`) without escaping single quotes. An attacker can break out of the JSON path string context and inject arbitrary SQL. This is inconsistent with `s CVSSv3.1 8.2 (HIGH)

CWECWE 89VNDKyselyTYPVulnerability

8.2

CVSS v3.1

Edit Score

2026-03-20

2026-03-20 00:16Z

HIGH

CVE-2026-32759 — Filebrowser Filebrowser: The impact ranges from DoS through expensive processing hooks, to command injection amplification when

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-32759

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. In versions on the 2.x branch prior to 2.33.8, the TUS resumable upload handler parses the Upload-Length header as a signed 64-bit integer without validating that the value is non-negative, allowing an authenticated user to supply a negative value that instantly satisfies the upload completion condition upon the first PATCH request. This cau CVSSv3.1 8.1 (HIGH) · EPSS 35th percentile

CWECWE 190VNDFilebrowserTYPVulnerability

8.1

CVSS v3.1

Edit Score

Latest intel// live feed

CVE-2026-33228 — Webreflection Flatted: is a circular JSON parser.

CVE-2026-33226 — Budibase Budibase: On GCP this leads to OAuth2 token theft with cloud-platform scope (full GCP access).

CVE-2026-33210 — Ruby-lang Json: From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection

CVE-2026-33186 — Grpc Grpc: Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of

CVE-2026-29796 — Igl Eparking.fi: WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and

CVE-2026-25192 — Ctek Charge_portal: WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and

v3.4.0.49

CVE-2026-33166 — Qameta Allure_report: The Allure report generator prior to version 2.38.0 is vulnerable to an arbitrary file

CVE-2026-33142 — Hackerbay Oneuptime: Prior to version 10.0.34, the fix for CVE-2026-32306 (ClickHouse SQL injection via aggregate query

v2.11.0

CVE-2026-33010 — Doobidoo Mcp-memory-service: The wildcard Access-Control-Allow-Origin: * header permits any website to read API responses cross-origin.

CVE-2026-22898 — Qnap Qvr_pro: A missing authentication for critical function vulnerability has been reported to affect QVR Pro.

CVE-2025-59383 — Qnap Media_streaming_add-on: A buffer overflow vulnerability has been reported to affect Media Streaming Add-On.

CVE-2025-15608 — Tp-link Archer_ax53_firmware: This vulnerability in AX53 v1, AX55 v4 and AX55 v4.6 results from insufficient input

CVE-2025-67260 — Aster-te Terrapack_tkservercgi: The Terrapack software, from ASTER TEC / ASTER S.p.A., with the indicated components and

CVE-2024-44722 — Anolis Sysak: v2.0 and before is vulnerable to command execution via aaa;cat /etc/passwd.

linux-exploit-suggester — Linux privilege escalation auditing tool

CVE-2026-22324 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

CVE-2026-4475 — Such manipulation leads to hard-coded credentials.

CVE-2026-32768 — Ctfer-io Chall-manager: In versions prior to 0.6.5, due to a miswritten NetworkPolicy, a malicious actor can

CVE-2026-33017 — Langflow Langflow: In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows without

CVE-2026-32888 — Opensourcepos Open_source_point_of_sale: Versions contain an SQL Injection in the Items search functionality.

CVE-2026-4447 — Google Chrome: Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.153 allowed a remote attacker

CVE-2026-32763 — Kysely Kysely: Versions up to and including 0.28.11 has a SQL injection vulnerability in JSON path

CVE-2026-32759 — Filebrowser Filebrowser: The impact ranges from DoS through expensive processing hooks, to command injection amplification when