Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-15 10:24Z
2026-01-23
2026-01-23 10:19Z
CRIT

Nuclei Templates v10.3.7 – Release Notes

Nuclei templates·github.comCVE-2025-69200CVE-2025-68926CVE-2025-68645CVE-2025-62522CVE-2025-60188CVE-2025-52691CVE-2025-34291CVE-2025-14847CVE-2025-8848CVE-2024-43971CVE-2024-30194CVE-2024-29931CVE-2024-29792CVE-2024-29138CVE-2024-28986CVE-2024-24882CVE-2024-6753CVE-2024-5057CVE-2024-4455CVE-2024-3469CVE-2023-33193CVE-2023-27351CVE-2022-27924CVE-2022-4940CVE-2021-36754CVE-2021-28799CVE-2021-24213CVE-2021-4448CVE-2020-13125CVE-2019-15823CVE-2019-11253CVE-2019-14206CVE-2019-9082CVE-2018-10245CVE-2018-9206CVE-2018-8011CVE-2018-6961CVE-2017-20192CVE-2017-11107CVE-2016-15043CVE-2016-15041CVE-2012-10018CVE-2011-3600CVE-2006-3392CVE-2025-34299CVE-2025-13486CVE-2021-23394

Nuclei Templates v10.3.7 release adds 102 new detection templates covering 42 CVEs, including critical RCE and authentication bypass vulnerabilities across SmarterMail, Langflow AI, RustFS, SolarWinds Web Help Desk, and legacy systems. The release includes templates for recent 2025 vulnerabilities alongside historical CVEs with public exploits, enabling rapid vulnerability scanning across enterprise infrastructure.

SRFApplicationTACTA0004TACTA0001TACTA0002SRFWebTACTA0003VNDProjectdiscoveryTYPTool
7.3
CVSS v3.1
62
Edit Score
2026-01-23
2026-01-23 07:15Z
HIGH

CVE-2026-0603 — Hibernate: A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-0603

A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. This could lead to sensitive information disclosure, such as reading system files, and allow for data manipulation or deletion within the application's database, resulting in an application level denial of service. CVSSv3.1 8.3 (HIGH)

CWECWE 89VNDHibernateTYPVulnerability
8.3
CVSS v3.1
92
Edit Score
2026-01-23
2026-01-23 04:16Z
CRIT

CVE-2026-0770 — Langflow Langflow: exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-0770

Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the exec_globals parameter provided to the validate endpoint. The issue results from the inclusion of a resource from an untrusted control sphere CVSSv3.1 9.8 (CRITICAL) · EPSS 95th percentile

CWECWE 829VNDLangflowTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2026-01-23
2026-01-23 04:16Z
INFO

CVE-2026-0766 — Rejected: reason: Open WebU's investigation further investigation showed that this is intended functionality of

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-0766

Rejected reason: Open WebU's investigation further investigation showed that this is intended functionality of the Plugins extension system, in which users granted the relevant permission author Python that the server executes by design, and not a security issue. https://docs.openwebui.com/security/vendor-dispositions/cve-2026-0766 EPSS 98th percentile

VNDRejectedTYPVulnerability
58
Edit Score
2026-01-23
2026-01-23 02:15Z
CRIT

CVE-2026-24304 — Microsoft Azure_resource_manager: Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-24304

Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network. CVSSv3.1 10.0 (CRITICAL) · EPSS 46th percentile

CWECWE 284VNDMicrosoftVNDAzureTYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2026-01-23
2026-01-23 02:00Z
CRIT

Pwn2Own Automotive 2026 - Day Three Results and the Master of Pwn

Zero Day Initiative·thezdi.com0day

Pwn2Own Automotive 2026 concluded with 76 unique 0-day vulnerabilities disclosed across three days of competition, awarding $1,047,000 USD total. Fuzzware.io's team claimed Master of Pwn with exploits targeting infotainment systems (Alpine iLX-F511, Sony XAV-9500ES, Kenwood DNR1007XR) and EV charging hardware (Grizzl-E, Alpitronic HYC50, Autel MaxiCharger), leveraging buffer overflows, TOCTOU conditions, race conditions, and permission misconfigurations to achieve arbitrary code execution and root access.

SRFNetwork ApplianceOSLinuxVNDKenwoodVNDAlpitronicVNDAutelVNDGrizzl EVNDSonyTYPResearch
72
Edit Score
2026-01-22
2026-01-22 22:16Z
CRIT

CVE-2026-20912 — Gitea Gitea: An attachment uploaded to a private repository could potentially be linked to a release

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-20912

Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users. CVSSv3.1 9.1 (CRITICAL) · EPSS 28th percentile

CWECWE 639CWECWE 284CWECWE 283VNDGiteaTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-01-22
2026-01-22 22:16Z
CRIT

CVE-2026-20897 — Gitea Gitea: does not properly validate repository ownership when deleting Git LFS locks.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-20897

Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories. CVSSv3.1 9.1 (CRITICAL) · EPSS 28th percentile

CWECWE 639CWECWE 284VNDGiteaTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-01-22
2026-01-22 22:16Z
CRIT

CVE-2026-20750 — Gitea Gitea: does not properly validate project ownership in organization project operations.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-20750

Gitea does not properly validate project ownership in organization project operations. A user with project write access in one organization may be able to modify projects belonging to a different organization. CVSSv3.1 9.1 (CRITICAL) · EPSS 27th percentile

CWECWE 284VNDGiteaTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-01-22
2026-01-22 18:16Z
CRIT

CVE-2025-56590 — Apryse Html2pdf: This vulnerability could allow an attacker to execute arbitrary operating system commands on the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-56590

An issue was discovered in the InsertFromURL() function of the Apryse HTML2PDF SDK thru 11.10. This vulnerability could allow an attacker to execute arbitrary operating system commands on the local server. CVSSv3.1 9.8 (CRITICAL) · EPSS 40th percentile

CWECWE 78VNDApryseTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-01-22
2026-01-22 17:16Z
HIGH

CVE-2026-24367 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-24367

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through < 3.2.8. CVSSv3.1 8.5 (HIGH)

CWECWE 89TYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2026-01-22
2026-01-22 17:16Z
HIGH

CVE-2026-0535 — Autodesk Fusion: A maliciously crafted HTML payload, stored in a component’s description and clicked by a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-0535

A maliciously crafted HTML payload, stored in a component’s description and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process. CVSSv3.1 8.1 (HIGH) · EPSS 7th percentile

CWECWE 79VNDAutodeskTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-01-22
2026-01-22 17:16Z
HIGH

CVE-2026-0534 — Autodesk Fusion: A maliciously crafted HTML payload, stored in a part’s attribute and clicked by a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-0534

A maliciously crafted HTML payload, stored in a part’s attribute and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process. CVSSv3.1 8.1 (HIGH) · EPSS 5th percentile

CWECWE 79VNDAutodeskTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-01-22
2026-01-22 17:16Z
HIGH

CVE-2026-0533 — Autodesk Fusion: A maliciously crafted HTML payload in a design name, when displayed during the delete

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-0533

A maliciously crafted HTML payload in a design name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process. CVSSv3.1 8.1 (HIGH) · EPSS 6th percentile

CWECWE 79VNDAutodeskTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-01-22
2026-01-22 17:16Z
HIGH

CVE-2025-69180 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-69180

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in themepassion Ultra Portfolio ultra-portfolio allows Blind SQL Injection.This issue affects Ultra Portfolio: from n/a through <= 6.7. CVSSv3.1 8.5 (HIGH)

CWECWE 89TYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2026-01-22
2026-01-22 17:16Z
HIGH

CVE-2025-69097 — Limitation: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in VibeThemes

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-69097

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through <= 1.9.9.5.4. CVSSv3.1 8.6 (HIGH)

CWECWE 22TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-01-22
2026-01-22 17:16Z
HIGH

CVE-2025-69043 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-69043

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in goalthemes Rashy rashy allows PHP Local File Inclusion.This issue affects Rashy: from n/a through <= 1.1.3. CVSSv3.1 8.1 (HIGH)

CWECWE 98TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-01-22
2026-01-22 17:16Z
HIGH

CVE-2025-69042 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-69042

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in goalthemes Lindo lindo allows PHP Local File Inclusion.This issue affects Lindo: from n/a through <= 1.2.5. CVSSv3.1 8.1 (HIGH)

CWECWE 98TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-01-22
2026-01-22 17:16Z
HIGH

CVE-2025-69040 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-69040

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in goalthemes Bfres bfres allows PHP Local File Inclusion.This issue affects Bfres: from n/a through <= 1.2.1. CVSSv3.1 8.1 (HIGH)

CWECWE 98TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-01-22
2026-01-22 17:16Z
HIGH

CVE-2025-69039 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-69039

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in goalthemes Bailly bailly allows PHP Local File Inclusion.This issue affects Bailly: from n/a through <= 1.3.4. CVSSv3.1 8.1 (HIGH)

CWECWE 98TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-01-22
2026-01-22 17:16Z
HIGH

CVE-2025-68999 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-68999

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons allows Blind SQL Injection.This issue affects Happy Addons for Elementor: from n/a through <= 3.20.4. CVSSv3.1 8.5 (HIGH)

CWECWE 89TYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2026-01-22
2026-01-22 17:16Z
HIGH

CVE-2025-68912 — Limitation: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Harmonic

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-68912

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Harmonic Design HDForms hdforms allows Path Traversal.This issue affects HDForms: from n/a through <= 1.6.1. CVSSv3.1 8.6 (HIGH)

CWECWE 22TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-01-22
2026-01-22 17:16Z
HIGH

CVE-2025-68901 — Limitation: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AivahThemes

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-68901

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AivahThemes Anona anona allows Path Traversal.This issue affects Anona: from n/a through <= 8.0. CVSSv3.1 8.6 (HIGH)

CWECWE 22TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-01-22
2026-01-22 17:16Z
CRIT

CVE-2025-68034 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-68034

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CleverReach® CleverReach® WP cleverreach-wp allows SQL Injection.This issue affects CleverReach® WP: from n/a through <= 1.5.21. CVSSv3.1 9.3 (CRITICAL)

CWECWE 89TYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2026-01-22
2026-01-22 17:16Z
CRIT

CVE-2025-68001 — Upload: Unrestricted Upload of File with Dangerous Type vulnerability in garidium g-FFL Checkout g-ffl-checkout allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-68001

Unrestricted Upload of File with Dangerous Type vulnerability in garidium g-FFL Checkout g-ffl-checkout allows Upload a Web Shell to a Web Server.This issue affects g-FFL Checkout: from n/a through <= 2.1.0. CVSSv3.1 10.0 (CRITICAL)

CWECWE 434TYPVulnerability
10.0
CVSS v3.1
100
Edit Score