Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-13 21:51Z
2026-03-21
2026-03-21 04:17Z
HIGH

CVE-2026-2941 — Linksy: The Linksy Search and Replace plugin for WordPress is vulnerable to unauthorized modification of

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-2941

The Linksy Search and Replace plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'linksy_search_and_replace_item_details' function in all versions up to, and including, 1.0.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to update any database table, any value, including the wp_capabilities database field, which allows attackers to change their own role to administrato CVSSv3.1 8.8 (HIGH) · EPSS 16th percentile

CWECWE 862VNDLinksyTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-03-20
2026-03-20 23:16Z
HIGH

CVE-2026-33243 — Pengutronix Barebox: However, hashed-nodes itself is not part of the hash and could therefore be modified

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-33243

barebox is a bootloader. In barebox from version 2016.03.0 to before version 2026.03.1 (and the corresponding backport to 2025.09.3), an attacker could exploit a FIT signature verification vulnerability to trick the bootloader into booting different images than those that were verified as part of a signed configuration. mkimage(1) sets the hashed-nodes property of the FIT signature node to list which nodes of the FIT were hashed as part of the signing process as these will ne CVSSv3.1 8.2 (HIGH) · EPSS 1th percentile

CWECWE 345VNDPengutronixTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-03-20
2026-03-20 23:16Z
HIGH

CVE-2026-33236 — Nltk Nltk: Attackers can control a remote XML index server to provide malicious values containing path

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-33236

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, the NLTK downloader does not validate the `subdir` and `id` attributes when processing remote XML index files. Attackers can control a remote XML index server to provide malicious values containing path traversal sequences (such as `../`), which can lead to arbitrary directory creati CVSSv3.1 8.1 (HIGH)

CWECWE 22VNDNltkTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-03-20
2026-03-20 23:16Z
CRIT

CVE-2026-33228 — Webreflection Flatted: is a circular JSON parser.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-33228

flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with the key "__proto__" returns Array.prototype via the inherited getter. This object is then treated as a legitimate parsed value and assigned as a property of the output object, effecti CVSSv3.1 9.8 (CRITICAL) · EPSS 45th percentile

CWECWE 1321CWECWE 915VNDWebreflectionTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-03-20
2026-03-20 23:16Z
HIGH

CVE-2026-33226 — Budibase Budibase: On GCP this leads to OAuth2 token theft with cloud-platform scope (full GCP access).

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-33226

Budibase is a low code platform for creating internal tools, workflows, and admin panels. In versions from 3.30.6 and prior, the REST datasource query preview endpoint (POST /api/queries/preview) makes server-side HTTP requests to any URL supplied by the user in fields.path with no validation. An authenticated admin can reach internal services that are not exposed to the internet — including cloud metadata endpoints (AWS/GCP/Azure), internal databases, Kubernetes APIs, and ot CVSSv3.1 8.7 (HIGH) · EPSS 32th percentile

CWECWE 918VNDBudibaseTYPVulnerability
8.7
CVSS v3.1
94
Edit Score
2026-03-20
2026-03-20 23:16Z
CRIT

CVE-2026-33210 — Ruby-lang Json: From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-33210

Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2. CVSSv3.1 9.1 (CRITICAL)

CWECWE 134VNDRuby LangTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-03-20
2026-03-20 23:16Z
CRIT

CVE-2026-33186 — Grpc Grpc: Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-33186

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (includin CVSSv3.1 9.1 (CRITICAL)

CWECWE 285VNDGrpcTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-03-20
2026-03-20 23:16Z
CRIT

CVE-2026-29796 — Igl Eparking.fi: WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-29796

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructu CVSSv3.1 9.4 (CRITICAL) · EPSS 16th percentile

CWECWE 306VNDWebsocketVNDIglTYPVulnerability
9.4
CVSS v3.1
97
Edit Score
2026-03-20
2026-03-20 23:16Z
CRIT

CVE-2026-25192 — Ctek Charge_portal: WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-25192

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructu CVSSv3.1 9.4 (CRITICAL) · EPSS 45th percentile

CWECWE 306VNDWebsocketVNDCtekTYPVulnerability
9.4
CVSS v3.1
97
Edit Score
2026-03-20
2026-03-20 23:03Z
INFO

v3.4.0.49

Mythic releases·github.com

Mythic v3.4.0.49 released with a Dockerfile tag bump to match the release version. No detailed changelog or feature information is provided in the GitHub release page.

VNDMythicTYPTool
15
Edit Score
2026-03-20
2026-03-20 22:16Z
HIGH

CVE-2026-33166 — Qameta Allure_report: The Allure report generator prior to version 2.38.0 is vulnerable to an arbitrary file

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-33166

Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. The Allure report generator prior to version 2.38.0 is vulnerable to an arbitrary file read via path traversal when processing test results. An attacker can craft a malicious result file (-result.json, -container.json, or .plist) that points an attachment source to a sensitive file on the host system. During report generation, Allure will resolve these paths and include the sensitive fi CVSSv3.1 8.6 (HIGH)

CWECWE 22VNDQametaVNDAllureTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-03-20
2026-03-20 21:17Z
HIGH

CVE-2026-33142 — Hackerbay Oneuptime: Prior to version 10.0.34, the fix for CVE-2026-32306 (ClickHouse SQL injection via aggregate query

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-33142

OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.34, the fix for CVE-2026-32306 (ClickHouse SQL injection via aggregate query parameters) added column name validation to the _aggregateBy method but did not apply the same validation to three other query construction paths in StatementGenerator. The toSortStatement, toSelectStatement, and toGroupByStatement methods accept user-controlled object keys from API request bodies and interpola CVSSv3.1 8.1 (HIGH)

CWECWE 89VNDHackerbayVNDOneuptimeTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-03-20
2026-03-20 19:54Z
INFO

v2.11.0

AzureHound releases·github.com

AzureHound v2.11.0 released with maintenance updates including CLA workflow fixes, Windows resource generation tooling via winres, tenant info corrections for application fixture naming, and removal of Trivy from CI/CD actions. This is a routine point release with no security fixes or feature additions.

SRFIdentitySRFCloudVNDSpecteropsVNDMicrosoft AzureTYPToolSTGDiscoverySTGRecon
28
Edit Score
2026-03-20
2026-03-20 19:16Z
HIGH

CVE-2026-33010 — Doobidoo Mcp-memory-service: The wildcard Access-Control-Allow-Origin: * header permits any website to read API responses cross-origin.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-33010

mcp-memory-service is an open-source memory backend for multi-agent systems. Prior to version 10.25.1, when the HTTP server is enabled (MCP_HTTP_ENABLED=true), the application configures FastAPI's CORSMiddleware with allow_origins=['*'], allow_credentials=True, allow_methods=["*"], and allow_headers=["*"]. The wildcard Access-Control-Allow-Origin: * header permits any website to read API responses cross-origin. When combined with anonymous access (MCP_ALLOW_ANONYMOUS_ACCESS=t CVSSv3.1 8.1 (HIGH)

CWECWE 942VNDDoobidooTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-03-20
2026-03-20 17:16Z
CRIT

CVE-2026-22898 — Qnap Qvr_pro: A missing authentication for critical function vulnerability has been reported to affect QVR Pro.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-22898

A missing authentication for critical function vulnerability has been reported to affect QVR Pro. The remote attackers can then exploit the vulnerability to gain access to the system. We have already fixed the vulnerability in the following version: QVR Pro 2.7.4.14 and later CVSSv3.1 9.8 (CRITICAL)

CWECWE 306VNDQnapTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-03-20
2026-03-20 17:16Z
CRIT

CVE-2025-59383 — Qnap Media_streaming_add-on: A buffer overflow vulnerability has been reported to affect Media Streaming Add-On.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-59383

A buffer overflow vulnerability has been reported to affect Media Streaming Add-On. The remote attackers can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: Media Streaming Add-on 500.1.1 and later CVSSv3.1 9.1 (CRITICAL)

CWECWE 121VNDQnapTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-03-20
2026-03-20 17:16Z
CRIT

CVE-2025-15608 — Tp-link Archer_ax53_firmware: This vulnerability in AX53 v1, AX55 v4 and AX55 v4.6 results from insufficient input

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-15608

This vulnerability in AX53 v1, AX55 v4 and AX55 v4.6 results from insufficient input sanitization in the device’s probe handling logic, where unvalidated parameters can trigger a stack-based buffer overflow that causes the affected service to crash and, under specific conditions, may enable remote code execution through complex heap-spray techniques. Successful exploitation may result in repeated service unavailability and, in certain scenarios, allow an attacker to gain c CVSSv3.1 9.8 (CRITICAL) · EPSS 41th percentile

CWECWE 121VNDTp LinkVNDAx53TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-03-20
2026-03-20 16:16Z
HIGH

CVE-2025-67260 — Aster-te Terrapack_tkservercgi: The Terrapack software, from ASTER TEC / ASTER S.p.A., with the indicated components and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-67260

The Terrapack software, from ASTER TEC / ASTER S.p.A., with the indicated components and versions has a file upload vulnerability that may allow attackers to execute arbitrary code. Vulnerable components include Terrapack TkWebCoreNG:: 1.0.20200914, Terrapack TKServerCGI 2.5.4.150, and Terrapack TpkWebGIS Client 1.0.0. CVSSv3.1 8.8 (HIGH)

CWECWE 434VNDAster TeVNDTerrapackTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-03-20
2026-03-20 14:16Z
CRIT

CVE-2024-44722 — Anolis Sysak: v2.0 and before is vulnerable to command execution via aaa;cat /etc/passwd.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-44722

SysAK v2.0 and before is vulnerable to command execution via aaa;cat /etc/passwd. CVSSv3.1 9.8 (CRITICAL)

CWECWE 94VNDAnolisVNDSysakTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-03-20
2026-03-20 13:15Z
INFO

linux-exploit-suggester — Linux privilege escalation auditing tool

GitHub · LPE exploits·github.comGITHUB POCCVE-2017-16995CVE-2017-1000112CVE-2016-8655

Linux Exploit Suggester (LES) is a shell-based auditing tool that identifies Linux kernel privilege escalation vulnerabilities on a target system by matching kernel version, distro, and configuration against a curated database of public exploits. The tool also performs kernel hardening assessment via checksec-style analysis of compile-time and runtime security configurations.

SRFOsTACTA0004TYPResearchTYPToolSTGDiscoverySTGPrivescTECT1068EXPLpe
62
Edit Score
2026-03-20
2026-03-20 10:16Z
HIGH

CVE-2026-22324 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-22324

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Melania melania allows PHP Local File Inclusion.This issue affects Melania: from n/a through <= 2.5.0. CVSSv3.1 8.1 (HIGH)

CWECWE 98TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-03-20
2026-03-20 07:16Z
HIGH

CVE-2026-4475 — Such manipulation leads to hard-coded credentials.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4475

A vulnerability has been found in Yi Technology YI Home Camera 2 2.1.1_20171024151200. The affected element is an unknown function of the file home/web/ipc. Such manipulation leads to hard-coded credentials. Access to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. CVSSv3.1 8.8 (HIGH) · EPSS 11th percentile

CWECWE 798CWECWE 259TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-03-20
2026-03-20 06:16Z
CRIT

CVE-2026-32768 — Ctfer-io Chall-manager: In versions prior to 0.6.5, due to a miswritten NetworkPolicy, a malicious actor can

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-32768

Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. In versions prior to 0.6.5, due to a miswritten NetworkPolicy, a malicious actor can pivot from an instance to any Pod out of the origin namespace. This breaks the security-by-default property expected as part of the deployment program, leading to a potential lateral movement. In the specific case of sdk/kubernetes.Kompose it does not isolate the instances. This issue has been fixed in CVSSv3.1 9.9 (CRITICAL)

CWECWE 284VNDCtfer IoVNDChallTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-03-20
2026-03-20 05:16Z
CRIT

CVE-2026-33017 — Langflow Langflow: In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows without

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-33017in the wild

Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows without requiring authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow data (containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to exec() with zero sandboxing, CVSSv3.1 9.8 (CRITICAL) · EPSS 97th percentile

CWECWE 94CWECWE 306CWECWE 95VNDLangflowTYPVulnerabilitySTAitw exploited
9.8
CVSS v3.1
100
Edit Score
2026-03-20
2026-03-20 03:15Z
HIGH

CVE-2026-32888 — Opensourcepos Open_source_point_of_sale: Versions contain an SQL Injection in the Items search functionality.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-32888

Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Versions contain an SQL Injection in the Items search functionality. When the custom attribute search feature is enabled (search_custom filter), user-supplied input from the search GET parameter is interpolated directly into a HAVING clause without parameterization or sanitization. This allows an authenticated attacker with basic item search permissions to execute ar CVSSv3.1 8.8 (HIGH)

CWECWE 89VNDOpensourceposTYPVulnerability
8.8
CVSS v3.1
94
Edit Score