Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-15 13:44Z
2026-01-13
2026-01-13 19:16Z
HIGH

CVE-2026-21280 — Adobe Illustrator: versions 29.8.3, 30.0 and earlier are affected by an Untrusted Search Path vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-21280

Illustrator versions 29.8.3, 30.0 and earlier are affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. If the application uses a search path to locate critical resources such as programs, an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. Exploitation of this issue requires user interaction in that a victim must open a mali CVSSv3.1 8.6 (HIGH) · EPSS 13th percentile

CWECWE 426VNDAdobeVNDIllustratorTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-01-13
2026-01-13 19:16Z
HIGH

CVE-2026-21272 — Adobe Dreamweaver: Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-21272

Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system write. An attacker could leverage this vulnerability to manipulate or inject malicious data into files on the system. Exploitation of this issue requires user interaction in that a victim must open a malicious file and scope is changed. CVSSv3.1 8.6 (HIGH)

CWECWE 20VNDAdobeVNDDreamweaverTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-01-13
2026-01-13 19:16Z
HIGH

CVE-2026-21271 — Adobe Dreamweaver: Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-21271

Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file and scope is changed. CVSSv3.1 8.6 (HIGH) · EPSS 13th percentile

CWECWE 20VNDAdobeVNDDreamweaverTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-01-13
2026-01-13 19:16Z
HIGH

CVE-2026-21268 — Adobe Dreamweaver: Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-21268

Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file and scope is changed. CVSSv3.1 8.6 (HIGH) · EPSS 13th percentile

CWECWE 20VNDAdobeVNDDreamweaverTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-01-13
2026-01-13 19:16Z
HIGH

CVE-2026-21267 — Adobe Dreamweaver: Desktop versions 21.6 and earlier are affected by an Improper Neutralization of Special

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-21267

Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue requires user interaction in that a victim must open a malicious file and scope is changed. CVSSv3.1 8.6 (HIGH) · EPSS 52th percentile

CWECWE 78VNDAdobeVNDDreamweaverTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-01-13
2026-01-13 18:16Z
HIGH

CVE-2026-20931 — Microsoft Windows_10_1607: External control of file name or path in Windows Telephony Service allows an authorized

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-20931

External control of file name or path in Windows Telephony Service allows an authorized attacker to elevate privileges over an adjacent network. CVSSv3.1 8.0 (HIGH) · EPSS 74th percentile

CWECWE 73VNDMicrosoftTYPVulnerability
8.0
CVSS v3.1
90
Edit Score
2026-01-13
2026-01-13 18:16Z
MED

CVE-2026-20925 — Microsoft Windows_10_1607: External control of file name or path in Windows NTLM allows an unauthorized attacker

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-20925

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network. CVSSv3.1 6.5 (MEDIUM) · EPSS 97th percentile

CWECWE 73VNDMicrosoftTYPVulnerability
6.5
CVSS v3.1
88
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-01-13
2026-01-13 18:16Z
MED

CVE-2026-20872 — Microsoft Windows_10_1607: External control of file name or path in Windows NTLM allows an unauthorized attacker

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-20872

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network. CVSSv3.1 6.5 (MEDIUM) · EPSS 97th percentile

CWECWE 73VNDMicrosoftTYPVulnerability
6.5
CVSS v3.1
88
Edit Score
2026-01-13
2026-01-13 18:16Z
HIGH

CVE-2026-20868 — Microsoft Windows_10_1607: Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-20868

Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network. CVSSv3.1 8.8 (HIGH) · EPSS 68th percentile

CWECWE 122VNDMicrosoftVNDHeapTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-01-13
2026-01-13 18:16Z
HIGH

CVE-2026-20856 — Microsoft Windows_10_1607: Improper input validation in Windows Server Update Service allows an unauthorized attacker to execute

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-20856

Improper input validation in Windows Server Update Service allows an unauthorized attacker to execute code over a network. CVSSv3.1 8.1 (HIGH) · EPSS 62th percentile

CWECWE 20VNDMicrosoftTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-01-13
2026-01-13 18:16Z
MED

CVE-2026-20805 — Microsoft Windows_10_1607: Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-20805in the wild

Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally. CVSSv3.1 5.5 (MEDIUM) · EPSS 91th percentile

CWECWE 200VNDMicrosoftTYPVulnerabilitySTAitw exploited
5.5
CVSS v3.1
79
Edit Score
2026-01-13
2026-01-13 17:15Z
HIGH

CVE-2025-25249 — Fortinet Fortios: A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-25249

A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets CVSSv3.1 8.1 (HIGH) · EPSS 4th percentile

CWECWE 787CWECWE 122VNDFortinetTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-01-13
2026-01-13 17:00Z
HIGH

Introducing ConfigManBearPig, a BloodHound OpenGraph Collector for SCCM

SpecterOps·specterops.io

SpecterOps released ConfigManBearPig, a BloodHound OpenGraph collector that enumerates Microsoft Configuration Manager (SCCM) infrastructure to identify 30+ documented attack techniques. The tool integrates with BloodHound to visualize SCCM misconfigurations, hierarchy takeover paths, privilege escalation vectors, and credential theft opportunities through LDAP, DNS, remote registry, MSSQL, AdminService, and HTTP collection phases.

SRFApplicationSRFNetworkTACTA0006TACTA0007SRFIdentityTACTA0043VNDMicrosoftVNDSpecterops
87
Edit Score
2026-01-13
2026-01-13 16:16Z
CRIT

CVE-2025-71095 — Linux Linux_kernel: However, stmmac_xdp_xmit_back() does not check the memory type and always uses the page pool

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-71095

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix the crash issue for zero copy XDP_TX action There is a crash issue when running zero copy XDP_TX action, the crash log is shown below. [ 216.122464] Unable to handle kernel paging request at virtual address fffeffff80000000 [ 216.187524] Internal error: Oops: 0000000096000144 [#1] SMP [ 216.301694] Call trace: [ 216.304130] dcache_clean_poc+0x20/0x38 (P) [ 216.308308] __dma_sync_si CVSSv3.1 9.1 (CRITICAL) · EPSS 2th percentile

TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-01-13
2026-01-13 16:16Z
CRIT

CVE-2025-71093 — Linux Linux_kernel: If the descriptor- reported length is zero or larger than the actual RX buffer

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-71093

In the Linux kernel, the following vulnerability has been resolved: e1000: fix OOB in e1000_tbi_should_accept() In e1000_tbi_should_accept() we read the last byte of the frame via 'data[length - 1]' to evaluate the TBI workaround. If the descriptor- reported length is zero or larger than the actual RX buffer size, this read goes out of bounds and can hit unrelated slab objects. The issue is observed from the NAPI receive path (e1000_clean_rx_irq): ========================= CVSSv3.1 9.1 (CRITICAL) · EPSS 2th percentile

CWECWE 125TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-01-13
2026-01-13 16:16Z
HIGH

CVE-2025-71072 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: shmem: fix recovery on

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-71072

In the Linux kernel, the following vulnerability has been resolved: shmem: fix recovery on rename failures maple_tree insertions can fail if we are seriously short on memory; simple_offset_rename() does not recover well if it runs into that. The same goes for simple_offset_rename_exchange(). Moreover, shmem_whiteout() expects that if it succeeds, the caller will progress to d_move(), i.e. that shmem_rename2() won't fail past the successful call of shmem_whiteout(). Not ha CVSSv3.1 8.2 (HIGH) · EPSS 2th percentile

TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-01-13
2026-01-13 16:16Z
CRIT

CVE-2025-71068 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: svcrdma: bound check rq_pages

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-71068

In the Linux kernel, the following vulnerability has been resolved: svcrdma: bound check rq_pages index in inline path svc_rdma_copy_inline_range indexed rqstp->rq_pages[rc_curpage] without verifying rc_curpage stays within the allocated page array. Add guards before the first use and after advancing to a new page. CVSSv3.1 9.8 (CRITICAL) · EPSS 3th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-01-13
2026-01-13 16:16Z
HIGH

CVE-2025-68818 — Linux: But unlike the older code below it, this new code failed to check sp->cmd_type

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-68818

In the Linux kernel, the following vulnerability has been resolved: scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" This reverts commit 0367076b0817d5c75dfb83001ce7ce5c64d803a9. The commit being reverted added code to __qla2x00_abort_all_cmds() to call sp->done() without holding a spinlock. But unlike the older code below it, this new code failed to check sp->cmd_type and just assumed TYPE_SRB, which results in a jump to an invalid pointer CVSSv3.1 8.8 (HIGH) · EPSS 7th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-01-13
2026-01-13 16:16Z
CRIT

CVE-2025-68817 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-68817

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency Under high concurrency, A tree-connection object (tcon) is freed on a disconnect path while another path still holds a reference and later executes *_put()/write on it. CVSSv3.1 9.8 (CRITICAL) · EPSS 6th percentile

CWECWE 416TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-01-13
2026-01-13 16:16Z
CRIT

CVE-2025-68811 — Linux: In the Linux kernel, the following vulnerability has been resolved: svcrdma: use rc_pageoff for

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-68811

In the Linux kernel, the following vulnerability has been resolved: svcrdma: use rc_pageoff for memcpy byte offset svc_rdma_copy_inline_range added rc_curpage (page index) to the page base instead of the byte offset rc_pageoff. Use rc_pageoff so copies land within the current page. Found by ZeroPath (https://zeropath.com) CVSSv3.1 9.8 (CRITICAL) · EPSS 6th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-01-13
2026-01-13 16:16Z
CRIT

CVE-2025-68809 — Linux: In the Linux kernel, the following vulnerability has been resolved: ksmbd: vfs: fix race

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-68809

In the Linux kernel, the following vulnerability has been resolved: ksmbd: vfs: fix race on m_flags in vfs_cache ksmbd maintains delete-on-close and pending-delete state in ksmbd_inode->m_flags. In vfs_cache.c this field is accessed under inconsistent locking: some paths read and modify m_flags under ci->m_lock while others do so without taking the lock at all. Examples: - ksmbd_query_inode_status() and __ksmbd_inode_close() use ci->m_lock when checking or updating m_ CVSSv3.1 9.1 (CRITICAL) · EPSS 6th percentile

TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-01-13
2026-01-13 16:16Z
HIGH

CVE-2025-68803 — Linux: In the Linux kernel, the following vulnerability has been resolved: NFSD: NFSv4 file creation

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-68803

In the Linux kernel, the following vulnerability has been resolved: NFSD: NFSv4 file creation neglects setting ACL An NFSv4 client that sets an ACL with a named principal during file creation retrieves the ACL afterwards, and finds that it is only a default ACL (based on the mode bits) and not the ACL that was requested during file creation. This violates RFC 8881 section 6.4.1.3: "the ACL attribute is set as given". The issue occurs in nfsd_create_setattr(), which calls n CVSSv3.1 8.0 (HIGH) · EPSS 7th percentile

TYPVulnerability
8.0
CVSS v3.1
90
Edit Score
2026-01-13
2026-01-13 16:16Z
HIGH

CVE-2025-68799 — Linux: This can lead to memory exhaustion and kernel instability, potential information disclosure if padding

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-68799

In the Linux kernel, the following vulnerability has been resolved: caif: fix integer underflow in cffrml_receive() The cffrml_receive() function extracts a length field from the packet header and, when FCS is disabled, subtracts 2 from this length without validating that len >= 2. If an attacker sends a malicious packet with a length field of 0 or 1 to an interface with FCS disabled, the subtraction causes an integer underflow. This can lead to memory exhaustion and kern CVSSv3.1 8.1 (HIGH) · EPSS 7th percentile

TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-01-13
2026-01-13 16:16Z
CRIT

CVE-2025-68794 — Linux: This causes too many bytes to be skipped for uptodate blocks, which results in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-68794

In the Linux kernel, the following vulnerability has been resolved: iomap: adjust read range correctly for non-block-aligned positions iomap_adjust_read_range() assumes that the position and length passed in are block-aligned. This is not always the case however, as shown in the syzbot generated case for erofs. This causes too many bytes to be skipped for uptodate blocks, which results in returning the incorrect position and length to read in. If all the blocks are uptodate CVSSv3.1 9.8 (CRITICAL) · EPSS 6th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-01-13
2026-01-13 16:15Z
CRIT

CVE-2025-68775 — Linux: In the Linux kernel, the following vulnerability has been resolved: net/handshake: duplicate handshake cancellations

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-68775

In the Linux kernel, the following vulnerability has been resolved: net/handshake: duplicate handshake cancellations leak socket When a handshake request is cancelled it is removed from the handshake_net->hn_requests list, but it is still present in the handshake_rhashtbl until it is destroyed. If a second cancellation request arrives for the same handshake request, then remove_pending() will return false... and assuming HANDSHAKE_F_REQ_COMPLETED isn't set in req->hr_flags CVSSv3.1 9.8 (CRITICAL) · EPSS 6th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score