Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-14 23:20Z
2026-02-24
2026-02-24 02:16Z
HIGH

CVE-2026-25965 — Imagemagick Imagemagick: As a result, a policy rule such as /etc/* can be bypassed by a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-25965

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, ImageMagick’s path security policy is enforced on the raw filename string before the filesystem resolves it. As a result, a policy rule such as /etc/* can be bypassed by a path traversal. The OS resolves the traversal and opens the sensitive file, but the policy matcher only sees the unnormalized path and therefore allows the read. This enab CVSSv3.1 8.6 (HIGH)

CWECWE 22VNDImagemagickTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-02-24
2026-02-24 01:16Z
HIGH

CVE-2026-25794 — Imagemagick Imagemagick: Prior to version 7.1.2-15, when image dimensions are large, the multiplication overflows 32-bit `int`

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-25794

ImageMagick is free and open-source software used for editing and manipulating digital images. `WriteUHDRImage` in `coders/uhdr.c` uses `int` arithmetic to compute the pixel buffer size. Prior to version 7.1.2-15, when image dimensions are large, the multiplication overflows 32-bit `int`, causing an undersized heap allocation followed by an out-of-bounds write. This can crash the process or potentially lead to an out of bounds heap write. Version 7.1.2-15 contains a patch. CVSSv3.1 8.2 (HIGH)

CWECWE 122CWECWE 190VNDImagemagickTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-02-24
2026-02-24 00:00Z
HIGH

Nowhere, man: The 2026 Active Adversary Report

Sophos X-Ops·news.sophos.comCVE-2024-40766

Sophos X-Ops' 2026 Active Adversary Report analyzes 661 incident response cases from Nov 2024–Oct 2025, revealing that identity-related attacks (compromised credentials, brute-force, phishing) now account for 67.32% of root causes—a multi-year dominance trend. Attackers are moving faster (3.4-hour median to AD compromise, 3-day dwell time) and increasingly exfiltrating data alongside ransomware; Impacket usage surged 83% YoY, while Cobalt Strike declined. Critical gaps persist: 59% of organizations lack MFA, firewall logging defaults are inadequate (7 days or less), and 13% run end-of-life Windows Server versions.

SRFOsTACTA0001SRFNetworkTACTA0006TACTA0007SRFIdentityVNDMicrosoftVNDSonicwall
78
Edit Score
2026-02-24
2026-02-24 00:00Z
INFO

Beyond Behaviors: AI-Augmented Detection Engineering with ES|QL COMPLETION

Elastic Security Labs·elastic.co

Elastic Security Labs introduces ES|QL COMPLETION, a new query language feature that embeds LLM reasoning directly into detection rules for alert triage. The technique correlates behavioral alerts by host or user, builds structured context, and uses LLM judgment to distinguish attack chains from benign activity (SCCM, Nessus, legitimate admin tools) without external orchestration. Two prebuilt rules are provided: LLM-Based Attack Chain Triage by Host and LLM-Based Compromised User Triage by User.

SRFApplicationTACTA0006TACTA0007SRFCloudSWElasticsearchVNDElasticTYPResearchTECT1087
62
Edit Score
2026-02-23
2026-02-23 21:19Z
HIGH

CVE-2025-71056 — GCOM: Improper session management in GCOM EPON 1GE ONU version C00R371V00B01 allows attackers to execute

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-71056

Improper session management in GCOM EPON 1GE ONU version C00R371V00B01 allows attackers to execute a session hijacking attack via spoofing the IP address of an authenticated user. CVSSv3.1 8.1 (HIGH) · EPSS 14th percentile

CWECWE 290VNDGcomTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-02-23
2026-02-23 20:28Z
HIGH

CVE-2025-67733 — Lfprojects Valkey: Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-67733

Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary information into the response stream for the given client, potentially corrupting or returning tampered data to other users on the same connection. The error handling code for lua scripts does not properly handle null characters. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue. CVSSv3.1 8.5 (HIGH)

CWECWE 74CWECWE 170VNDLfprojectsVNDValkeyTYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2026-02-23
2026-02-23 14:52Z
HIGH

v1.5.1

NetExec releases·github.com

NetExec v1.5.1 patches a critical arbitrary file write vulnerability in the spider_plus module. The release includes multiple bug fixes across SMB, NFS, LDAP, FTP, RDP, and WMI modules. Users are advised to upgrade immediately via GitHub/pipx.

SRFNetworkVNDNetexecTYPToolTYPAdvisorySTGDiscoverySTGInitial AccessSTApatched
72
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-02-23
2026-02-23 14:34Z
INFO

v2.10.0-rc1

AzureHound releases·github.com

AzureHound v2.10.0-rc1 released with support for federated identity credentials enumeration and minor bug fixes. This is a pre-release candidate with 23 commits since v2.9.2.

SRFIdentitySRFCloudVNDSpecteropsVNDMicrosoft AzureTYPToolSTGDiscoverySTGRecon
35
Edit Score
2026-02-23
2026-02-23 09:17Z
HIGH

CVE-2026-25747 — Apache Camel: Deserialization of Untrusted Data vulnerability in Apache Camel LevelDB component.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-25747

Deserialization of Untrusted Data vulnerability in Apache Camel LevelDB component. The Camel-LevelDB DefaultLevelDBSerializer class deserializes data read from the LevelDB aggregation repository using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. An attacker who can write to the LevelDB database files used by a Camel application can inject a crafted serialized Java object that, when deserialized during normal aggregation repo CVSSv3.1 8.8 (HIGH)

CWECWE 502VNDApacheTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-02-23
2026-02-23 00:00Z
HIGH

Malicious OpenClaw Skills Used to Distribute Atomic macOS Stealer

Trend Micro Research·trendmicro.comin the wild

Trend Micro Research identified a campaign distributing Atomic macOS Stealer (AMOS) through malicious OpenClaw AI agent skills, representing an evolution from traditional cracked-software distribution to supply-chain attacks targeting AI workflows. The attack chain embeds malicious instructions in SKILL.md files that trick AI agents into installing a fake CLI tool, which then deploys a Mach-O universal binary stealer that exfiltrates Apple keychains, KeePass vaults, browser data, and documents. Over 39 distinct malicious skills were identified across ClawHub, SkillsMP, and GitHub repositories, with hundreds more related skills previously documented by other researchers.

TACTA0001TACTA0002TACTA0006TACTA0009SRFAiVNDOpenclawVNDTrend MicroTYPResearch
78
Edit Score
2026-02-21
2026-02-21 20:23Z
MED

1 little known secret of sti_ci.dll

Hexacorn·hexacorn.com

Hexacorn documents a Living-off-the-Land Binary (LOLBin) technique leveraging sti_ci.dll's InstallWiaService export function callable via rundll32.exe to execute multiple system binaries (regsvr32.exe, wiaacmgr.exe, etc.). The technique can be abused for code execution and defense evasion by copying rundll32.exe to alternate directories to bypass system32 search order restrictions; execution is logged to wiatrace.log.

SRFOsTACTA0005TACTA0002TYPResearchTYPTechniqueSTGDefense EvasionSTGExecutionTECT1218
68
Edit Score
2026-02-21
2026-02-21 00:16Z
HIGH

CVE-2026-27134 — Linuxfoundation Strimzi_kafka_operator: Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-27134

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In versions 0.49.0 through 0.50.0, when using a custom Cluster or Clients CA with a multistage CA chain consisting of multiple CAs, Strimzi incorrectly configures the trusted certificates for mTLS authentication on the internal as well as user-configured listeners. All CAs from the CA chain will be trusted. And users with certificates signed by any of the CA CVSSv3.1 8.1 (HIGH)

CWECWE 287CWECWE 295CWECWE 296VNDLinuxfoundationVNDStrimziTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-02-20
2026-02-20 23:16Z
HIGH

CVE-2026-2044 — Gimp Gimp: PGM File Parsing Uninitialized Memory Remote Code Execution Vulnerability.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-2044

GIMP PGM File Parsing Uninitialized Memory Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PGM files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can CVSSv3.1 8.8 (HIGH)

CWECWE 908VNDGimpTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-02-20
2026-02-20 22:16Z
HIGH

CVE-2026-0797 — Gimp Gimp: ICO File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-0797

GIMP ICO File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ICO files. The issue results from the lack of proper validation of the length of user-supplied data prior to c CVSSv3.1 8.8 (HIGH)

CWECWE 120CWECWE 787CWECWE 122VNDGimpTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-02-20
2026-02-20 21:19Z
CRIT

CVE-2026-25896 — Naturalintelligence Fast-xml-parser: allows users to validate XML, parse XML to JS object, or build XML

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-25896

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (<, >, &, ", ') with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered. This vulnerability is fi CVSSv3.1 9.3 (CRITICAL)

CWECWE 79CWECWE 185VNDNaturalintelligenceTYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2026-02-20
2026-02-20 20:25Z
HIGH

CVE-2026-2472 — Stored: Cross-Site Scripting (XSS) in the _genai/_evals_visualization component of Google Cloud Vertex AI SDK

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-2472

Stored Cross-Site Scripting (XSS) in the _genai/_evals_visualization component of Google Cloud Vertex AI SDK (google-cloud-aiplatform) versions from 1.98.0 up to (but not including) 1.131.0 allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's Jupyter or Colab environment via injecting script escape sequences into model evaluation results or dataset JSON data. CVSSv3.1 8.1 (HIGH)

CWECWE 79VNDStoredTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-02-20
2026-02-20 17:25Z
HIGH

CVE-2026-2818 — A zip-slip path traversal vulnerability in Spring Data Geode's import snapshot functionality allows attackers

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-2818

A zip-slip path traversal vulnerability in Spring Data Geode's import snapshot functionality allows attackers to write files outside the intended extraction directory. This vulnerability appears to be susceptible on Windows OS only. CVSSv3.1 8.2 (HIGH)

CWECWE 22CWECWE 23TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-02-20
2026-02-20 17:25Z
CRIT

CVE-2026-26725 — Edubusinesssolutions Print_shop_pro_webdesk: An issue in edu Business Solutions Print Shop Pro WebDesk v.18.34 (fixed in 19.76)

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-26725

An issue in edu Business Solutions Print Shop Pro WebDesk v.18.34 (fixed in 19.76) allows a remote attacker to escalate privileges via the AccessID parameter. CVSSv3.1 9.8 (CRITICAL) · EPSS 46th percentile

CWECWE 269VNDBusinessVNDEdubusinesssolutionsTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-02-20
2026-02-20 16:22Z
CRIT

CVE-2026-22384 — Deserialization: of Untrusted Data vulnerability in leafcolor Applay - Shortcodes applay-shortcodes allows Object Injection.This

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-22384

Deserialization of Untrusted Data vulnerability in leafcolor Applay - Shortcodes applay-shortcodes allows Object Injection.This issue affects Applay - Shortcodes: from n/a through <= 3.7. CVSSv3.1 9.8 (CRITICAL)

CWECWE 502TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-02-20
2026-02-20 16:22Z
HIGH

CVE-2026-22365 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-22365

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Soleng soleng allows PHP Local File Inclusion.This issue affects Soleng: from n/a through <= 1.0.5. CVSSv3.1 8.1 (HIGH)

CWECWE 98TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-02-20
2026-02-20 16:22Z
HIGH

CVE-2025-69063 — Authorization: Missing Authorization vulnerability in Saad Iqbal New User Approve new-user-approve allows Exploiting Incorrectly Configured

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-69063

Missing Authorization vulnerability in Saad Iqbal New User Approve new-user-approve allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects New User Approve: from n/a through <= 3.2.0. CVSSv3.1 8.6 (HIGH)

CWECWE 862TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-02-20
2026-02-20 16:22Z
HIGH

CVE-2025-68853 — Deserialization: of Untrusted Data vulnerability in Kleor Contact Manager contact-manager allows Object Injection.This issue

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-68853

Deserialization of Untrusted Data vulnerability in Kleor Contact Manager contact-manager allows Object Injection.This issue affects Contact Manager: from n/a through <= 9.1.1. CVSSv3.1 8.8 (HIGH)

CWECWE 502TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-02-20
2026-02-20 16:22Z
HIGH

CVE-2025-68545 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-68545

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Nika nika allows PHP Local File Inclusion.This issue affects Nika: from n/a through <= 1.2.14. CVSSv3.1 8.1 (HIGH)

CWECWE 98TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-02-20
2026-02-20 16:22Z
HIGH

CVE-2025-67977 — Authorization: Missing Authorization vulnerability in VillaTheme HAPPY happy-helpdesk-support-ticket-system allows Exploiting Incorrectly Configured Access Control Security

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-67977

Missing Authorization vulnerability in VillaTheme HAPPY happy-helpdesk-support-ticket-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HAPPY: from n/a through <= 1.0.8. CVSSv3.1 8.2 (HIGH)

CWECWE 862TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-02-20
2026-02-20 16:00Z
HIGH

Using threat modeling and prompt injection to audit Comet

Trail of Bits·blog.trailofbits.com

Trail of Bits disclosed a pre-launch security audit of Perplexity's Comet AI-powered browser, demonstrating four prompt injection techniques that could extract private Gmail data by exploiting the browser's AI assistant. The vulnerabilities exploited the assistant's failure to treat external web content as untrusted input, allowing attackers to inject fake system messages, security mechanisms, and user requests. The findings led to five security recommendations for AI-integrated products, including ML-centered threat modeling, clear trust boundaries, systematic red-teaming, least-privilege capabilities, and input validation.

TACTA0001TACTA0006TACTA0009SRFBrowserSRFAiVNDPerplexityTYPResearchTYPWriteup
82
Edit Score