Heap buffer overflow in the Audio/Video: Playback component in Firefox for Android. This vulnerability was fixed in Firefox 148.0.2. CVSSv3.1 8.8 (HIGH)
Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 on Linux contains a SQL Injection vulnerability (CWE-89) in the system configuration module. A remote attacker can send specially crafted HTTP POST requests to the /php/request.php endpoint via the sql parameter in application/x-www-form-urlencoded data (e.g., action=do&sql=<query_here>&reload_driver=0) to execute arbitrary SQL commands and potentially achieve remote code execution. CVSSv3.1 9.8 (CRITICAL) · EPSS 39th percentile
OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, OneUptime Synthetic Monitors allow a low-privileged authenticated project user to execute arbitrary commands on the oneuptime-probe server/container. The root cause is that untrusted Synthetic Monitor code is executed inside Node's vm while live host-realm Playwright browser and page objects are exposed to it. A malicious user can call Playwright APIs on the injected browser object and caus CVSSv3.1 9.9 (CRITICAL)
OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, a low‑privileged user can bypass authorization and tenant isolation in OneUptime v10.0.20 and earlier by sending a forged is-multi-tenant-query header together with a controlled projectid header. Because the server trusts this client-supplied header, internal permission checks in BasePermission are skipped and tenant scoping is disabled. This allows attackers to access project data belongin CVSSv3.1 9.9 (CRITICAL) · EPSS 39th percentile
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, The TimescaleDB export module constructs SQL queries using string concatenation with unsanitized system monitoring data. The normalize() method wraps string values in single quotes but does not escape embedded single quotes, making SQL injection trivial via attacker-controlled data such as process names, filesystem mount points, network interface names, or container names. This vulnerability is f CVSSv3.1 9.8 (CRITICAL) · EPSS 9th percentile
Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally. CVSSv3.1 8.4 (HIGH) · EPSS 19th percentile
In the Linux kernel, the following vulnerability has been resolved: tls: Fix race condition in tls_sw_cancel_work_tx() This issue was discovered during a code audit. After cancel_delayed_work_sync() is called from tls_sk_proto_close(), tx_work_handler() can still be scheduled from paths such as the Delayed ACK handler or ksoftirqd. As a result, the tx_work_handler() worker may dereference a freed TLS object. The following is a simple race scenario: cpu0 CVSSv3.1 9.8 (CRITICAL) · EPSS 19th percentile
A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiSwitchAXFixed 1.0.0 through 1.0.1 may allow an unauthenticated attacker within the same adjacent network to execute unauthorized code or commands on the device via sending a crafted LLDP packet. CVSSv3.1 8.8 (HIGH)
Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network. CVSSv3.1 8.8 (HIGH) · EPSS 79th percentile
Incorrect Access Control via missing 2FA rate-limiting allowing unlimited brute-force retries and full MFA bypass with no user interaction required. Affected Product: Deutsche Telekom AG Telekom Account Management Portal, versions before 2025-10-24, fixed 2025-11-03. CVSSv3.1 9.1 (CRITICAL) · EPSS 3th percentile
Incorrect Access Control via activation token reuse on the password-reset endpoint allowing unauthorized password resets and full account takeover. Affected Product: Deutsche Telekom AG Telekom Account Management Portal, versions before 2025-10-27, fixed 2025-10-31. CVSSv3.1 9.4 (CRITICAL) · EPSS 6th percentile
A deserialization vulnerability in LimeSurvey before v6.15.0+250623 allows a remote attacker to execute arbitrary code on the server. CVSSv3.1 9.8 (CRITICAL) · EPSS 55th percentile
USBArmyKnife is a comprehensive open-source physical access toolkit built on ESP32-S3 hardware that combines BadUSB HID attacks, mass storage emulation, network device spoofing, WiFi/Bluetooth exploitation, and post-exploitation capabilities including screen capture and audio recording. The tool supports multiple affordable hardware platforms (LilyGo T-Dongle S3, Evil Crow Cable, smartwatches) and provides a web-based UI for attack orchestration via DuckyScript with custom extensions.
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6, including 9.3.x and 8.3.x, do not restrict Groovy scripts in new PRPT reports published by users, allowing insertion of arbitrary scripts and leading to a RCE. CVSSv3.1 9.1 (CRITICAL) · EPSS 5th percentile
SpecterOps published a comprehensive development guide for Nemesis 2.X, a file enrichment and credential harvesting platform. The guide covers extending Nemesis through custom enrichment modules (with both manual and AI-assisted approaches via Claude Code/Codex), adding Yara/Nosey Parker detection rules, and building C2 connectors to ingest operator downloads.
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, an integer overflow in DIB coder can result in out of bounds read or write. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41. CVSSv3.1 8.1 (HIGH)
Trend Micro's MDR investigation documents an active KongTuke campaign delivering modeloRAT through compromised WordPress sites injected with malicious JavaScript that triggers fake CAPTCHA lures and PowerShell execution. The group abuses legitimate Windows tools (finger.exe), Dropbox-hosted payloads, and portable Python environments to establish persistence via registry Run keys and scheduled tasks, while employing 32-layer obfuscation and anti-analysis checks targeting enterprise domain-joined systems. The campaign operates in parallel with the newer CrashFix browser-extension technique, demonstrating a modular, scalable operation with ongoing infrastructure activity.
Trend Micro analyzes OpenClaw, a locally-hosted sovereign AI agent built on Anthropic's Claude that executes terminal commands with user privileges and maintains persistent memory. The research identifies critical attack vectors including indirect prompt injection via messaging apps, time-shifted attacks through persistent JSON storage, and the Moltbook database breach exposing 1.5M API tokens. The paper argues that current deployment practices lack essential controls: sandboxing, human-in-the-loop confirmation, and input/output guardrails against injection attacks.
A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/rewrite-target` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.) CVSSv3.1 8.8 (HIGH) · EPSS 16th percentile
A command injection vulnerability was identified in the web module of Archer AXE75 v1.6/v1.0 router. An authenticated attacker with adjacent-network access may be able to perform remote code execution (RCE) when the router is configured with sysmode=ap. Successful exploitation results in root-level privileges and impacts confidentiality, integrity and availability of the device. This issue affects Archer AXE75 v1.6/v1.0: through 1.3.2 Build 20250107. CVSSv3.1 8.0 (HIGH)
Bishop Fox disclosed practical exploitation of CVE-2026-21643, a pre-authentication SQL injection in FortiClient EMS 7.4.4 affecting multi-tenant deployments. The vulnerability exists in the SiteMiddleware layer where unsanitized HTTP Site headers are interpolated directly into PostgreSQL SET search_path statements before authentication checks. Attackers can achieve arbitrary SQL execution, credential theft, endpoint data exfiltration, and RCE via the unauthenticated /api/v1/init_consts endpoint with no rate limiting.
A SQL injection vulnerability has been found in Eventobot. This vulnerability allows an attacker to retrieve, create, update and delete databases through the 'promo_send' parameter in the '/assets/php/calculate_discount.php'. CVSSv3.1 9.8 (CRITICAL) · EPSS 23th percentile
EHG2408 series switch developed by Atop Technologies has a Stack-based Buffer Overflow vulnerability, allowing unauthenticated remote attackers to control the program's execution flow and execute arbitrary code. CVSSv3.1 9.8 (CRITICAL) · EPSS 48th percentile
Trend Micro researchers demonstrated two novel attack vectors against AI systems at [un]prompted 2026: (1) exploiting AI-driven KYC pipelines by embedding malicious instructions in documents to trick AI agents into reading/writing across customer records, and (2) FENRIR, an automated vulnerability discovery system that has identified 60+ published CVEs and 100+ pre-disclosure vulnerabilities in AI/MCP ecosystems. The research frames documents as executable attack surfaces when AI agents can read and invoke tools, fundamentally shifting the threat model for document-processing pipelines.
A comprehensive curated repository of Linux kernel exploitation research, techniques, and tools maintained by Andrey Konovalov. The collection spans 15+ years of kernel pwning primitives including heap feng shui, use-after-free exploitation, KASLR bypasses, control-flow hijacking, and defense evasion methods, with bimonthly updates covering both academic papers and practical CTF/real-world exploits.