Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-14 14:52Z
2026-03-05
2026-03-05 00:00Z
HIGH

Hooked on Linux: Rootkit Taxonomy, Hooking Techniques and Tradecraft

Elastic Security Labs·elastic.coCVE-2022-0847

Elastic Security Labs publishes a comprehensive two-part research series on Linux rootkit taxonomy, evolution, and hooking techniques. Part one traces rootkit development from early 2000s userland LD_PRELOAD techniques through LKM-based syscall hooking, eBPF-based in-kernel bytecode injection, and emerging io_uring-based evasion methods. The article details loader and payload components, hooking primitives (IDT, syscall table, ftrace, LSM hooks), and real-world examples including Diamorphine, Reptile, Triple Cross, Boopkit, and RingReaper.

SRFOsTACTA0005TACTA0003OSLinuxTYPResearchSTGDefense EvasionSTGPersistenceTECT1547
82
Edit Score
2026-03-04
2026-03-04 23:00Z
HIGH

Bypassing debug password protection on the RH850 family using fault injection

Quarkslab·blog.quarkslab.com

Quarkslab researchers demonstrated reliable voltage fault injection attacks to bypass 16-byte IDCODE debug password protection on Renesas RH850 automotive microcontrollers. Using power analysis to identify a consistent trigger pattern, they achieved reproducible attacks in ~1 minute on development boards and real ECUs, and validated the attack with budget DIY hardware (Pico Glitcher v3, €30-50).

SRFFirmwareSRFHardwareVNDRenesasTYPResearchTYPExploitSTGDefense EvasionSTGInitial AccessTECT1552
82
Edit Score
2026-03-04
2026-03-04 22:16Z
CRIT

CVE-2026-29000 — pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-29000

pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication tokens. Attackers who possess the server's RSA public key can create a JWE-wrapped PlainJWT with arbitrary subject and role claims, bypassing signature verification to authenticate as any user including administrators. CVSSv3.1 9.1 (CRITICAL) · EPSS 92th percentile

CWECWE 347TYPVulnerability
9.1
CVSS v3.1
97
Edit Score
2026-03-04
2026-03-04 22:16Z
CRIT

CVE-2025-66024 — Xwiki Blog_application: The XWiki blog application allows users of the XWiki platform to create and manage

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-66024

The XWiki blog application allows users of the XWiki platform to create and manage blog posts. Versions starting with 9.15 and prior to 9.15.7 are vulnerable to Stored Cross-Site Scripting (XSS) via the Blog Post Title. The vulnerability arises because the post title is injected directly into the HTML <title> tag without proper escaping. An attacker with permissions to create or edit blog posts can inject malicious JavaScript into the title field. This script will execute in CVSSv3.1 9.0 (CRITICAL) · EPSS 28th percentile

CWECWE 79VNDXwikiTYPVulnerability
9.0
CVSS v3.1
95
Edit Score
2026-03-04
2026-03-04 21:19Z
HIGH

BadZure — BadZure automates the deployment of intentionally misconfigured Entra ID tenants and Azure subscriptions, populating the

GitHub · Azure / Entra tools·github.comGITHUB POC

BadZure is a Python-based automation tool that deploys intentionally misconfigured Entra ID tenants and Azure subscriptions with realistic permission sprawl and seven distinct privilege escalation attack paths spanning identity and infrastructure layers. The tool enables red teams, blue teams, and security practitioners to simulate post-compromise Azure attacks, develop detection controls, and conduct purple team exercises without requiring initial access simulation.

TACTA0004TACTA0005SRFIdentitySRFCloudVNDMicrosoftVNDAzureTYPResearchTYPTool
82
Edit Score
2026-03-04
2026-03-04 18:16Z
HIGH

CVE-2026-20103 — Cisco Adaptive_security_appliance_software: A vulnerability in the Remote Access SSL VPN functionality of Cisco Secure Firewall Adaptive

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-20103

A vulnerability in the Remote Access SSL VPN functionality of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to exhaust device memory resulting in a denial of service (DoS) condition to new Remote Access SSL VPN connections. This does not affect the management interface, though it may become temporarily unresponsive. This vulnerability is due to trusting use CVSSv3.1 8.6 (HIGH) · EPSS 28th percentile

CWECWE 770VNDCiscoVNDAccessTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-03-04
2026-03-04 18:16Z
HIGH

CVE-2026-20101 — Cisco Adaptive_security_appliance_software: A vulnerability in the SAML 2.0 single sign-on (SSO) feature of Cisco Secure Firewall

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-20101

A vulnerability in the SAML 2.0 single sign-on (SSO) feature of Cisco Secure Firewall ASA Software and Secure FTD Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a DoS condition. This vulnerability is due to insufficient error checking when processing SAML messages. An attacker could exploit this vulnerability by sending crafted SAML messages to the SAML service. A successful exploit could allow the attacker CVSSv3.1 8.6 (HIGH) · EPSS 28th percentile

CWECWE 330VNDCiscoVNDSamlTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-03-04
2026-03-04 18:16Z
HIGH

CVE-2026-20082 — Cisco Adaptive_security_appliance_software: A vulnerability in the handling of the embryonic connection limits in Cisco Secure Firewall

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-20082

A vulnerability in the handling of the embryonic connection limits in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause incoming TCP SYN packets to be dropped incorrectly. This vulnerability is due to improper handling of new, incoming TCP connections that are destined to management or data interfaces when the device is under a TCP SYN flood attack. An attacker could exploit this vulnerability by sendi CVSSv3.1 8.6 (HIGH) · EPSS 36th percentile

CWECWE 772VNDCiscoTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-03-04
2026-03-04 18:16Z
CRIT

CVE-2026-20079 — A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-20079

A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.&nbsp; This vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successfu CVSSv3.1 10.0 (CRITICAL) · EPSS 98th percentile

CWECWE 288TYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2026-03-04
2026-03-04 18:16Z
HIGH

CVE-2026-20039 — Cisco Adaptive_security_appliance_software: A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-20039

A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to ineffective memory management of the VPN web server. An attacker could exploit this vulnerability by sending a large number of&nbsp;crafted HTTP requests to an affected d CVSSv3.1 8.6 (HIGH) · EPSS 29th percentile

CWECWE 244VNDCiscoVNDVpnTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-03-04
2026-03-04 18:16Z
HIGH

CVE-2026-20002 — Cisco Secure_firewall_management_center: A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-20002

A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability is due to inadequate validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted requests to an affected device. A successful exploit could allow the attacker to obtain full access to the database and read certain files on the underly CVSSv3.1 8.1 (HIGH) · EPSS 27th percentile

CWECWE 89VNDCiscoTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-03-04
2026-03-04 17:16Z
HIGH

CVE-2025-15558 — Docker Command_line_interface: A low-privileged attacker can create this directory and place malicious CLI plugin binaries (docker-compose.exe

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-15558

Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries (docker-compose.exe, docker-buildx.exe, etc.) that are executed when a victim user opens Docker Desktop or invokes Docker CLI plugin features, and allow privilege-escalation if the docker CLI is executed as a privileged user. This issue affects Docker C CVSSv3.1 8.0 (HIGH)

CWECWE 427VNDDockerTYPVulnerability
8.0
CVSS v3.1
90
Edit Score
2026-03-04
2026-03-04 17:00Z
HIGH

Offensive DPAPI With Nemesis

SpecterOps·specterops.io

SpecterOps released Nemesis 2.2 with comprehensive DPAPI automation for Windows credential extraction, including SYSTEM/user masterkey decryption, CNG key handling, and Chromium App-Bound Encryption (ABE) decryption chains. The tool automates the entire decryption pipeline from DPAPI masterkeys through Chrome 137+ ABE protections, supporting both retroactive and forward decryption with file-based enrichment workflows.

SRFApplicationSRFOsTACTA0006TACTA0007VNDMicrosoftVNDGoogleVNDChromiumTYPResearch
78
Edit Score
2026-03-04
2026-03-04 09:15Z
CRIT

CVE-2026-27446 — Apache Activemq_artemis: Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-27446

Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. This could potentially result in message injection into any queue and/or message exfiltration from any queue via the rogue broker. This impacts environments that allow both: - incoming Cor CVSSv3.1 9.8 (CRITICAL)

CWECWE 306VNDApacheTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-03-04
2026-03-04 00:00Z
HIGH

Europol, Microsoft, TrendAI™ and Collaborators Halt Tycoon 2FA Operations

Trend Micro Research·trendmicro.com

Law enforcement and industry partners including Europol, Microsoft, and Trend Micro disrupted Tycoon 2FA, a phishing-as-a-service platform with ~2,000 users that used adversary-in-the-middle (AitM) proxying to bypass MFA and harvest session cookies. The operation seized over 300 domains and attributed the service to threat actors using monikers 'SaaadFridi' and 'Mr_Xaad'. The takedown highlights how PhaaS platforms lower the barrier to entry for credential theft and feed into broader cybercrime ecosystems where stolen sessions are resold to access brokers for follow-on attacks.

TACTA0001SRFIdentitySRFWebVNDMicrosoftVNDTrend MicroTYPThreat IntelTYPNewsSTGInitial Access
72
Edit Score
2026-03-03
2026-03-03 22:16Z
CRIT

CVE-2026-2590 — Devolutions Remote_desktop_manager: Improper enforcement of the Disable password saving in vaults setting in the connection entry

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-2590

Improper enforcement of the Disable password saving in vaults setting in the connection entry component in Devolutions Remote Desktop Manager 2025.3.30 and earlier allows an authenticated user to persist credentials in vault entries, potentially exposing sensitive information to other users, by creating or editing certain connection types while password saving is disabled. CVSSv3.1 9.8 (CRITICAL) · EPSS 17th percentile

CWECWE 20CWECWE 295VNDDevolutionsVNDDisableTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-03-03
2026-03-03 18:16Z
HIGH

CVE-2026-3437 — Portwell Engineering_toolkits: An improper restriction of operations within the bounds of a memory buffer vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-3437

An improper restriction of operations within the bounds of a memory buffer vulnerability in Portwell Engineering Toolkits version 4.8.2 could allow a local authenticated attacker to read and write to arbitrary memory via the Portwell Engineering Toolkits driver. Successful exploitation of this vulnerability could result in escalation of privileges or cause a denial-of-service condition. CVSSv3.1 8.8 (HIGH) · EPSS 5th percentile

CWECWE 119VNDPortwellTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-03-03
2026-03-03 14:15Z
CRIT

Sometimes, You Can Just Feel The Security In The Design (Juniper Junos Evolved CVE-2026-21902 Pre-Auth RCE)

watchTowr Labs·labs.watchtowr.comCVE-2026-21902in the wild

CVE-2026-21902 is a pre-authentication remote code execution vulnerability in Juniper Junos OS Evolved affecting PTX Series routers. The On-Box Anomaly Detection Framework REST API listens on port 8160/TCP bound to 0.0.0.0 despite design intent to restrict it to internal interfaces, allowing unauthenticated attackers to create malicious DAG (Directed Acyclic Graph) workflows that execute arbitrary shell commands as root via the RE-SHELL command type. The vulnerability is enabled by default and exploitable through a simple four-step HTTP API sequence: create a command, define a DAG, instantiate it, and commit the configuration.

TACTA0001TACTA0002SRFNetwork ApplianceVNDJuniperTYPWriteupTYPVulnerabilitySTGExecutionSTGInitial Access
92
Edit Score
2026-03-03
2026-03-03 14:00Z
HIGH

Beyond Electron: Attacking Alternative Desktop Application Frameworks

Bishop Fox Labs·bishopfox.com

Bishop Fox researchers demonstrate a practical XSS-to-RCE exploitation chain against Tauri desktop applications, showing that despite architectural improvements over Electron, permissive configuration settings combined with XSS vulnerabilities enable full remote code execution. The attack leverages filesystem write access, shell.open() functionality, and Tauri API exposure to write and execute arbitrary binaries on the target system.

SRFApplicationTACTA0001TYPResearchTYPTechniqueSTGExecutionSTGInitial AccessTECT1190TECT1059
78
Edit Score
2026-03-03
2026-03-03 10:16Z
CRIT

CVE-2026-22886 — Eclipse Openmq: exposes a TCP-based management service (imqbrokerd) that by default requires authentication.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-22886

OpenMQ exposes a TCP-based management service (imqbrokerd) that by default requires authentication. However, the product ships with a default administrative account (admin/ admin) and does not enforce a mandatory password change on first use. After the first successful login, the server continues to accept the default password indefinitely without warning or enforcement. In real-world deployments, this service is often left enabled without changing the default credentials. CVSSv3.1 9.8 (CRITICAL)

CWECWE 1393CWECWE 1391CWECWE 1392VNDEclipseVNDOpenmqTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-03-03
2026-03-03 00:00Z
HIGH

Claude Code Security set the Cybersecurity Stocks on Fire - Here's the Signal in the Smoke

Trend Micro Research·trendmicro.com

Trend Micro analyzes Anthropic's Claude Code Security announcement and the resulting cybersecurity stock market sell-off, arguing the market overreacted to a pre-deployment code scanning tool. The article contends that while AI-assisted vulnerability detection is valuable, the real emerging threat surface lies in autonomous AI agents themselves—supply chain poisoning, runtime behavior drift, and observability gaps that static code analysis cannot address.

TACTA0043SRFAiVNDAnthropicVNDCrowdstrikeVNDOktaTYPResearchTYPThreat IntelSTGDiscovery
72
Edit Score
2026-03-02
2026-03-02 23:00Z
CRIT

Avira: Deserialize, Delete and Escalate - The Proper Way to Use an AV

Quarkslab·blog.quarkslab.comCVE-2026-27748CVE-2026-27749CVE-2026-27750

Quarkslab disclosed three critical vulnerabilities in Avira Internet Security (≤1.1.109.1990) affecting privileged modules: arbitrary file deletion via symlink following in Software Updater (CVE-2026-27748), insecure .NET BinaryFormatter deserialization in System Speedup (CVE-2026-27749), and TOCTOU-based folder deletion in Optimizer (CVE-2026-27750). All three enable local privilege escalation to SYSTEM, with the first two chained via the well-known Config.msi MSI rollback DLL injection primitive.

SRFApplicationSRFOsTACTA0004TACTA0005VNDAviraTYPWriteupTYPExploitTYPVulnerability
92
Edit Score
2026-03-02
2026-03-02 19:16Z
HIGH

CVE-2026-0013 — Google Android: This could lead to local escalation of privilege with no additional execution privileges needed.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-0013

In setupLayout of PickActivity.java, there is a possible way to start any activity as a DocumentsUI app due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. CVSSv3.1 8.4 (HIGH) · EPSS 1th percentile

CWECWE 441VNDGoogleVNDPickactivityTYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-03-02
2026-03-02 19:16Z
HIGH

CVE-2026-0011 — Google Android: This could lead to local escalation of privilege with no additional execution privileges needed.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-0011

In enableSystemPackageLPw of Settings.java, there is a possible way to prevent location access from working due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. CVSSv3.1 8.4 (HIGH) · EPSS 2th percentile

CWECWE 693CWECWE 703VNDGoogleVNDSettingsTYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-03-02
2026-03-02 19:16Z
HIGH

CVE-2026-0010 — Google Android: In onTransact of IDrmManagerService.cpp, there is a possible out of bounds write due to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-0010

In onTransact of IDrmManagerService.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. CVSSv3.1 8.4 (HIGH) · EPSS 1th percentile

CWECWE 787VNDGoogleVNDIdrmmanagerserviceTYPVulnerability
8.4
CVSS v3.1
92
Edit Score