Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-13 21:14Z
2026-03-24
2026-03-24 00:16Z
CRIT

CVE-2026-33195 — Rubyonrails Rails: Active Storage allows users to attach cloud and local files in Rails applications.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-33195

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applicatio CVSSv3.1 9.8 (CRITICAL)

CWECWE 22VNDActiveVNDRubyonrailsTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-03-24
2026-03-24 00:00Z
INFO

Security Automation with Elastic Workflows: From Alert to Response

Elastic Security Labs·elastic.co

Elastic released Workflows, a native SIEM automation platform embedded in Kibana that enables security teams to build alert triage and response playbooks without external tools. The feature supports alert triggers, threat intel enrichment (VirusTotal, etc.), ES|QL queries, conditional branching, case creation, team notifications, and AI-driven classification and investigation via Agent Builder.

SRFApplicationSRFCloudVNDElasticTYPTool
62
Edit Score
2026-03-23
2026-03-23 16:16Z
HIGH

CVE-2026-32845 — cgltf version 1.15 and prior contain an integer overflow vulnerability in the cgltf_validate() function

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-32845

cgltf version 1.15 and prior contain an integer overflow vulnerability in the cgltf_validate() function when validating sparse accessors that allows attackers to trigger out-of-bounds reads by supplying crafted glTF/GLB input files with attacker-controlled size values. Attackers can exploit unchecked arithmetic operations in sparse accessor validation to cause heap buffer over-reads in cgltf_calc_index_bound(), resulting in denial of service crashes and potential memory discl CVSSv3.1 8.4 (HIGH) · EPSS 4th percentile

CWECWE 190TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-03-23
2026-03-23 15:30Z
INFO

v3.4.0.51

Mythic releases·github.com

Mythic v3.4.0.51 released with a Dockerfile tag bump to match the release version. No detailed changelog or feature/fix information is provided in the release notes.

VNDMythicTYPTool
15
Edit Score
2026-03-23
2026-03-23 15:16Z
CRIT

CVE-2026-4404 — Linuxfoundation Harbor: Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4404

Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI. CVSSv3.1 9.4 (CRITICAL) · EPSS 40th percentile

CWECWE 798CWECWE 1393VNDLinuxfoundationTYPVulnerability
9.4
CVSS v3.1
97
Edit Score
2026-03-23
2026-03-23 15:00Z
HIGH

Discovering Unexpected Okta Attack Paths with BloodHound

SpecterOps·specterops.io

SpecterOps released OktaHound, a BloodHound data collector for Okta that maps identity entities, roles, policies, and trust relationships to discover attack paths and privilege escalation vectors. The tool extends BloodHound's graph analysis to hybrid environments, revealing misconfigurations in Okta RBAC, SCIM password sync abuse, SWA credential exposure, and dangerous AD agent deployments that grant Domain Admin privileges.

TACTA0004TACTA0007SRFIdentitySRFCloudTACTA0008VNDOktaTYPResearchTYPTool
82
Edit Score
2026-03-23
2026-03-23 14:06Z
INFO

v3.4.0.50

Mythic releases·github.com

Mythic v3.4.0.50 released with a Dockerfile tag bump to match the release version. No detailed changelog or feature/fix information is provided in the GitHub release page.

SRFApplicationVNDMythicTYPTool
15
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-03-23
2026-03-23 13:16Z
CRIT

CVE-2026-31851 — Nexxtsolutions Nebula300plus_firmware: Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 does not implement rate limiting or

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-31851

Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 does not implement rate limiting or account lockout mechanisms on authentication interfaces. An attacker can perform unlimited authentication attempts against endpoints that rely on credential validation, enabling brute-force attacks to guess administrative credentials without restriction. CVSSv3.1 9.8 (CRITICAL) · EPSS 11th percentile

CWECWE 307VNDNexxtsolutionsVNDNexxtTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-03-23
2026-03-23 13:16Z
CRIT

CVE-2026-31848 — Nexxtsolutions Nebula300plus_firmware: This allows unauthorized administrative access to protected endpoints.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-31848

Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 uses the ecos_pw cookie for authentication, which contains Base64-encoded credential data combined with a static suffix. Because the encoding is reversible and lacks integrity protection, an attacker can reconstruct or forge a valid cookie value without proper authentication. This allows unauthorized administrative access to protected endpoints. CVSSv3.1 9.8 (CRITICAL) · EPSS 7th percentile

CWECWE 312VNDNexxtsolutionsVNDNexxtTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-03-23
2026-03-23 13:16Z
HIGH

CVE-2026-31847 — Nexxtsolutions Nebula300plus_firmware: Hidden functionality in the /goform/setSysTools endpoint in Nexxt Solutions Nebula 300+ firmware through version

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-31847

Hidden functionality in the /goform/setSysTools endpoint in Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 allows remote enablement of a Telnet service. By sending a crafted POST request with parameters such as telnetManageEn=true and telnetPwd, an authenticated attacker can activate a Telnet service on port 23. This exposes a privileged diagnostic interface that is not intended for external access and can be used to interact with the underlying system. CVSSv3.1 8.8 (HIGH) · EPSS 10th percentile

CWECWE 912VNDNexxtsolutionsVNDHiddenTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-03-23
2026-03-23 12:16Z
CRIT

CVE-2026-4585 — The manipulation of the argument File leads to os command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4585

A vulnerability has been found in Tiandy Easy7 Integrated Management Platform up to 7.17.0. This vulnerability affects unknown code of the file /Easy7/apps/WebService/ImportSystemConfiguration.jsp of the component Configuration Handler. The manipulation of the argument File leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond i CVSSv3.1 9.8 (CRITICAL) · EPSS 44th percentile

CWECWE 77CWECWE 78TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-03-23
2026-03-23 10:11Z
HIGH

entra-ca-insight — Discover gaps in Entra Conditional Access policies before attackers do

GitHub · Azure / Entra tools·github.comGITHUB POC

entra-ca-insight is a proactive gap-detection tool for Microsoft Entra Conditional Access policies that enumerates all possible access combinations and evaluates them offline against tenant policy configurations. Unlike reactive log-based approaches, it discovers unused gaps before exploitation by analyzing identity types, applications, platforms, locations, and client types to identify scenarios where no strong control (MFA, Auth Strength, or block) is enforced.

TACTA0007SRFIdentitySRFCloudVNDMicrosoftTYPResearchTYPToolSTGDiscoveryTECT1087
78
Edit Score
2026-03-23
2026-03-23 06:16Z
HIGH

CVE-2026-4601 — Jsrsasign_project Jsrsasign: Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4601

Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private key by forcing r or s to be zero, so the library emits an invalid signature without retrying, and then solves for x from the resulting signature. CVSSv3.1 8.7 (HIGH) · EPSS 4th percentile

CWECWE 325VNDJsrsasign ProjectTYPVulnerability
8.7
CVSS v3.1
94
Edit Score
2026-03-23
2026-03-23 06:16Z
CRIT

CVE-2026-4599 — Kjur Jsrsasign: Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4599

Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions in src/crypto-1.1.js; an attacker can recover the private key by exploiting the incorrect compareTo checks that accept out-of-range candidates and thus bias DSA nonces during signature generation. CVSSv3.1 9.1 (CRITICAL) · EPSS 26th percentile

CWECWE 1023VNDKjurTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-03-23
2026-03-23 03:16Z
HIGH

CVE-2026-4566 — Belkin F9k1122_firmware: Executing a manipulation of the argument webpage can lead to stack-based buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4566

A flaw has been found in Belkin F9K1122 1.00.33. The affected element is the function formWISP5G of the file /goform/formWISP5G. Executing a manipulation of the argument webpage can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. CVSSv3.1 8.8 (HIGH) · EPSS 17th percentile

CWECWE 121CWECWE 119VNDBelkinTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-03-23
2026-03-23 00:00Z
HIGH

NICKEL ALLEY strategy: Fake it 'til you make it

Sophos X-Ops·news.sophos.comin the wild

Sophos CTU researchers document NICKEL ALLEY (North Korean state-sponsored threat group) conducting sustained social engineering campaigns targeting software developers through fake job postings, LinkedIn profiles, and GitHub repositories. The group delivers PyLangGhost RAT and BeaverTail malware via ClickFix tactics, malicious npm packages, and VS Code task automation, with primary objectives of cryptocurrency theft and supply-chain compromise. Active campaigns observed throughout 2025 demonstrate the group's operational maturity and infrastructure agility, leveraging Vercel for payload hosting and rotating staging domains.

SRFApplicationTACTA0005TACTA0001TACTA0002TACTA0006TACTA0007SRFWebTACTA0003
78
Edit Score
2026-03-23
2026-03-23 00:00Z
CRIT

Oracle vulnerability (CVE-2026-21992) impacts core products

Sophos X-Ops·news.sophos.comCVE-2026-21992

Oracle disclosed CVE-2026-21992, a critical vulnerability (CVSS 9.8) affecting Oracle Identity Manager and Oracle Web Services Manager in Fusion Middleware. Unauthenticated attackers can achieve remote code execution via HTTP due to missing network-level authentication. No active exploitation reported as of publication.

SRFApplicationTACTA0001TACTA0002VNDOracleTYPVulnerabilityTYPAdvisorySTGExecutionSTGInitial Access
72
Edit Score
2026-03-22
2026-03-22 18:16Z
HIGH

CVE-2026-4558 — Linksys Mr9600_firmware: Executing a manipulation of the argument configApSsid/configApPassphrase/srpLogin/srpPassword can lead to os command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4558

A flaw has been found in Linksys MR9600 2.0.6.206937. Affected is the function smartConnectConfigure of the file SmartConnect.lua. Executing a manipulation of the argument configApSsid/configApPassphrase/srpLogin/srpPassword can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. CVSSv3.1 8.8 (HIGH) · EPSS 49th percentile

CWECWE 77CWECWE 78VNDLinksysTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-03-22
2026-03-22 04:16Z
HIGH

CVE-2026-4314 — Ultimate: The 'The Ultimate WordPress Toolkit – WP Extended' plugin for WordPress is vulnerable to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4314

The 'The Ultimate WordPress Toolkit – WP Extended' plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.4. This is due to the `isDashboardOrProfileRequest()` method in the Menu Editor module using an insecure `strpos()` check against `$_SERVER['REQUEST_URI']` to determine if a request targets the dashboard or profile page. The `grantVirtualCaps()` method, which is hooked into the `user_has_cap` filter, grants elevated capabiliti CVSSv3.1 8.8 (HIGH) · EPSS 14th percentile

CWECWE 269VNDUltimateTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-03-21
2026-03-21 23:16Z
HIGH

CVE-2026-4529 — Dlink Dhp-1320_firmware: Such manipulation leads to stack-based buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4529

A vulnerability was identified in D-Link DHP-1320 1.00WWB04. This affects the function redirect_count_down_page of the component SOAP Handler. Such manipulation leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. This vulnerability only affects products that are no longer supported by the maintainer. CVSSv3.1 8.8 (HIGH) · EPSS 18th percentile

CWECWE 121CWECWE 119VNDDlinkTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-03-21
2026-03-21 23:16Z
HIGH

CVE-2026-3629 — Import: The Import and export users and customers plugin for WordPress is vulnerable to privilege

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-3629

The Import and export users and customers plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.29.7. This is due to the 'save_extra_user_profile_fields' function not properly restricting which user meta keys can be updated via profile fields. The 'get_restricted_fields' method does not include sensitive meta keys such as 'wp_capabilities'. This makes it possible for unauthenticated attackers to escalate their privileges to Adminis CVSSv3.1 8.1 (HIGH) · EPSS 24th percentile

CWECWE 269VNDImportTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-03-21
2026-03-21 16:16Z
HIGH

CVE-2019-25580 — Owndms Owndms: 4.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-25580

ownDMS 4.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the IMG parameter. Attackers can send GET requests to pdfstream.php, imagestream.php, or anyfilestream.php with crafted SQL payloads in the IMG parameter to extract sensitive database information including version and database names. CVSSv3.1 8.2 (HIGH) · EPSS 23th percentile

CWECWE 434VNDOwndmsTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-03-21
2026-03-21 16:16Z
HIGH

CVE-2019-25578 — Codnloc Phptransformer: 2016.9 contains an SQL injection vulnerability that allows remote attackers to execute arbitrary

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-25578

phpTransformer 2016.9 contains an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through the idnews parameter. Attackers can send crafted GET requests to GeneratePDF.php with SQL payloads in the idnews parameter to extract sensitive database information or manipulate queries. CVSSv3.1 8.2 (HIGH) · EPSS 29th percentile

CWECWE 89VNDCodnlocTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-03-21
2026-03-21 04:17Z
HIGH

CVE-2026-4261 — Expire: The Expire Users plugin for WordPress is vulnerable to Privilege Escalation in all versions

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4261

The Expire Users plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.2. This is due to the plugin allowing a user to update the 'on_expire_default_to_role' meta through the 'save_extra_user_profile_fields' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator. CVSSv3.1 8.8 (HIGH) · EPSS 16th percentile

CWECWE 862VNDExpireTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-03-21
2026-03-21 04:17Z
HIGH

CVE-2026-3334 — CMS: The CMS Commander plugin for WordPress is vulnerable to SQL Injection via the 'or_blogname'

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-3334

The CMS Commander plugin for WordPress is vulnerable to SQL Injection via the 'or_blogname', 'or_blogdescription', and 'or_admin_email' parameters in all versions up to, and including, 2.288. This is due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL queries in the restore workflow. This makes it possible for authenticated attackers, with CMS Commander API key access, to append additional SQL queries into alread CVSSv3.1 8.8 (HIGH) · EPSS 11th percentile

CWECWE 89VNDCmsTYPVulnerability
8.8
CVSS v3.1
94
Edit Score