opsecsafe — cyber intelligence

2026-03-19

2026-03-19 18:16Z

CRIT

CVE-2026-3548 — Wolfssl Wolfssl: Two buffer overflow vulnerabilities existed in the wolfSSL CRL parser when parsing CRL numbers

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-3548

Two buffer overflow vulnerabilities existed in the wolfSSL CRL parser when parsing CRL numbers: a heap-based buffer overflow could occur when improperly storing the CRL number as a hexadecimal string, and a stack-based overflow for sufficiently sized CRL numbers. With appropriately crafted CRLs, either of these out of bound writes could be triggered. Note this only affects builds that specifically enable CRL support, and the user would need to load a CRL from an untrusted sou CVSSv3.1 9.8 (CRITICAL) · EPSS 6th percentile

CWECWE 787CWECWE 122VNDWolfsslVNDTwoTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-03-19

2026-03-19 18:16Z

HIGH

CVE-2026-2646 — Wolfssl Wolfssl: A heap-buffer-overflow vulnerability exists in wolfSSL's wolfSSL_d2i_SSL_SESSION() function.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-2646

A heap-buffer-overflow vulnerability exists in wolfSSL's wolfSSL_d2i_SSL_SESSION() function. When deserializing session data with SESSION_CERTS enabled, certificate and session id lengths are read from an untrusted input without bounds validation, allowing an attacker to overflow fixed-size buffers and corrupt heap memory. A maliciously crafted session would need to be loaded from an external source to trigger this vulnerability. Internal sessions were not vulnerable. CVSSv3.1 8.1 (HIGH) · EPSS 3th percentile

CWECWE 787CWECWE 122VNDWolfsslTYPVulnerability

8.1

CVSS v3.1

Edit Score

2026-03-19

2026-03-19 16:00Z

CRIT

Graph the Planet: Shai-Hulud 2.0

SpecterOps·specterops.ioin the wild

SpecterOps analyzes the Shai-Hulud 2.0 worm supply-chain attack through an attack path management lens, decomposing how attackers exploited GitHub PWN requests to harvest credentials, weaponized NPM tokens to infect packages, and propagated malware across 13.7k public repositories. The post introduces NPMHound, a BloodHound OpenGraph extension for modeling NPM dependency chains and semantic versioning attack surfaces, and SecretHound for tracking credential exposure in organizational graphs.

TACTA0001TACTA0006TACTA0007SRFCloudTACTA0009SRFSupply ChainVNDGithubVNDPosthog

Edit Score

2026-03-19

2026-03-19 15:16Z

HIGH

CVE-2026-30711 — Devome: GRR v4.5.0 was discovered to contain multiple authenticated SQL injection vulnerabilities in the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-30711

Devome GRR v4.5.0 was discovered to contain multiple authenticated SQL injection vulnerabilities in the include/session.inc.php file via the referer and user-agent. CVSSv3.1 8.8 (HIGH) · EPSS 12th percentile

CWECWE 89VNDDevomeTYPVulnerability

8.8

CVSS v3.1

Edit Score

2026-03-19

2026-03-19 15:16Z

CRIT

CVE-2026-22557 — A malicious actor with access to the network could exploit a Path Traversal vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-22557

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in the UniFi Network Application to access files on the underlying system that could be manipulated to access an underlying account. CVSSv3.1 10.0 (CRITICAL) · EPSS 10th percentile

CWECWE 22TYPVulnerability

10.0

CVSS v3.1

100

Edit Score

2026-03-19

2026-03-19 14:45Z

INFO

v2.11.0-rc2

AzureHound releases·github.com

AzureHound v2.11.0-rc2 released with a bug fix addressing tenant information handling in application-specific configurations to ensure correct name construction. This is a pre-release candidate containing 13 commits since the previous RC1.

SRFIdentitySRFCloudVNDSpecteropsVNDMicrosoft AzureTYPTool

Edit Score

2026-03-19

2026-03-19 14:16Z

HIGH

CVE-2025-71260 — Bmc Footprints: ITSM versions 20.20.02 through 20.24.01.001 contain a deserialization of untrusted data vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-71260

BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a deserialization of untrusted data vulnerability in the ASP.NET servlet's VIEWSTATE handling that allows authenticated attackers to execute arbitrary code. Attackers can supply crafted serialized objects to the VIEWSTATE parameter to achieve remote code execution and fully compromise the application. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22. CVSSv3.1 8.8 (HIGH) · EPSS 98th percentile

CWECWE 502VNDBmcTYPVulnerability

8.8

CVSS v3.1

100

Edit Score

2026-03-19

2026-03-19 14:16Z

MED

CVE-2025-71259 — Bmc Footprints: ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-71259

BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the externalfeed/RSS API component that allows authenticated attackers to trigger arbitrary outbound requests from the server. Attackers can exploit insufficient validation of externally supplied resource references to interact with internal services or cause resource exhaustion impacting availability. The following hotfixes remediate the vulnerability: 20.2 CVSSv3.1 4.3 (MEDIUM) · EPSS 96th percentile

CWECWE 918VNDBmcTYPVulnerability

4.3

CVSS v3.1

Edit Score

2026-03-19

2026-03-19 14:16Z

MED

CVE-2025-71258 — Bmc Footprints: ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-71258

BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the searchWeb API component that allows authenticated attackers to cause the server to initiate arbitrary outbound requests. Attackers can exploit improper URL validation to perform internal network scanning or interact with internal services, impacting system availability. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01. CVSSv3.1 4.3 (MEDIUM) · EPSS 97th percentile

CWECWE 918VNDBmcTYPVulnerability

4.3

CVSS v3.1

Edit Score

2026-03-19

2026-03-19 12:16Z

CRIT

CVE-2006-10003 — Toddr Xml\: XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2006-10003

XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack. In the case (stackptr == stacksize - 1), the stack will NOT be expanded. Then the new value will be written at location (++stackptr), which equals stacksize and therefore falls just outside the allocated buffer. The bug can be observed when parsing an XML file with very deep element nesting CVSSv3.1 9.8 (CRITICAL)

CWECWE 122CWECWE 193VNDToddrTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-03-19

2026-03-19 09:16Z

CRIT

CVE-2026-27067 — Upload: Unrestricted Upload of File with Dangerous Type vulnerability in Syarif Mobile App Editor mobile-app-editor

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-27067

Unrestricted Upload of File with Dangerous Type vulnerability in Syarif Mobile App Editor mobile-app-editor allows Upload a Web Shell to a Web Server.This issue affects Mobile App Editor: from n/a through <= 1.3.1. CVSSv3.1 9.1 (CRITICAL)

CWECWE 434TYPVulnerability

9.1

CVSS v3.1

Edit Score

2026-03-19

2026-03-19 09:16Z

CRIT

CVE-2026-27065 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-27065

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress BuilderPress builderpress allows PHP Local File Inclusion.This issue affects BuilderPress: from n/a through <= 2.0.1. CVSSv3.1 9.8 (CRITICAL)

CWECWE 98TYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-03-19

2026-03-19 09:16Z

HIGH

CVE-2026-25445 — Deserialization: of Untrusted Data vulnerability in Membership Software WishList Member X wishlist-member-x allows Object

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-25445

Deserialization of Untrusted Data vulnerability in Membership Software WishList Member X wishlist-member-x allows Object Injection.This issue affects WishList Member X: from n/a through <= 3.29.0. CVSSv3.1 8.8 (HIGH)

CWECWE 502TYPVulnerability

8.8

CVSS v3.1

Edit Score

2026-03-19

2026-03-19 09:16Z

CRIT

CVE-2025-60237 — Deserialization: of Untrusted Data vulnerability in Themeton Finag finag allows Object Injection.This issue affects

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-60237

Deserialization of Untrusted Data vulnerability in Themeton Finag finag allows Object Injection.This issue affects Finag: from n/a through <= 1.5.0. CVSSv3.1 9.8 (CRITICAL)

CWECWE 502TYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-03-19

2026-03-19 09:16Z

CRIT

CVE-2025-60233 — Deserialization: of Untrusted Data vulnerability in Themeton Zuut zuut allows Object Injection.This issue affects

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-60233

Deserialization of Untrusted Data vulnerability in Themeton Zuut zuut allows Object Injection.This issue affects Zuut: from n/a through <= 1.4.2. CVSSv3.1 9.8 (CRITICAL)

CWECWE 502TYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-03-19

2026-03-19 08:16Z

HIGH

CVE-2026-25471 — Authentication: Bypass Using an Alternate Path or Channel vulnerability in Themepaste Admin Safety Guard

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-25471

Authentication Bypass Using an Alternate Path or Channel vulnerability in Themepaste Admin Safety Guard admin-safety-guard allows Password Recovery Exploitation.This issue affects Admin Safety Guard: from n/a through <= 1.2.7. CVSSv3.1 8.1 (HIGH)

CWECWE 288TYPVulnerability

8.1

CVSS v3.1

Edit Score

2026-03-19

2026-03-19 07:15Z

HIGH

CVE-2026-27093 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-27093

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme Tripgo tripgo allows PHP Local File Inclusion.This issue affects Tripgo: from n/a through < 1.5.6. CVSSv3.1 8.1 (HIGH)

CWECWE 98TYPVulnerability

8.1

CVSS v3.1

Edit Score

2026-03-19

2026-03-19 06:16Z

CRIT

CVE-2026-27542 — Incorrect: Privilege Assignment vulnerability in Rymera Web Co Pty Ltd.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-27542

Incorrect Privilege Assignment vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture woocommerce-wholesale-lead-capture allows Privilege Escalation.This issue affects Woocommerce Wholesale Lead Capture: from n/a through <= 2.0.3.1. CVSSv3.1 9.8 (CRITICAL) · EPSS 1th percentile

CWECWE 266TYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-03-19

2026-03-19 06:16Z

CRIT

CVE-2026-27540 — Upload: Woocommerce Wholesale Lead Capture woocommerce-wholesale-lead-capture allows Using Malicious Files.This issue affects Woocommerce Wholesale Lead

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-27540

Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture woocommerce-wholesale-lead-capture allows Using Malicious Files.This issue affects Woocommerce Wholesale Lead Capture: from n/a through <= 2.0.3.1. CVSSv3.1 9.0 (CRITICAL) · EPSS 1th percentile

CWECWE 434TYPVulnerability

9.0

CVSS v3.1

Edit Score

2026-03-19

2026-03-19 06:16Z

CRIT

CVE-2026-27413 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-27413

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozmoslabs Profile Builder Pro profile-builder-pro allows Blind SQL Injection.This issue affects Profile Builder Pro: from n/a through < 3.14.0. CVSSv3.1 9.3 (CRITICAL)

CWECWE 89TYPVulnerability

9.3

CVSS v3.1

Edit Score

2026-03-19

2026-03-19 06:16Z

HIGH

CVE-2026-27096 — Deserialization: of Untrusted Data vulnerability in BuddhaThemes ColorFolio - Freelance Designer WordPress Theme colorfolio

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-27096

Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio - Freelance Designer WordPress Theme colorfolio allows Object Injection.This issue affects ColorFolio - Freelance Designer WordPress Theme: from n/a through <= 1.3. CVSSv3.1 8.1 (HIGH)

CWECWE 502TYPVulnerability

8.1

CVSS v3.1

Edit Score

2026-03-19

2026-03-19 00:00Z

HIGH

From Invitation to Infection: How SILENTCONNECT Delivers ScreenConnect

Elastic Security Labs·elastic.coin the wild

Elastic Security Labs disclosed SILENTCONNECT, a multi-stage .NET loader actively deployed in-the-wild since March 2025 that silently installs ConnectWise ScreenConnect RMM via phishing campaigns. The infection chain leverages VBScript, PowerShell, PEB masquerading, UAC bypass via COM elevation, and Windows Defender exclusions to evade detection and establish persistent hands-on-keyboard access. Campaigns abuse Cloudflare Turnstile CAPTCHAs, Google Drive, and compromised legitimate websites as infrastructure to deliver the payload.

SRFApplicationSRFOsTACTA0005TACTA0001TACTA0011VNDMicrosoftVNDGoogleVNDCloudflare

Edit Score

2026-03-19

2026-03-19 00:00Z

CRIT

Android devices ship with firmware-level malware

Sophos X-Ops·news.sophos.comin the wild

Sophos and Kaspersky identified Keenadu, a firmware-level backdoor pre-installed on Android devices from budget manufacturers (BLU, Ulefone, DOOGEE, etc.) affecting 500+ devices across 40 countries. The malware injects into libandroid_runtime.so via the Zygote process, achieving persistence across all apps and enabling second-stage payload delivery for ad fraud, credential theft, and data exfiltration. The compromise occurred at the firmware build phase, indicating a supply-chain attack at the OEM level.

SRFOsTACTA0005SRFMobileTACTA0001SRFFirmwareTACTA0007TACTA0003TACTA0011

Edit Score

2026-03-19

2026-03-19 00:00Z

HIGH

Copyright Lures Mask a Multi‑Stage PureLog Stealer Attack on Key Industries

Trend Micro Research·trendmicro.comin the wild

Trend Micro researchers documented a targeted multi-stage PureLog Stealer campaign using localized copyright-violation lures to deliver information-stealing malware to healthcare, government, hospitality, and education sectors across Germany, Canada, the US, and Australia. The attack chain employs encrypted payloads, remote key retrieval, renamed WinRAR for extraction, Python-based loaders, and fileless .NET execution with AMSI bypass and anti-VM evasion. Two operational variants were identified, with the more recent chain using pre-bundled payloads and hardcoded decryption keys, while earlier variants relied on live C&C communication.

SRFApplicationSRFOsTACTA0005TACTA0001TACTA0002TACTA0007SRFWebTACTA0003

Edit Score

2026-03-19

2026-03-19 00:00Z

HIGH

From Invitation to Infection: How SILENTCONNECT Delivers ScreenConnect

Elastic Security Labs·elastic.coin the wild

Elastic Security Labs disclosed SILENTCONNECT, a previously undocumented multi-stage loader actively deployed in-the-wild since March 2025 that delivers ConnectWise ScreenConnect RMM for hands-on keyboard access. The infection chain begins with phishing emails directing users to Cloudflare Turnstile CAPTCHA pages, followed by VBScript execution that downloads and compiles C# code in-memory via PowerShell, ultimately installing ScreenConnect via MSI. The loader employs PEB masquerading, UAC bypass via COM elevation, Windows Defender exclusion, and NT API calls to evade detection while leveraging trusted infrastructure (Google Drive, Cloudflare) for payload hosting.

SRFApplicationTACTA0005TACTA0001SRFNetworkTACTA0011OSWindowsSWScreenconnectVNDConnectwise

Edit Score

Latest intel// live feed

CVE-2026-3548 — Wolfssl Wolfssl: Two buffer overflow vulnerabilities existed in the wolfSSL CRL parser when parsing CRL numbers

CVE-2026-2646 — Wolfssl Wolfssl: A heap-buffer-overflow vulnerability exists in wolfSSL's wolfSSL_d2i_SSL_SESSION() function.

Graph the Planet: Shai-Hulud 2.0

CVE-2026-30711 — Devome: GRR v4.5.0 was discovered to contain multiple authenticated SQL injection vulnerabilities in the

CVE-2026-22557 — A malicious actor with access to the network could exploit a Path Traversal vulnerability

v2.11.0-rc2

CVE-2025-71260 — Bmc Footprints: ITSM versions 20.20.02 through 20.24.01.001 contain a deserialization of untrusted data vulnerability

CVE-2025-71259 — Bmc Footprints: ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability

CVE-2025-71258 — Bmc Footprints: ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability

CVE-2006-10003 — Toddr Xml\: XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack.

CVE-2026-27067 — Upload: Unrestricted Upload of File with Dangerous Type vulnerability in Syarif Mobile App Editor mobile-app-editor

CVE-2026-27065 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

CVE-2026-25445 — Deserialization: of Untrusted Data vulnerability in Membership Software WishList Member X wishlist-member-x allows Object

CVE-2025-60237 — Deserialization: of Untrusted Data vulnerability in Themeton Finag finag allows Object Injection.This issue affects

CVE-2025-60233 — Deserialization: of Untrusted Data vulnerability in Themeton Zuut zuut allows Object Injection.This issue affects

CVE-2026-25471 — Authentication: Bypass Using an Alternate Path or Channel vulnerability in Themepaste Admin Safety Guard

CVE-2026-27093 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

CVE-2026-27542 — Incorrect: Privilege Assignment vulnerability in Rymera Web Co Pty Ltd.

CVE-2026-27540 — Upload: Woocommerce Wholesale Lead Capture woocommerce-wholesale-lead-capture allows Using Malicious Files.This issue affects Woocommerce Wholesale Lead

CVE-2026-27413 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

CVE-2026-27096 — Deserialization: of Untrusted Data vulnerability in BuddhaThemes ColorFolio - Freelance Designer WordPress Theme colorfolio

From Invitation to Infection: How SILENTCONNECT Delivers ScreenConnect

Android devices ship with firmware-level malware

Copyright Lures Mask a Multi‑Stage PureLog Stealer Attack on Key Industries

From Invitation to Infection: How SILENTCONNECT Delivers ScreenConnect