Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-15 06:33Z
2026-02-11
2026-02-11 08:16Z
HIGH

CVE-2025-10913 — Neutralization: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-10913

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saastech Cleaning and Internet Services Inc. TemizlikYolda allows Cross-Site Scripting (XSS). This issue affects TemizlikYolda: through 11022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. CVSSv3.1 8.3 (HIGH) · EPSS 20th percentile

CWECWE 79TYPVulnerability
8.3
CVSS v3.1
92
Edit Score
2026-02-11
2026-02-11 00:00Z
HIGH

BADIIS to the Bone: New Insights to a Global SEO Poisoning Campaign

Elastic Security Labs·elastic.coin the wild

Elastic Security Labs published a comprehensive analysis of REF4033, a Chinese-speaking cybercrime group operating a large-scale SEO poisoning campaign targeting over 1,800 Windows IIS servers globally using the BADIIS malware. The campaign deploys a malicious IIS native module that injects keyword-stuffed content for search engines while redirecting users to illicit gambling, cryptocurrency phishing, and adult content sites, with infrastructure geotargeted across APAC, Brazil, and other regions. The intrusion chain progresses from initial access to full IIS module persistence in under 17 minutes, using Windows service creation, DLL injection, and configuration manipulation to remain stealthy.

TACTA0005TACTA0001TACTA0002SRFNetworkTACTA0007SRFWebTACTA0003OSWindows
78
Edit Score
2026-02-10
2026-02-10 18:30Z
CRIT

The February 2026 Security Update Review

Zero Day Initiative·thezdi.comCVE-2026-21510CVE-2026-21514CVE-2026-21519CVE-2026-21533CVE-2026-21513CVE-2026-21525CVE-2026-24302CVE-2026-24300CVE-2026-21532CVE-2026-21522CVE-2026-23655CVE-2026-21531CVE-2026-21523CVE-2026-21256CVE-2026-21516CVE-2026-21537CVE-2026-21244CVE-2026-21247CVE-2026-21248CVE-2026-20841CVE-2026-21229in the wild

Microsoft released 62 CVEs in February 2026 with six actively exploited vulnerabilities, including critical Windows Shell and Word security feature bypasses (CVE-2026-21510, CVE-2026-21514), Desktop Window Manager and RDS privilege escalations (CVE-2026-21519, CVE-2026-21533), and multiple Azure cloud infrastructure vulnerabilities. Adobe released 44 CVEs across creative suite products with no active exploitation reported. The unusually high number of ITW exploits (6 vs. 1 last month) and prevalence of one-click code execution and SYSTEM-level privilege escalation bugs warrant immediate patching.

SRFApplicationSRFOsTACTA0004TACTA0005TACTA0002SRFCloudVNDMicrosoftVNDAdobe
8.6
CVSS v3.1
82
Edit Score
2026-02-10
2026-02-10 18:16Z
HIGH

CVE-2026-25646 — Libpng Libpng: Prior to 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-25646

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user's display, certain palettes will cause the function to enter into an infinite loop that reads past th CVSSv3.1 8.1 (HIGH)

CWECWE 125CWECWE 122CWECWE 126VNDLibpngTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-02-10
2026-02-10 18:16Z
HIGH

CVE-2026-21229 — Microsoft Power_bi_report_server: Improper input validation in Power BI allows an authorized attacker to execute code over

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-21229

Improper input validation in Power BI allows an authorized attacker to execute code over a network. CVSSv3.1 8.0 (HIGH) · EPSS 57th percentile

CWECWE 20VNDMicrosoftVNDPowerTYPVulnerability
8.0
CVSS v3.1
90
Edit Score
2026-02-10
2026-02-10 15:45Z
INFO

v2.9.1

AzureHound releases·github.com

AzureHound v2.9.1 released with a minor bug fix removing an unneeded channel for devices (BED-7366). This is a routine maintenance release with 41 commits since v2.9.0.

SRFCloudTACTA0043VNDSpecteropsTYPToolSTGRecon
25
Edit Score
2026-02-10
2026-02-10 15:16Z
HIGH

CVE-2025-7636 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-7636

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ergosis Security Systems Computer Industry and Trade Inc. ZEUS PDKS allows SQL Injection. This issue affects ZEUS PDKS: from <1.0.5.10 through 10022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. CVSSv3.1 8.8 (HIGH) · EPSS 14th percentile

CWECWE 89TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-02-10
2026-02-10 15:16Z
HIGH

CVE-2025-7347 — Authorization: Bypass Through User-Controlled Key vulnerability in Dinibh Puzzle Software Solutions Dinibh Patrol Tracking

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-7347

Authorization Bypass Through User-Controlled Key vulnerability in Dinibh Puzzle Software Solutions Dinibh Patrol Tracking System allows Exploitation of Trusted Identifiers. This issue affects Dinibh Patrol Tracking System: through 10022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. CVSSv3.1 8.8 (HIGH) · EPSS 19th percentile

CWECWE 639TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-02-10
2026-02-10 14:16Z
HIGH

CVE-2025-6967 — Execution: CMS allows JSON Hijacking (aka JavaScript Hijacking), Authentication Bypass.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-6967

Execution After Redirect (EAR) vulnerability in Sarman Soft Software and Technology Services Industry and Trade Ltd. Co. CMS allows JSON Hijacking (aka JavaScript Hijacking), Authentication Bypass. This issue affects CMS: through 10022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. CVSSv3.1 8.7 (HIGH) · EPSS 10th percentile

CWECWE 698VNDExecutionTYPVulnerability
8.7
CVSS v3.1
94
Edit Score
2026-02-10
2026-02-10 09:16Z
CRIT

CVE-2025-11242 — Server: Server-Side Request Forgery (SSRF) vulnerability in Teknolist Computer Systems Software Publishing Industry and Trade

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-11242

Server-Side Request Forgery (SSRF) vulnerability in Teknolist Computer Systems Software Publishing Industry and Trade Inc. Okulistik allows Server Side Request Forgery. This issue affects Okulistik: through 21102025. CVSSv3.1 9.8 (CRITICAL) · EPSS 20th percentile

CWECWE 918TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-02-10
2026-02-10 04:16Z
HIGH

CVE-2026-23687 — Sap Sap_basis: NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-23687

SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed message and send modified signed XML documents to the verifier. This may result in acceptance of tampered identity information, unauthorized access to sensitive user data and potential disruption of normal system usage. CVSSv3.1 8.8 (HIGH) · EPSS 5th percentile

CWECWE 347VNDSapTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-02-10
2026-02-10 00:00Z
CRIT

SolarWinds Web Help Desk Exploitation - February 2026

Elastic Security Labs·elastic.coCVE-2025-26399CVE-2025-40536CVE-2025-40551in the wild

SolarWinds Web Help Desk servers are being actively exploited in the wild as of February 2026, with intrusions beginning in December 2025. Three CVEs (CVE-2025-26399, CVE-2025-40536, CVE-2025-40551) involving unauthenticated deserialization RCE and security control bypass are implicated. Post-exploitation activity includes RMM deployment, Velociraptor abuse, credential dumping via DCSync/NTDS.dit extraction, and persistence via QEMU-based SSH tunneling.

SRFApplicationTACTA0004TACTA0005TACTA0001TACTA0002TACTA0006TACTA0007SRFWeb
92
Edit Score
2026-02-09
2026-02-09 23:00Z
CRIT

Intego X9: When your macOS antivirus becomes your enemy

Quarkslab·blog.quarkslab.comCVE-2026-26224CVE-2026-26225

Quarkslab disclosed two critical local privilege escalation vulnerabilities in Intego X9 macOS security suite affecting Log Reporter and Personal Backup. Both vulnerabilities exploit TOCTOU race conditions to write arbitrary files as root, enabling unauthenticated privilege escalation. The vulnerabilities affect all Intego applications in the bundle and were disclosed after failed vendor contact attempts, with publication coordinated through CERT-FR.

SRFApplicationSRFOsTACTA0004TACTA0003VNDIntegoTYPWriteupTYPVulnerabilitySTGPrivesc
88
Edit Score
2026-02-09
2026-02-09 20:15Z
HIGH

CVE-2026-1529 — Keycloak: This lack of cryptographic signature verification allows the attacker to successfully self-register into an

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-1529

A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the attacker to successfully self-register into an unauthorized organization, leading to unauthorized access. CVSSv3.1 8.1 (HIGH)

CWECWE 347VNDKeycloakTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-02-09
2026-02-09 20:15Z
HIGH

CVE-2026-1486 — Keycloak: A flaw was found in Keycloak.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-1486

A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider (IdP) is enabled before issuing tokens. The issuer lookup mechanism (lookupIdentityProviderFromIssuer) retrieves the IdP configuration but does not filter for isEnabled=false. If an administrator disables an IdP (e.g., due to a compromise or offboarding), an entity possessing that IdP's signing key can still generate valid JWT asser CVSSv3.1 8.8 (HIGH)

CWECWE 358VNDKeycloakTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-02-09
2026-02-09 14:16Z
HIGH

CVE-2025-10465 — Upload: Sensaway allows Upload a Web Shell to a Web Server.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-10465

Unrestricted Upload of File with Dangerous Type vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co. Sensaway allows Upload a Web Shell to a Web Server. This issue affects Sensaway: through 09022026. NOTE: Because the product was developed using outdated technology, the manufacturer is unable to fix the relevant vulnerabilities. Users of the Sensaway application are advised to contact the manufacturer and review updated products developed with newer CVSSv3.1 8.8 (HIGH) · EPSS 6th percentile

CWECWE 434TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-02-09
2026-02-09 12:15Z
CRIT

CVE-2025-6830 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-6830

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Xpoda Türkiye Information Technology Inc. Password Module allows SQL Injection. This issue affects Password Module: through 11022026. CVSSv3.1 9.8 (CRITICAL) · EPSS 4th percentile

CWECWE 89TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-02-09
2026-02-09 09:16Z
HIGH

CVE-2025-7799 — Neutralization: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-7799

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Zirve Information Technologies Inc. E-Taxpayer Accounting Website allows Reflected XSS. This issue affects e-Taxpayer Accounting Website: through 07082025. CVSSv3.1 8.6 (HIGH) · EPSS 6th percentile

CWECWE 79TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-02-09
2026-02-09 08:00Z
CRIT

Deep Dive into Arista NG Firewall Vulnerabilities

Bishop Fox Labs·bishopfox.comCVE-2025-6978CVE-2026-25620CVE-2026-25621CVE-2026-25622CVE-2026-25623CVE-2026-25624

Bishop Fox disclosed six vulnerabilities in Arista NG Firewall 17.4, including multiple OS command injection flaws (CVE-2025-6978, CVE-2026-25620, CVE-2026-25621, CVE-2026-25622), an overly permissive RPC interface (CVE-2026-25623), and reflected XSS (CVE-2026-25624). The most critical issues allow unauthenticated RCE via captive portal password fields under specific conditions, and authenticated admins can achieve root command execution; chaining XSS with RPC exposure enables single-click RCE against logged-in administrators. Arista released patched version 17.4.1 on February 3, 2026.

TACTA0004TACTA0002SRFNetwork ApplianceTACTA0008VNDAristaTYPResearchTYPWriteupTYPAdvisory
88
Edit Score
2026-02-09
2026-02-09 05:16Z
CRIT

CVE-2026-1615 — Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-1615

Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The library relies on the static-eval module to process JSON Path input, which is not designed to handle untrusted data safely. An attacker can exploit this vulnerability by supplying a malicious JSON Path expression that, when evaluated, executes arbitrary JavaScript code, leading to Remote Code Execution in Node.js environmen CVSSv3.1 9.8 (CRITICAL)

CWECWE 94TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-02-08
2026-02-08 22:39Z
INFO

v1.7.1

Sliver releases·github.com

Sliver v1.7.1 released with updates to Linux shellcode generation and multi-console functionality. This is a routine tool update with incremental feature additions and bug fixes.

SRFOsTACTA0011VNDBishop FoxTYPToolSTGExecutionSTGC2
35
Edit Score
2026-02-07
2026-02-07 22:16Z
HIGH

CVE-2026-25859 — Wekan_project Wekan: versions prior to 8.20 allow non-administrative users to access migration functionality due to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-25859

Wekan versions prior to 8.20 allow non-administrative users to access migration functionality due to insufficient permission checks, potentially resulting in unauthorized migration operations. CVSSv3.1 8.8 (HIGH) · EPSS 26th percentile

CWECWE 863VNDWekanVNDWekan ProjectTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-02-07
2026-02-07 22:16Z
CRIT

CVE-2026-25858 — Macrozheng Mall: version 1.0.3 and prior contains an authentication vulnerability in the mall-portal password

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-25858

macrozheng mall version 1.0.3 and prior contains an authentication vulnerability in the mall-portal password reset workflow that allows an unauthenticated attacker to reset arbitrary user account passwords using only a victim’s telephone number. The password reset flow exposes the one-time password (OTP) directly in the API response and validates password reset requests solely by comparing the provided OTP to a value stored by telephone number, without verifying user identity CVSSv3.1 9.1 (CRITICAL)

CWECWE 640VNDMacrozhengTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-02-07
2026-02-07 22:16Z
CRIT

CVE-2026-25560 — Wekan_project Wekan: versions prior to 8.19 contain an LDAP filter injection vulnerability in LDAP authentication.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-25560

WeKan versions prior to 8.19 contain an LDAP filter injection vulnerability in LDAP authentication. User-supplied username input is incorporated into LDAP search filters and DN-related values without adequate escaping, allowing an attacker to manipulate LDAP queries during authentication. CVSSv3.1 9.8 (CRITICAL) · EPSS 47th percentile

CWECWE 90VNDWekanVNDWekan ProjectTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-02-07
2026-02-07 08:33Z
INFO

v1.7.0

Sliver releases·github.com

Sliver v1.7.0 released with updates to C2/mux functionality, Darwin/arm64 shellcode generation, background execution features, DNS DoS fixes, and gRPC API improvements. This is a routine tool release with incremental feature additions and bug fixes.

SRFOsVNDBishop FoxTYPToolSTGExecutionSTGC2
45
Edit Score