Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-14 01:57Z
2026-03-24
2026-03-24 19:16Z
HIGH

CVE-2026-23921 — Zabbix Zabbix: A low privilege Zabbix user with API access can exploit a blind SQL injection

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-23921

A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise. CVSSv3.1 8.8 (HIGH) · EPSS 86th percentile

CWECWE 89VNDZabbixTYPVulnerability
8.8
CVSS v3.1
95
Edit Score
2026-03-24
2026-03-24 19:16Z
HIGH

CVE-2026-23920 — Zabbix Zabbix: If ^ and $ anchors are used in user input validation, an injected newline

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-23920

Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands. CVSSv3.1 8.8 (HIGH) · EPSS 16th percentile

CWECWE 78VNDZabbixVNDHostTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-03-24
2026-03-24 18:20Z
HIGH

Attack Paths Don’t Stop at Identity Providers

SpecterOps·specterops.io

SpecterOps published research demonstrating how modern federated identity architectures create cross-platform attack paths that transcend individual system boundaries. The article models Okta as a translation layer between upstream identity sources (Active Directory, Entra) and downstream applications (GitHub, SaaS), showing how privilege accumulates across systems and how compromising upstream identity can propagate downstream through federation and synchronization relationships. The research introduces Okta modeling in BloodHound Enterprise to visualize these nested dependencies as attack graphs.

TACTA0001TACTA0007SRFIdentitySRFCloudVNDMicrosoftVNDGithubVNDOktaVNDSpecterops
82
Edit Score
2026-03-24
2026-03-24 18:16Z
HIGH

CVE-2026-32853 — Libvncserver_project Libvncserver: versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-32853

LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read vulnerability in the UltraZip encoding handler that allows a malicious VNC server to cause information disclosure or application crash. Attackers can exploit improper bounds checking in the HandleUltraZipBPP() function by manipulating subrectangle header counts to read beyond the allocated heap buffer. CVSSv3.1 8.1 (HIGH) · EPSS 35th percentile

CWECWE 125VNDLibvncserver ProjectVNDLibvncserverTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-03-24
2026-03-24 16:00Z
CRIT

RTFM: Read The Fatal Manual – When Vendor Documentation Creates Critical Attack Paths

SpecterOps·specterops.ioCVE-2026-0872in the wild

SpecterOps researcher Martin Sohn Christensen disclosed that vendor documentation from 16 major technology companies actively guided administrators to deploy critical Active Directory Certificate Services (AD CS) misconfigurations (ESC1, ESC3, ESC4) that have been known for over four years. Through responsible disclosure coordinated across November 2025–March 2026, some vendors (CyberArk, Iru, ManageEngine, Netskope) remediated within weeks, while others (Cisco, Entrust, FEITIAN, HP, Mitel, Oracle, ServiceNow) remain partially or fully unresolved. The research demonstrates that documentation-induced misconfigurations can create domain-wide attack paths worse than traditional CVEs, affecting countless organizations following official guidance.

SRFOsTACTA0004TACTA0005TACTA0001SRFIdentityVNDCitrixVNDNetskopeVNDDelinea
92
Edit Score
2026-03-24
2026-03-24 15:16Z
HIGH

CVE-2026-27654 — F5 Nginx_plus: NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-27654

NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this vulnerability may result in termination of the NGINX worker process or modification of source or destination file names outside the document root. This issue affects NGINX Open Source and NGINX Plus when the configuration file uses DAV module MOVE or COPY methods, prefix location (nonregular express CVSSv3.1 8.2 (HIGH)

CWECWE 120CWECWE 122VNDF5VNDNginxTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-03-24
2026-03-24 13:42Z
INFO

v3.4.0.52

Mythic releases·github.com

Mythic v3.4.0.52 released with a Dockerfile tag bump to match the release version. No detailed changelog or feature information is available in the GitHub release page.

VNDMythicTYPTool
15
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-03-24
2026-03-24 13:16Z
CRIT

CVE-2026-4729 — Mozilla Firefox: Some of these bugs showed evidence of memory corruption and we presume that with

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4729

Memory safety bugs present in Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 149 and Thunderbird 149. CVSSv3.1 9.8 (CRITICAL)

CWECWE 120VNDMozillaTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-03-24
2026-03-24 13:16Z
CRIT

CVE-2026-4725 — Mozilla Firefox: Sandbox escape due to use-after-free in the Graphics: Canvas2D component.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4725

Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149 and Thunderbird 149. CVSSv3.1 10.0 (CRITICAL)

CWECWE 416VNDMozillaTYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2026-03-24
2026-03-24 13:16Z
CRIT

CVE-2026-4724 — Mozilla Firefox: Undefined behavior in the Audio/Video component.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4724

Undefined behavior in the Audio/Video component. This vulnerability was fixed in Firefox 149 and Thunderbird 149. CVSSv3.1 9.1 (CRITICAL)

CWECWE 758VNDMozillaVNDUndefinedTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-03-24
2026-03-24 13:16Z
CRIT

CVE-2026-4723 — Mozilla Firefox: Use-after-free in the JavaScript Engine component.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4723

Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 149 and Thunderbird 149. CVSSv3.1 9.8 (CRITICAL)

CWECWE 416VNDMozillaTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-03-24
2026-03-24 13:16Z
HIGH

CVE-2026-4722 — Mozilla Firefox: Privilege escalation in the IPC component.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4722

Privilege escalation in the IPC component. This vulnerability was fixed in Firefox 149 and Thunderbird 149. CVSSv3.1 8.8 (HIGH)

VNDMozillaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-03-24
2026-03-24 13:16Z
CRIT

CVE-2026-4721 — Mozilla Firefox: Some of these bugs showed evidence of memory corruption and we presume that with

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4721

Memory safety bugs present in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. CVSSv3.1 9.8 (CRITICAL)

CWECWE 120VNDMozillaTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-03-24
2026-03-24 13:16Z
CRIT

CVE-2026-4720 — Mozilla Firefox: Some of these bugs showed evidence of memory corruption and we presume that with

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4720

Memory safety bugs present in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. CVSSv3.1 9.8 (CRITICAL)

CWECWE 120VNDMozillaTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-03-24
2026-03-24 13:16Z
HIGH

CVE-2026-4718 — Mozilla Firefox: Undefined behavior in the WebRTC: Signaling component.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4718

Undefined behavior in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. CVSSv3.1 8.1 (HIGH)

CWECWE 758VNDMozillaVNDUndefinedTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-03-24
2026-03-24 13:16Z
CRIT

CVE-2026-4717 — Mozilla Firefox: Privilege escalation in the Netmonitor component.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4717

Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. CVSSv3.1 9.8 (CRITICAL)

VNDMozillaTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-03-24
2026-03-24 13:16Z
CRIT

CVE-2026-4716 — Mozilla Firefox: Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4716

Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. CVSSv3.1 9.1 (CRITICAL)

CWECWE 908VNDMozillaTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-03-24
2026-03-24 13:16Z
CRIT

CVE-2026-4715 — Mozilla Firefox: Uninitialized memory in the Graphics: Canvas2D component.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4715

Uninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. CVSSv3.1 9.1 (CRITICAL)

CWECWE 908VNDMozillaVNDUninitializedTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-03-24
2026-03-24 13:16Z
CRIT

CVE-2026-4711 — Mozilla Firefox: Use-after-free in the Widget: Cocoa component.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4711

Use-after-free in the Widget: Cocoa component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. CVSSv3.1 9.8 (CRITICAL)

CWECWE 416VNDMozillaTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-03-24
2026-03-24 13:16Z
CRIT

CVE-2026-4710 — Mozilla Firefox: Incorrect boundary conditions in the Audio/Video component.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4710

Incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. CVSSv3.1 9.8 (CRITICAL)

CWECWE 119VNDMozillaTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-03-24
2026-03-24 13:16Z
CRIT

CVE-2026-4705 — Mozilla Firefox: Undefined behavior in the WebRTC: Signaling component.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4705

Undefined behavior in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. CVSSv3.1 9.8 (CRITICAL)

CWECWE 758VNDMozillaVNDUndefinedTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-03-24
2026-03-24 13:16Z
CRIT

CVE-2026-4702 — Mozilla Firefox: JIT miscompilation in the JavaScript Engine component.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4702

JIT miscompilation in the JavaScript Engine component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. CVSSv3.1 9.8 (CRITICAL)

CWECWE 843VNDMozillaVNDJitTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-03-24
2026-03-24 13:16Z
CRIT

CVE-2026-4701 — Mozilla Firefox: Use-after-free in the JavaScript Engine component.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4701

Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. CVSSv3.1 9.8 (CRITICAL)

CWECWE 416VNDMozillaTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-03-24
2026-03-24 13:16Z
CRIT

CVE-2026-4700 — Mozilla Firefox: Mitigation bypass in the Networking: HTTP component.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4700

Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. CVSSv3.1 9.8 (CRITICAL)

CWECWE 288VNDMozillaVNDMitigationTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-03-24
2026-03-24 13:16Z
CRIT

CVE-2026-4698 — Mozilla Firefox: JIT miscompilation in the JavaScript Engine: JIT component.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4698

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. CVSSv3.1 9.8 (CRITICAL)

CWECWE 843VNDMozillaVNDJitTYPVulnerability
9.8
CVSS v3.1
99
Edit Score