Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-15 12:50Z
2026-01-15
2026-01-15 20:16Z
HIGH

CVE-2026-23622 — Easyappointments Easy\!appointments: In 1.5.2 and earlier, application/core/EA_Security.php::csrf_verify() only enforces CSRF for POST requests and returns early

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-23622

Easy!Appointments is a self hosted appointment scheduler. In 1.5.2 and earlier, application/core/EA_Security.php::csrf_verify() only enforces CSRF for POST requests and returns early for non-POST methods. Several application endpoints perform state-changing operations while accepting parameters from GET (or $_REQUEST), so an attacker can perform CSRF by forcing a victim's browser to issue a crafted GET request. Impact: creation of admin accounts, modification of admin email/p CVSSv3.1 8.8 (HIGH) · EPSS 1th percentile

CWECWE 352VNDEasyappointmentsTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-01-15
2026-01-15 20:16Z
HIGH

CVE-2026-23527 — H3 H3: Prior to 1.15.5, there is a critical HTTP Request Smuggling vulnerability.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-23527

H3 is a minimal H(TTP) framework built for high performance and portability. Prior to 1.15.5, there is a critical HTTP Request Smuggling vulnerability. readRawBody is doing a strict case-sensitive check for the Transfer-Encoding header. It explicitly looks for "chunked", but per the RFC, this header should be case-insensitive. This vulnerability is fixed in 1.15.5. CVSSv3.1 8.9 (HIGH)

CWECWE 444VNDH3VNDTtpTYPVulnerability
8.9
CVSS v3.1
95
Edit Score
2026-01-15
2026-01-15 17:00Z
HIGH

MSSQL and SCCM Elevation of Privilege Vulnerabilities

SpecterOps·specterops.ioCVE-2025-49758CVE-2025-47179

SpecterOps researcher Chris Thompson disclosed two privilege escalation vulnerabilities: CVE-2025-49758 in MSSQL Server (CVSS 8.8) allowing ALTER ANY LOGIN permission holders to reset securityadmin passwords and escalate to sysadmin, and CVE-2025-47179 in Configuration Manager (CVSS 6.7) allowing CMPivot Administrator role members to grant themselves Full Administrator access. Both vulnerabilities stem from overly permissive role configurations and have been patched; detection capabilities were added to BloodHound and MSSQLHound.

SRFApplicationSRFOsTACTA0004TACTA0005VNDMicrosoftVNDBloodhoundTYPResearchTYPWriteup
82
Edit Score
2026-01-15
2026-01-15 16:16Z
HIGH

CVE-2021-47763 — Aimeos: 2021.10 LTS contains a SQL injection vulnerability in the json api 'sort' parameter

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-47763

Aimeos 2021.10 LTS contains a SQL injection vulnerability in the json api 'sort' parameter that allows attackers to inject malicious database queries. Attackers can manipulate the sort parameter to reveal table and column names by sending crafted GET requests to the jsonapi/review endpoint. CVSSv3.1 8.2 (HIGH) · EPSS 25th percentile

CWECWE 89VNDAimeosTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-01-15
2026-01-15 12:54Z
INFO

EntraGoat — A deliberately vulnerable Microsoft Entra ID environment. Learn identity security through hands-on, realistic attack cha

GitHub · Azure / Entra tools·github.comGITHUB POC

EntraGoat is a deliberately vulnerable Microsoft Entra ID lab environment released by Semperis, designed to teach identity security through hands-on attack scenarios. The tool deploys realistic misconfigurations and privilege escalation paths using PowerShell and Microsoft Graph APIs, with multiple challenge scenarios covering service principal abuse, app-only permissions exploitation, and certificate-based authentication attacks.

TACTA0004TACTA0005TACTA0001SRFIdentitySRFCloudVNDMicrosoftTYPResearchTYPTool
72
Edit Score
2026-01-15
2026-01-15 00:00Z
CRIT

Introducing ÆSIR: Finding Zero-Day Vulnerabilities at the Speed of AI

Trend Micro Research·trendmicro.comCVE-2025-33184CVE-2025-33183CVE-2025-23298CVE-2025-23296CVE-2025-33185CVE-2025-23357CVE-2025-11202CVE-2025-12489CVE-2025-11200CVE-2025-13709CVE-2025-13711CVE-2025-13706CVE-2025-13708CVE-2025-13716CVE-2025-13714CVE-2025-13710CVE-2025-13707CVE-2025-13712CVE-2025-13713

Trend Micro's ÆSIR platform, combining AI-assisted vulnerability discovery with human oversight, has identified 21 critical CVEs across NVIDIA, Tencent, MLflow, and MCP tooling since mid-2025. The research demonstrates systematic exploitation of deserialization, authentication bypass, and command injection flaws in foundational AI infrastructure, with particular emphasis on patch bypass identification in NVIDIA Isaac GR00T. The platform's dual-component architecture (MIMIR for threat intelligence, FENRIR for zero-day discovery) operates at machine speed while maintaining human-directed validation and responsible disclosure.

SRFApplicationTACTA0001SRFAiVNDNvidiaVNDMlflowVNDTencentTYPResearchTYPTool
82
Edit Score
2026-01-14
2026-01-14 18:16Z
CRIT

CVE-2026-22859 — Freerdp Freerdp: Prior to 3.20.1, the URBDRC client does not perform bounds checking on server‑supplied MSUSB_INTERFACE_DESCRIPTOR

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-22859

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, the URBDRC client does not perform bounds checking on server‑supplied MSUSB_INTERFACE_DESCRIPTOR values and uses them as indices in libusb_udev_complete_msconfig_setup, causing an out‑of‑bounds read. This vulnerability is fixed in 3.20.1. CVSSv3.1 9.1 (CRITICAL)

CWECWE 125CWECWE 129VNDFreerdpTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-01-14
2026-01-14 18:16Z
CRIT

CVE-2026-22858 — Freerdp Freerdp: As a result, non-ASCII bytes (e.g., 0x80-0xFF) may bypass the intended range restriction and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-22858

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, global-buffer-overflow was observed in FreeRDP's Base64 decoding path. The root cause appears to be implementation-defined char signedness: on Arm/AArch64 builds, plain char is treated as unsigned, so the guard c <= 0 can be optimized into a simple c != 0 check. As a result, non-ASCII bytes (e.g., 0x80-0xFF) may bypass the intended range restriction and be used as an index into a global lookup t CVSSv3.1 9.1 (CRITICAL)

CWECWE 125CWECWE 787CWECWE 758VNDFreerdpTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-01-14
2026-01-14 18:16Z
CRIT

CVE-2026-22855 — Freerdp Freerdp: Prior to 3.20.1, a heap out-of-bounds read occurs in the smartcard SetAttrib path when

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-22855

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap out-of-bounds read occurs in the smartcard SetAttrib path when cbAttrLen does not match the actual NDR buffer length. This vulnerability is fixed in 3.20.1. CVSSv3.1 9.1 (CRITICAL)

CWECWE 125VNDFreerdpTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-01-14
2026-01-14 18:16Z
CRIT

CVE-2026-22853 — Freerdp Freerdp: Prior to 3.20.1, RDPEAR’s NDR array reader does not perform bounds checking on the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-22853

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, RDPEAR’s NDR array reader does not perform bounds checking on the on‑wire element count and can write past the heap buffer allocated from hints, causing a heap buffer overflow in ndr_read_uint8Array. This vulnerability is fixed in 3.20.1. CVSSv3.1 9.8 (CRITICAL)

CWECWE 787VNDFreerdpTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-01-14
2026-01-14 18:01Z
CRIT

A 0-click exploit chain for the Pixel 9 Part 3: Where do we go from here?

Project Zero·googleprojectzero.blogspot.comCVE-2025-54957CVE-2025-36934in the wild

Project Zero published the third installment of their Pixel 9 0-click exploit chain analysis, detailing systemic vulnerabilities in Android's attack surface management, patch prioritization, and deployment timelines. The chain exploited CVE-2025-54957 (Dolby UDC memory corruption) and CVE-2025-36934 (BigWave driver privilege escalation) to achieve kernel code execution from untrusted audio messages—requiring only two bugs and taking ~11 person-weeks to develop. The post reveals critical gaps: the Dolby UDC vulnerability took 139 days to patch on any Android device and 82 days after public disclosure before Pixel patched it, Dolby's advisory significantly understated exploitability, and Android's severity matrix initially rated both bugs as Moderate despite their 0-click nature.

SRFOsTACTA0004SRFMobileTACTA0001TACTA0002VNDDolbyVNDGoogleVNDQualcomm
95
Edit Score
2026-01-14
2026-01-14 18:00Z
CRIT

A 0-click exploit chain for the Pixel 9 Part 2: Cracking the Sandbox with a Big Wave

Project Zero·googleprojectzero.blogspot.com

Project Zero discloses a complete 0-click exploit chain for Pixel 9 combining a Dolby decoder RCE with three BigWave driver vulnerabilities, culminating in kernel arbitrary read/write and SELinux bypass. The primary vulnerability is a use-after-free in the BigWave AV1 hardware decoder driver triggered by race conditions between ioctl timeout handling and worker thread job processing, patched January 5, 2026.

TACTA0004TACTA0005SRFMobileSRFFirmwareVNDGoogleVNDQualcommTYPResearchTYPWriteup
98
Edit Score
2026-01-14
2026-01-14 17:59Z
CRIT

A 0-click exploit chain for the Pixel 9 Part 1: Decoding Dolby

Project Zero·googleprojectzero.blogspot.comCVE-2025-54957CVE-2025-36934CVE-2025-49415in the wild

Project Zero disclosed a complete 0-click exploit chain for Pixel 9 targeting the Dolby Unified Decoder (CVE-2025-54957), an integer overflow in EMDF payload parsing that enables arbitrary heap writes. The vulnerability exists in the 0-click attack surface via automatic audio transcription in Google Messages, affecting most Android devices. Part 1 details exploitation of the decoder to achieve mediacodec RCE through heap layout manipulation and function pointer overwriting.

SRFOsTACTA0004SRFMobileTACTA0001TACTA0002VNDDolbyVNDGoogleTYPResearch
98
Edit Score
2026-01-14
2026-01-14 17:00Z
CRIT

Wait, Why is my WebClient Started?: SCCM Hierarchy Takeover via NTLM Relay to LDAP

SpecterOps·specterops.io

SpecterOps researchers discovered a critical SCCM hierarchy takeover primitive combining automatic client push installation with WebDav/HTTP NTLM relay to LDAP. The attack exploits the site server's automatic share mapping behavior (WNetAddConnection2 API) during client push, which triggers WebClient startup and coerces HTTP NTLM authentication from either the client push account or the site server machine account. Successful exploitation requires WebClient installation on the site server, automatic client push enabled, NTLM fallback enabled, and disabled LDAP signing/channel binding—conditions common in enterprise deployments.

SRFApplicationTACTA0004TACTA0001SRFIdentityTACTA0008VNDMicrosoftTYPResearchTYPTechnique
92
Edit Score
2026-01-14
2026-01-14 15:16Z
CRIT

CVE-2025-71116 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: libceph: make decode_pool() more

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-71116

In the Linux kernel, the following vulnerability has been resolved: libceph: make decode_pool() more resilient against corrupted osdmaps If the osdmap is (maliciously) corrupted such that the encoded length of ceph_pg_pool envelope is less than what is expected for a particular encoding version, out-of-bounds reads may ensue because the only bounds check that is there is based on that length value. This patch adds explicit bounds checks for each field that is decoded or sk CVSSv3.1 9.1 (CRITICAL) · EPSS 3th percentile

CWECWE 125TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-01-14
2026-01-14 15:16Z
HIGH

CVE-2025-71112 — Linux Linux_kernel: It may cause out-of-bounds memory access once the VLAN id is bigger than or

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-71112

In the Linux kernel, the following vulnerability has been resolved: net: hns3: add VLAN id validation before using Currently, the VLAN id may be used without validation when receive a VLAN configuration mailbox from VF. The length of vlan_del_fail_bmap is BITS_TO_LONGS(VLAN_N_VID). It may cause out-of-bounds memory access once the VLAN id is bigger than or equal to VLAN_N_VID. Therefore, VLAN id needs to be checked to ensure it is within the range of VLAN_N_VID. CVSSv3.1 8.8 (HIGH) · EPSS 3th percentile

CWECWE 125TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-01-14
2026-01-14 11:15Z
HIGH

CVE-2026-0532 — External: Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918)

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-0532

External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure through a specially crafted credentials JSON payload in the Google Gemini connector configuration. This requires an attacker to have authenticated access with privileges sufficient to create or modify connectors (Alerts & Connectors: All). The server processes a configuration without proper validation, allowing for arbitra CVSSv3.1 8.6 (HIGH)

CWECWE 918TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-01-14
2026-01-14 09:16Z
CRIT

CVE-2026-23550 — Incorrect: Privilege Assignment vulnerability in Modular DS Modular DS modular-connector allows Privilege Escalation.This issue

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-23550

Incorrect Privilege Assignment vulnerability in Modular DS Modular DS modular-connector allows Privilege Escalation.This issue affects Modular DS: from n/a through <= 2.5.1. CVSSv3.1 9.8 (CRITICAL)

CWECWE 266TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-01-13
2026-01-13 23:59Z
HIGH

MAAD-AF — MAAD Attack Framework - An attack tool for simple, fast & effective security testing of M365 & Entra ID (Azure AD).

GitHub · Azure / Entra tools·github.comGITHUB POC

Vectra AI Research released MAAD-AF (MAAD Attack Framework), an open-source PowerShell-based attack emulation tool for Microsoft 365 and Entra ID environments. The framework enables security testing across Exchange Online, Teams, SharePoint, and eDiscovery with techniques including credential brute-forcing, MFA manipulation, mailbox audit bypass, mail forwarding exfiltration, and cross-tenant synchronization exploitation.

TACTA0004TACTA0005TACTA0001TACTA0006TACTA0007SRFIdentityTACTA0003SRFCloud
78
Edit Score
2026-01-13
2026-01-13 23:16Z
CRIT

CVE-2023-54335 — Extplorer Extplorer: 2.1.14 contains an authentication bypass vulnerability that allows attackers to login without a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-54335

eXtplorer 2.1.14 contains an authentication bypass vulnerability that allows attackers to login without a password by manipulating the login request. Attackers can exploit this flaw to upload malicious PHP files and execute remote commands on the vulnerable file management system. CVSSv3.1 9.8 (CRITICAL) · EPSS 93th percentile

CWECWE 306VNDExtplorerTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2026-01-13
2026-01-13 19:16Z
HIGH

CVE-2026-21280 — Adobe Illustrator: versions 29.8.3, 30.0 and earlier are affected by an Untrusted Search Path vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-21280

Illustrator versions 29.8.3, 30.0 and earlier are affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. If the application uses a search path to locate critical resources such as programs, an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. Exploitation of this issue requires user interaction in that a victim must open a mali CVSSv3.1 8.6 (HIGH) · EPSS 13th percentile

CWECWE 426VNDAdobeVNDIllustratorTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-01-13
2026-01-13 19:16Z
HIGH

CVE-2026-21272 — Adobe Dreamweaver: Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-21272

Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system write. An attacker could leverage this vulnerability to manipulate or inject malicious data into files on the system. Exploitation of this issue requires user interaction in that a victim must open a malicious file and scope is changed. CVSSv3.1 8.6 (HIGH)

CWECWE 20VNDAdobeVNDDreamweaverTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-01-13
2026-01-13 19:16Z
HIGH

CVE-2026-21271 — Adobe Dreamweaver: Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-21271

Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file and scope is changed. CVSSv3.1 8.6 (HIGH) · EPSS 13th percentile

CWECWE 20VNDAdobeVNDDreamweaverTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-01-13
2026-01-13 19:16Z
HIGH

CVE-2026-21268 — Adobe Dreamweaver: Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-21268

Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file and scope is changed. CVSSv3.1 8.6 (HIGH) · EPSS 13th percentile

CWECWE 20VNDAdobeVNDDreamweaverTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-01-13
2026-01-13 19:16Z
HIGH

CVE-2026-21267 — Adobe Dreamweaver: Desktop versions 21.6 and earlier are affected by an Improper Neutralization of Special

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-21267

Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue requires user interaction in that a victim must open a malicious file and scope is changed. CVSSv3.1 8.6 (HIGH) · EPSS 52th percentile

CWECWE 78VNDAdobeVNDDreamweaverTYPVulnerability
8.6
CVSS v3.1
93
Edit Score