v3.4.0.51
Mythic releases·github.com
Mythic v3.4.0.51 released with a Dockerfile tag bump to match the release version. No detailed changelog or feature/fix information is provided in the release notes.
15
Edit Score
Latest intel// live feed
25 results//sorted by published//last sync 2026-10-14 03:32Z
CVE-2026-4404 — Linuxfoundation Harbor: Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers
Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI. CVSSv3.1 9.4 (CRITICAL) · EPSS 40th percentile
9.4
CVSS v3.1
97
Edit Score
Discovering Unexpected Okta Attack Paths with BloodHound
SpecterOps·specterops.io
SpecterOps released OktaHound, a BloodHound data collector for Okta that maps identity entities, roles, policies, and trust relationships to discover attack paths and privilege escalation vectors. The tool extends BloodHound's graph analysis to hybrid environments, revealing misconfigurations in Okta RBAC, SCIM password sync abuse, SWA credential exposure, and dangerous AD agent deployments that grant Domain Admin privileges.
82
Edit Score
v3.4.0.50
Mythic releases·github.com
Mythic v3.4.0.50 released with a Dockerfile tag bump to match the release version. No detailed changelog or feature/fix information is provided in the GitHub release page.
15
Edit Score
CVE-2026-31851 — Nexxtsolutions Nebula300plus_firmware: Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 does not implement rate limiting or
Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 does not implement rate limiting or account lockout mechanisms on authentication interfaces. An attacker can perform unlimited authentication attempts against endpoints that rely on credential validation, enabling brute-force attacks to guess administrative credentials without restriction. CVSSv3.1 9.8 (CRITICAL) · EPSS 11th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2026-31848 — Nexxtsolutions Nebula300plus_firmware: This allows unauthorized administrative access to protected endpoints.
Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 uses the ecos_pw cookie for authentication, which contains Base64-encoded credential data combined with a static suffix. Because the encoding is reversible and lacks integrity protection, an attacker can reconstruct or forge a valid cookie value without proper authentication. This allows unauthorized administrative access to protected endpoints. CVSSv3.1 9.8 (CRITICAL) · EPSS 7th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2026-31847 — Nexxtsolutions Nebula300plus_firmware: Hidden functionality in the /goform/setSysTools endpoint in Nexxt Solutions Nebula 300+ firmware through version
Hidden functionality in the /goform/setSysTools endpoint in Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 allows remote enablement of a Telnet service. By sending a crafted POST request with parameters such as telnetManageEn=true and telnetPwd, an authenticated attacker can activate a Telnet service on port 23. This exposes a privileged diagnostic interface that is not intended for external access and can be used to interact with the underlying system. CVSSv3.1 8.8 (HIGH) · EPSS 10th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2026-4585 — The manipulation of the argument File leads to os command injection.
A vulnerability has been found in Tiandy Easy7 Integrated Management Platform up to 7.17.0. This vulnerability affects unknown code of the file /Easy7/apps/WebService/ImportSystemConfiguration.jsp of the component Configuration Handler. The manipulation of the argument File leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond i CVSSv3.1 9.8 (CRITICAL) · EPSS 44th percentile
9.8
CVSS v3.1
99
Edit Score
entra-ca-insight — Discover gaps in Entra Conditional Access policies before attackers do
GitHub · Azure / Entra tools·github.comGITHUB POC
entra-ca-insight is a proactive gap-detection tool for Microsoft Entra Conditional Access policies that enumerates all possible access combinations and evaluates them offline against tenant policy configurations. Unlike reactive log-based approaches, it discovers unused gaps before exploitation by analyzing identity types, applications, platforms, locations, and client types to identify scenarios where no strong control (MFA, Auth Strength, or block) is enforced.
78
Edit Score
CVE-2026-4601 — Jsrsasign_project Jsrsasign: Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via
Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private key by forcing r or s to be zero, so the library emits an invalid signature without retrying, and then solves for x from the resulting signature. CVSSv3.1 8.7 (HIGH) · EPSS 4th percentile
8.7
CVSS v3.1
94
Edit Score
CVE-2026-4599 — Kjur Jsrsasign: Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete
Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions in src/crypto-1.1.js; an attacker can recover the private key by exploiting the incorrect compareTo checks that accept out-of-range candidates and thus bias DSA nonces during signature generation. CVSSv3.1 9.1 (CRITICAL) · EPSS 26th percentile
9.1
CVSS v3.1
96
Edit Score
CVE-2026-4566 — Belkin F9k1122_firmware: Executing a manipulation of the argument webpage can lead to stack-based buffer overflow.
A flaw has been found in Belkin F9K1122 1.00.33. The affected element is the function formWISP5G of the file /goform/formWISP5G. Executing a manipulation of the argument webpage can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. CVSSv3.1 8.8 (HIGH) · EPSS 17th percentile
8.8
CVSS v3.1
94
Edit Score
NICKEL ALLEY strategy: Fake it 'til you make it
Sophos X-Ops·news.sophos.comin the wild
Sophos CTU researchers document NICKEL ALLEY (North Korean state-sponsored threat group) conducting sustained social engineering campaigns targeting software developers through fake job postings, LinkedIn profiles, and GitHub repositories. The group delivers PyLangGhost RAT and BeaverTail malware via ClickFix tactics, malicious npm packages, and VS Code task automation, with primary objectives of cryptocurrency theft and supply-chain compromise. Active campaigns observed throughout 2025 demonstrate the group's operational maturity and infrastructure agility, leveraging Vercel for payload hosting and rotating staging domains.
78
Edit Score
Oracle vulnerability (CVE-2026-21992) impacts core products
Oracle disclosed CVE-2026-21992, a critical vulnerability (CVSS 9.8) affecting Oracle Identity Manager and Oracle Web Services Manager in Fusion Middleware. Unauthenticated attackers can achieve remote code execution via HTTP due to missing network-level authentication. No active exploitation reported as of publication.
72
Edit Score
CVE-2026-4558 — Linksys Mr9600_firmware: Executing a manipulation of the argument configApSsid/configApPassphrase/srpLogin/srpPassword can lead to os command injection.
A flaw has been found in Linksys MR9600 2.0.6.206937. Affected is the function smartConnectConfigure of the file SmartConnect.lua. Executing a manipulation of the argument configApSsid/configApPassphrase/srpLogin/srpPassword can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. CVSSv3.1 8.8 (HIGH) · EPSS 49th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2026-4314 — Ultimate: The 'The Ultimate WordPress Toolkit – WP Extended' plugin for WordPress is vulnerable to
The 'The Ultimate WordPress Toolkit – WP Extended' plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.4. This is due to the `isDashboardOrProfileRequest()` method in the Menu Editor module using an insecure `strpos()` check against `$_SERVER['REQUEST_URI']` to determine if a request targets the dashboard or profile page. The `grantVirtualCaps()` method, which is hooked into the `user_has_cap` filter, grants elevated capabiliti CVSSv3.1 8.8 (HIGH) · EPSS 14th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2026-4529 — Dlink Dhp-1320_firmware: Such manipulation leads to stack-based buffer overflow.
A vulnerability was identified in D-Link DHP-1320 1.00WWB04. This affects the function redirect_count_down_page of the component SOAP Handler. Such manipulation leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. This vulnerability only affects products that are no longer supported by the maintainer. CVSSv3.1 8.8 (HIGH) · EPSS 18th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2026-3629 — Import: The Import and export users and customers plugin for WordPress is vulnerable to privilege
The Import and export users and customers plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.29.7. This is due to the 'save_extra_user_profile_fields' function not properly restricting which user meta keys can be updated via profile fields. The 'get_restricted_fields' method does not include sensitive meta keys such as 'wp_capabilities'. This makes it possible for unauthenticated attackers to escalate their privileges to Adminis CVSSv3.1 8.1 (HIGH) · EPSS 24th percentile
8.1
CVSS v3.1
91
Edit Score
CVE-2019-25580 — Owndms Owndms: 4.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary
ownDMS 4.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the IMG parameter. Attackers can send GET requests to pdfstream.php, imagestream.php, or anyfilestream.php with crafted SQL payloads in the IMG parameter to extract sensitive database information including version and database names. CVSSv3.1 8.2 (HIGH) · EPSS 23th percentile
8.2
CVSS v3.1
91
Edit Score
CVE-2019-25578 — Codnloc Phptransformer: 2016.9 contains an SQL injection vulnerability that allows remote attackers to execute arbitrary
phpTransformer 2016.9 contains an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through the idnews parameter. Attackers can send crafted GET requests to GeneratePDF.php with SQL payloads in the idnews parameter to extract sensitive database information or manipulate queries. CVSSv3.1 8.2 (HIGH) · EPSS 29th percentile
8.2
CVSS v3.1
91
Edit Score
CVE-2026-4261 — Expire: The Expire Users plugin for WordPress is vulnerable to Privilege Escalation in all versions
The Expire Users plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.2. This is due to the plugin allowing a user to update the 'on_expire_default_to_role' meta through the 'save_extra_user_profile_fields' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator. CVSSv3.1 8.8 (HIGH) · EPSS 16th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2026-3334 — CMS: The CMS Commander plugin for WordPress is vulnerable to SQL Injection via the 'or_blogname'
The CMS Commander plugin for WordPress is vulnerable to SQL Injection via the 'or_blogname', 'or_blogdescription', and 'or_admin_email' parameters in all versions up to, and including, 2.288. This is due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL queries in the restore workflow. This makes it possible for authenticated attackers, with CMS Commander API key access, to append additional SQL queries into alread CVSSv3.1 8.8 (HIGH) · EPSS 11th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2026-2941 — Linksy: The Linksy Search and Replace plugin for WordPress is vulnerable to unauthorized modification of
The Linksy Search and Replace plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'linksy_search_and_replace_item_details' function in all versions up to, and including, 1.0.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to update any database table, any value, including the wp_capabilities database field, which allows attackers to change their own role to administrato CVSSv3.1 8.8 (HIGH) · EPSS 16th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2026-33243 — Pengutronix Barebox: However, hashed-nodes itself is not part of the hash and could therefore be modified
barebox is a bootloader. In barebox from version 2016.03.0 to before version 2026.03.1 (and the corresponding backport to 2025.09.3), an attacker could exploit a FIT signature verification vulnerability to trick the bootloader into booting different images than those that were verified as part of a signed configuration. mkimage(1) sets the hashed-nodes property of the FIT signature node to list which nodes of the FIT were hashed as part of the signing process as these will ne CVSSv3.1 8.2 (HIGH) · EPSS 1th percentile
8.2
CVSS v3.1
91
Edit Score
CVE-2026-33236 — Nltk Nltk: Attackers can control a remote XML index server to provide malicious values containing path
NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, the NLTK downloader does not validate the `subdir` and `id` attributes when processing remote XML index files. Attackers can control a remote XML index server to provide malicious values containing path traversal sequences (such as `../`), which can lead to arbitrary directory creati CVSSv3.1 8.1 (HIGH)
8.1
CVSS v3.1
91
Edit Score