Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-15 12:04Z
2026-01-21
2026-01-21 18:16Z
HIGH

CVE-2026-0834 — Tp-link Archer_ax53_firmware: Logic vulnerability in TP-Link Archer C20 v5, 6.0, Archer AX53 v1.0 and TL-WR841N v13

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-0834

Logic vulnerability in TP-Link Archer C20 v5, 6.0, Archer AX53 v1.0 and TL-WR841N v13 (TDDP module) allows unauthenticated adjacent attackers to execute administrative commands including factory reset and device reboot without credentials. Attackers on the adjacent network can remotely trigger factory resets and reboots without credentials, causing configuration loss and interruption of device availability.This issue affects Archer C20 v6.0 < V6_251031, Archer C20 v5 <EU_V5_2 CVSSv3.1 8.8 (HIGH)

CWECWE 290VNDTp LinkVNDLogicTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-01-21
2026-01-21 17:00Z
CRIT

Task Failed Successfully – Microsoft’s “Immediate” Retirement of MDT

SpecterOps·specterops.io

SpecterOps researcher Garrett Foster disclosed critical vulnerabilities in Microsoft Deployment Toolkit (MDT) that enable unauthenticated credential theft and lateral movement. Rather than patch the issues, Microsoft chose to retire MDT entirely as of January 6, 2026, leaving enterprises with unpatched systems. The attack chain combines unauthenticated WDS/PXE discovery, XXE injection in the MDT monitoring service, and authentication coercion to extract privileged service account credentials.

SRFOsTACTA0001SRFNetworkTACTA0006VNDMicrosoftTYPResearchTYPVulnerabilitySTGInitial Access
92
Edit Score
2026-01-21
2026-01-21 07:16Z
CRIT

CVE-2026-24061 — Gnu Inetutils: telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root"

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-24061in the wild

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable. CVSSv3.1 9.8 (CRITICAL) · EPSS 100th percentile

CWECWE 88VNDGnuTYPVulnerabilitySTAitw exploited
9.8
CVSS v3.1
100
Edit Score
2026-01-21
2026-01-21 04:03Z
CRIT

Pwn2Own Automotive 2026 - Day One Results

Zero Day Initiative·thezdi.com0day

Pwn2Own Automotive 2026 Day One concluded with 37 unique 0-days disclosed across automotive infotainment systems, EV chargers, and Tesla components. Researchers exploited memory corruption vulnerabilities (stack/heap overflows, out-of-bounds writes), authentication bypasses, hardcoded credentials, and command injection flaws to achieve root-level code execution and charging signal manipulation. Total prize pool awarded: $516,500 USD.

SRFApplicationTACTA0004TACTA0002OSLinuxVNDTeslaVNDKenwoodVNDAlpitronicVNDAutel
92
Edit Score
2026-01-20
2026-01-20 22:15Z
CRIT

CVE-2026-21962 — Oracle Http_server: Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-21962

Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in. While the v CVSSv3.1 10.0 (CRITICAL) · EPSS 99th percentile

CWECWE 284VNDOracleVNDVulnerabilityTYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2026-01-20
2026-01-20 21:16Z
CRIT

CVE-2025-55130 — Nodejs Node.js: A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-55130

A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission m CVSSv3.1 9.1 (CRITICAL)

CWECWE 289CWECWE 281TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-01-20
2026-01-20 19:15Z
CRIT

CVE-2025-56005 — Dabeaz Ply: An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-56005

An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `yacc()` function. This parameter accepts a `.pkl` file that is deserialized with `pickle.load()` without validation. Because `pickle` allows execution of embedded code via `__reduce__()`, an attacker can achieve code execution by passing a malicious pickle file. The parameter is not mentioned in official documentation or the Gi CVSSv3.1 9.8 (CRITICAL)

CWECWE 502VNDDabeazTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-01-20
2026-01-20 17:00Z
HIGH

Updates to the MSSQLHound OpenGraph Collector for BloodHound

SpecterOps·specterops.ioCVE-2025-49758

SpecterOps released updates to MSSQLHound, a BloodHound OpenGraph collector that now detects NTLM relay attack susceptibility by scanning for Extended Protection for Authentication (EPA) settings on MSSQL servers. The tool also identifies CVE-2025-49758, a privilege escalation flaw allowing ALTER ANY LOGIN permission holders to change passwords for securityadmin principals without knowing the old password, enabling server compromise. New BloodHound Cypher queries enable visualization of attack paths from domain principals to MSSQL compromise.

SRFApplicationTACTA0007SRFIdentityTACTA0008VNDMicrosoftVNDSpecteropsTYPResearchTYPTool
78
Edit Score
2026-01-20
2026-01-20 01:15Z
HIGH

CVE-2026-23950 — Isaacs Tar: node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-23950

node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the `path-reservations` system. On case-insensitive or normalization-insensitive filesystems (such as macOS APFS, In which it has been tested), the library fails to lock colliding paths (e.g., `ß` and `ss`), allowing them to be processed in parallel. This bypasses the library's internal concurrency safeguards CVSSv3.1 8.8 (HIGH)

CWECWE 352CWECWE 367CWECWE 176VNDIsaacsVNDTarTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-01-20
2026-01-20 01:15Z
HIGH

CVE-2026-23876 — Imagemagick Imagemagick: Prior to versions 7.1.2-13 and 6.9.13-38, a heap buffer overflow vulnerability in the XBM

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-23876

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-13 and 6.9.13-38, a heap buffer overflow vulnerability in the XBM image decoder (ReadXBMImage) allows an attacker to write controlled data past the allocated heap buffer when processing a maliciously crafted image file. Any operation that reads or identifies an image can trigger the overflow, making it exploitable via common image upload and processing pipeli CVSSv3.1 8.1 (HIGH)

CWECWE 787CWECWE 122CWECWE 190VNDImagemagickTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-01-19
2026-01-19 18:16Z
CRIT

CVE-2026-23884 — Freerdp Freerdp: A malicious server can trigger a client‑side use after free, causing a crash (DoS)

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-23884

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, offscreen bitmap deletion leaves `gdi->drawing` pointing to freed memory, causing UAF when related update packets arrive. A malicious server can trigger a client‑side use after free, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue. CVSSv3.1 9.8 (CRITICAL)

CWECWE 416VNDFreerdpTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-01-19
2026-01-19 18:16Z
CRIT

CVE-2026-23883 — Freerdp Freerdp: A malicious server can trigger a client‑side use after free, causing a crash (DoS)

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-23883

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, `xf_Pointer_New` frees `cursorPixels` on failure, then `pointer_free` calls `xf_Pointer_Free` and frees it again, triggering ASan UAF. A malicious server can trigger a client‑side use after free, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue. CVSSv3.1 9.8 (CRITICAL)

CWECWE 416VNDFreerdpTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-01-19
2026-01-19 18:16Z
CRIT

CVE-2026-23534 — Freerdp Freerdp: Prior to version 3.21.0, a client-side heap buffer overflow occurs in the ClearCodec bands

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-23534

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the ClearCodec bands decode path when crafted band coordinates allow writes past the end of the destination surface buffer. A malicious server can trigger a client‑side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 c CVSSv3.1 9.8 (CRITICAL)

CWECWE 122VNDFreerdpTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-01-19
2026-01-19 18:16Z
CRIT

CVE-2026-23533 — Freerdp Freerdp: Prior to version 3.21.0, a client-side heap buffer overflow occurs in the RDPGFX ClearCodec

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-23533

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the RDPGFX ClearCodec decode path when maliciously crafted residual data causes out-of-bounds writes during color output. A malicious server can trigger a client‑side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 con CVSSv3.1 9.8 (CRITICAL)

CWECWE 122VNDFreerdpTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-01-19
2026-01-19 18:16Z
CRIT

CVE-2026-22797 — OpenStack: An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-22797

An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged identity headers such as X-Is-Admin-Project, X-Roles, or X-User-Id, an authenticated attacker may escalate privileges or impersonate other users. All deployments using the external_ CVSSv3.1 9.9 (CRITICAL)

CWECWE 290VNDOpenstackTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-01-19
2026-01-19 17:15Z
CRIT

CVE-2026-23532 — Freerdp Freerdp: Prior to version 3.21.0, a client-side heap buffer overflow occurs in the FreeRDP client’s

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-23532

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the FreeRDP client’s `gdi_SurfaceToSurface` path due to a mismatch between destination rectangle clamping and the actual copy size. A malicious server can trigger a client‑side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version CVSSv3.1 9.8 (CRITICAL)

CWECWE 122VNDFreerdpTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-01-19
2026-01-19 17:15Z
CRIT

CVE-2026-23531 — Freerdp Freerdp: Prior to version 3.21.0, in ClearCodec, when `glyphData` is present, `clear_decompress` calls `freerdp_image_copy_no_overlap` without

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-23531

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, in ClearCodec, when `glyphData` is present, `clear_decompress` calls `freerdp_image_copy_no_overlap` without validating the destination rectangle, allowing an out-of-bounds read/write via crafted RDPGFX surface updates. A malicious server can trigger a client‑side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator beh CVSSv3.1 9.8 (CRITICAL)

CWECWE 122VNDFreerdpTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-01-19
2026-01-19 17:15Z
CRIT

CVE-2026-23530 — Freerdp Freerdp: A malicious server can trigger a client‑side heap buffer overflow, causing a crash (DoS)

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-23530

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0,`freerdp_bitmap_decompress_planar` does not validate `nSrcWidth`/`nSrcHeight` against `planar->maxWidth`/`maxHeight` before RLE decode. A malicious server can trigger a client‑side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue. CVSSv3.1 9.8 (CRITICAL)

CWECWE 122VNDFreerdpTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-01-19
2026-01-19 16:15Z
HIGH

CVE-2026-22031 — Fastify Fastify\/middie: @fastify/middie is the plugin that adds middleware support on steroids to Fastify.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-22031

@fastify/middie is the plugin that adds middleware support on steroids to Fastify. A security vulnerability exists in @fastify/middie prior to version 9.1.0 where middleware registered with a specific path prefix can be bypassed using URL-encoded characters (e.g., `/%61dmin` instead of `/admin`). While the middleware engine fails to match the encoded path and skips execution, the underlying Fastify router correctly decodes the path and matches the route handler, allowing atta CVSSv3.1 8.4 (HIGH) · EPSS 29th percentile

CWECWE 177VNDFastifyTYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-01-19
2026-01-19 00:00Z
HIGH

From Extension to Infection: An In-Depth Analysis of the Evelyn Stealer Campaign Targeting Software Developers

Trend Micro Research·trendmicro.comin the wild

Trend Micro published an in-depth technical analysis of the Evelyn Stealer campaign, a multistage malware operation targeting software developers via weaponized Visual Studio Code extensions. The attack chain uses a malicious VSC extension to deploy a downloader (Lightshot.dll), which fetches a process-hollowing injector that decrypts and injects the final Evelyn Stealer payload into grpconv.exe. Evelyn implements sophisticated anti-analysis techniques, browser credential theft via DLL injection, cryptocurrency wallet harvesting, and FTP-based exfiltration of collected data.

SRFApplicationSRFOsTACTA0005TACTA0001TACTA0002TACTA0006TACTA0009VNDMicrosoft
78
Edit Score
2026-01-18
2026-01-18 00:15Z
HIGH

wpair-app — WPair is a defensive security research tool that demonstrates the CVE-2025-36911 (eg WhisperPair) vulnerability in Googl

GitHub · recent CVE PoCs·github.comGITHUB POCCVE-2025-36911in the wild

WPair is a public proof-of-concept tool demonstrating CVE-2025-36911 (WhisperPair), a critical authentication bypass in Google's Fast Pair Bluetooth protocol affecting millions of audio devices. The vulnerability allows unauthenticated attackers to pair with vulnerable devices, establish HFP connections, and access microphone streams without user consent. The tool includes a vulnerability scanner, full exploit chain, and audio capture capabilities targeting JBL, Sony, Marshall, and other major manufacturers.

SRFMobileTACTA0001TACTA0006VNDGoogleTYPResearchTYPToolTYPExploitSTGInitial Access
82
Edit Score
2026-01-16
2026-01-16 17:34Z
INFO

v1.6.6

Sliver releases·github.com

Sliver v1.6.6 released with minor improvements to error handling in directory listing operations and TUI/advanced forms. This is a routine maintenance release with 400 commits since v1.6.5, containing no disclosed security fixes or feature additions of note.

SRFOsVNDBishop FoxTYPTool
25
Edit Score
2026-01-16
2026-01-16 17:00Z
HIGH

One WSL BOF to Rule Them All

SpecterOps·specterops.io

SpecterOps released a Beacon Object File (BOF) that enables reliable command execution across all WSL2 versions by reverse-engineering the COM interface variations in WslServiceProxyStub.dll. The tool addresses the challenge of WSL2's unmonitored execution environment by dynamically detecting WSL version and applying the correct interface definition, allowing attackers to pivot from monitored Windows hosts into isolated Linux VMs with minimal detection risk.

SRFApplicationSRFOsTACTA0007TACTA0008TYPResearchTYPToolTYPWriteupSTGDiscovery
82
Edit Score
2026-01-16
2026-01-16 03:15Z
CRIT

CVE-2025-62582 — Deltaww Diaview: Delta Electronics DIAView has multiple vulnerabilities.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-62582

Delta Electronics DIAView has multiple vulnerabilities. CVSSv3.1 9.8 (CRITICAL) · EPSS 6th percentile

CWECWE 306VNDDeltaVNDDeltawwTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-01-16
2026-01-16 03:15Z
CRIT

CVE-2025-62581 — Deltaww Diaview: Delta Electronics DIAView has multiple vulnerabilities.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-62581

Delta Electronics DIAView has multiple vulnerabilities. CVSSv3.1 9.8 (CRITICAL) · EPSS 8th percentile

CWECWE 321VNDDeltaVNDDeltawwTYPVulnerability
9.8
CVSS v3.1
99
Edit Score