opsecsafe — cyber intelligence

2026-01-08

2026-01-08 13:15Z

HIGH

CVE-2026-0719 — This results in incorrect memory allocation on the stack, followed by unsafe memory copying.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-0719

A flaw was identified in the NTLM authentication handling of the libsoup HTTP library, used by GNOME and other applications for network communication. When processing extremely long passwords, an internal size calculation can overflow due to improper use of signed integers. This results in incorrect memory allocation on the stack, followed by unsafe memory copying. As a result, applications using libsoup may crash unexpectedly, creating a denial-of-service risk. CVSSv3.1 8.6 (HIGH)

CWECWE 121TYPVulnerability

8.6

CVSS v3.1

Edit Score

2026-01-08

2026-01-08 13:15Z

CRIT

CVE-2025-69258 — Trendmicro Apex_central: A LoadLibraryEX vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-69258

A LoadLibraryEX vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to load an attacker-controlled DLL into a key executable, leading to execution of attacker-supplied code under the context of SYSTEM on affected installations. CVSSv3.1 9.8 (CRITICAL) · EPSS 89th percentile

CWECWE 120CWECWE 290CWECWE 346VNDTrendmicroVNDLoadlibraryexTYPVulnerability

9.8

CVSS v3.1

100

Edit Score

2026-01-08

2026-01-08 13:15Z

CRIT

CVE-2025-62877 — Projects: using the SUSE Virtualization (Harvester) environment may expose the OS default ssh login

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-62877

Projects using the SUSE Virtualization (Harvester) environment may expose the OS default ssh login password if they are using the 1.5.x or 1.6.x interactive installer to either create a new cluster or add new hosts to an existing cluster. The environment is not affected if the PXE boot mechanism is utilized along with the Harvester configuration setup. CVSSv3.1 9.8 (CRITICAL) · EPSS 42th percentile

CWECWE 1188VNDProjectsTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-01-08

2026-01-08 11:15Z

HIGH

CVE-2025-66001 — NeuVector: supports login authentication through OpenID Connect.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-66001

NeuVector supports login authentication through OpenID Connect. However, the TLS verification (which verifies the remote server's authenticity and integrity) for OpenID Connect is not enforced by default. As a result this may expose the system to man-in-the-middle (MITM) attacks. CVSSv3.1 8.8 (HIGH) · EPSS 28th percentile

CWECWE 295VNDNeuvectorTYPVulnerability

8.8

CVSS v3.1

Edit Score

2026-01-08

2026-01-08 10:15Z

HIGH

CVE-2025-67937 — Qodeinteractive Hendon: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-67937

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Hendon hendon allows PHP Local File Inclusion.This issue affects Hendon: from n/a through < 1.7. CVSSv3.1 8.1 (HIGH) · EPSS 41th percentile

CWECWE 98VNDQodeinteractiveTYPVulnerability

8.1

CVSS v3.1

Edit Score

2026-01-08

2026-01-08 10:15Z

HIGH

CVE-2025-67936 — Qodeinteractive Curly: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-67936

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Curly curly allows PHP Local File Inclusion.This issue affects Curly: from n/a through < 3.3. CVSSv3.1 8.1 (HIGH) · EPSS 41th percentile

CWECWE 98VNDQodeinteractiveTYPVulnerability

8.1

CVSS v3.1

Edit Score

2026-01-08

2026-01-08 10:15Z

HIGH

CVE-2025-67935 — Qodeinteractive Optimize: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-67935

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Optimize optimizewp allows PHP Local File Inclusion.This issue affects Optimize: from n/a through < 2.4. CVSSv3.1 8.1 (HIGH) · EPSS 39th percentile

CWECWE 98VNDQodeinteractiveTYPVulnerability

8.1

CVSS v3.1

Edit Score

2026-01-08

2026-01-08 10:15Z

HIGH

CVE-2025-67934 — Qodeinteractive Wellspring: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-67934

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Wellspring wellspring allows PHP Local File Inclusion.This issue affects Wellspring: from n/a through < 2.8. CVSSv3.1 8.1 (HIGH)

CWECWE 98VNDQodeinteractiveTYPVulnerability

8.1

CVSS v3.1

Edit Score

2026-01-08

2026-01-08 10:15Z

CRIT

CVE-2025-67928 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-67928

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in themesuite Automotive Listings automotive allows Blind SQL Injection.This issue affects Automotive Listings: from n/a through <= 18.6. CVSSv3.1 9.3 (CRITICAL)

CWECWE 89TYPVulnerability

9.3

CVSS v3.1

Edit Score

2026-01-08

2026-01-08 10:15Z

CRIT

CVE-2025-67924 — Upload: Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Corpkit corpkit allows Upload

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-67924

Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Corpkit corpkit allows Upload a Web Shell to a Web Server.This issue affects Corpkit: from n/a through <= 2.0. CVSSv3.1 9.9 (CRITICAL)

CWECWE 434TYPVulnerability

9.9

CVSS v3.1

100

Edit Score

2026-01-08

2026-01-08 10:15Z

HIGH

CVE-2025-67921 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-67921

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VanKarWai Lobo lobo allows Blind SQL Injection.This issue affects Lobo: from n/a through < 2.8.6. CVSSv3.1 8.5 (HIGH)

CWECWE 89TYPVulnerability

8.5

CVSS v3.1

Edit Score

2026-01-08

2026-01-08 10:15Z

HIGH

CVE-2025-67920 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-67920

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Neo Ocular neoocular allows PHP Local File Inclusion.This issue affects Neo Ocular: from n/a through < 1.2. CVSSv3.1 8.1 (HIGH)

CWECWE 98TYPVulnerability

8.1

CVSS v3.1

Edit Score

2026-01-08

2026-01-08 10:15Z

HIGH

CVE-2025-67915 — Authentication: Bypass Using an Alternate Path or Channel vulnerability in Arraytics Timetics timetics allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-67915

Authentication Bypass Using an Alternate Path or Channel vulnerability in Arraytics Timetics timetics allows Authentication Abuse.This issue affects Timetics: from n/a through <= 1.0.46. CVSSv3.1 8.8 (HIGH)

CWECWE 288TYPVulnerability

8.8

CVSS v3.1

Edit Score

2026-01-08

2026-01-08 10:15Z

CRIT

CVE-2025-67911 — Deserialization: of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-67911

Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through <= 4.11. CVSSv3.1 9.8 (CRITICAL) · EPSS 36th percentile

CWECWE 502TYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-01-08

2026-01-08 10:15Z

CRIT

CVE-2025-67910 — Upload: Unrestricted Upload of File with Dangerous Type vulnerability in contentstudio Contentstudio contentstudio allows Upload

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-67910

Unrestricted Upload of File with Dangerous Type vulnerability in contentstudio Contentstudio contentstudio allows Upload a Web Shell to a Web Server.This issue affects Contentstudio: from n/a through <= 1.3.7. CVSSv3.1 9.1 (CRITICAL)

CWECWE 434TYPVulnerability

9.1

CVSS v3.1

Edit Score

2026-01-08

2026-01-08 10:15Z

CRIT

CVE-2025-23993 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-23993

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RiceTheme Felan Framework felan-framework allows SQL Injection.This issue affects Felan Framework: from n/a through <= 1.1.3. CVSSv3.1 9.3 (CRITICAL)

CWECWE 89TYPVulnerability

9.3

CVSS v3.1

Edit Score

2026-01-08

2026-01-08 10:15Z

CRIT

CVE-2025-23504 — Authentication: Bypass Using an Alternate Path or Channel vulnerability in RiceTheme Felan Framework felan-framework

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-23504

Authentication Bypass Using an Alternate Path or Channel vulnerability in RiceTheme Felan Framework felan-framework allows Authentication Abuse.This issue affects Felan Framework: from n/a through <= 1.1.3. CVSSv3.1 9.8 (CRITICAL) · EPSS 42th percentile

CWECWE 288TYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-01-08

2026-01-08 10:15Z

HIGH

CVE-2025-22728 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-22728

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Workreap (theme's plugin) workreap allows SQL Injection.This issue affects Workreap (theme's plugin): from n/a through <= 3.3.6. CVSSv3.1 8.5 (HIGH)

CWECWE 89TYPVulnerability

8.5

CVSS v3.1

Edit Score

2026-01-08

2026-01-08 10:15Z

HIGH

CVE-2025-22713 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-22713

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in vanquish WooCommerce Orders & Customers Exporter woocommerce-orders-ei allows SQL Injection.This issue affects WooCommerce Orders & Customers Exporter: from n/a through <= 5.4. CVSSv3.1 8.5 (HIGH)

CWECWE 89TYPVulnerability

8.5

CVSS v3.1

Edit Score

2026-01-08

2026-01-08 10:15Z

HIGH

CVE-2025-22712 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-22712

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in QantumThemes Typify typify allows PHP Local File Inclusion.This issue affects Typify: from n/a through <= 3.0.2. CVSSv3.1 8.1 (HIGH)

CWECWE 98TYPVulnerability

8.1

CVSS v3.1

Edit Score

2026-01-08

2026-01-08 10:15Z

HIGH

CVE-2025-22708 — Thememove Mitech: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-22708

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Mitech mitech allows PHP Local File Inclusion.This issue affects Mitech: from n/a through <= 2.3.4. CVSSv3.1 8.1 (HIGH)

CWECWE 98VNDThememoveTYPVulnerability

8.1

CVSS v3.1

Edit Score

2026-01-08

2026-01-08 10:15Z

HIGH

CVE-2025-22707 — Thememove Moody: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-22707

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Moody tm-moody allows PHP Local File Inclusion.This issue affects Moody: from n/a through <= 2.7.3. CVSSv3.1 8.1 (HIGH)

CWECWE 98VNDThememoveTYPVulnerability

8.1

CVSS v3.1

Edit Score

2026-01-08

2026-01-08 10:15Z

HIGH

CVE-2025-22509 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-22509

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TMRW-studio Atlas atlas allows PHP Local File Inclusion.This issue affects Atlas: from n/a through <= 2.1.0. CVSSv3.1 8.1 (HIGH)

CWECWE 98TYPVulnerability

8.1

CVSS v3.1

Edit Score

2026-01-08

2026-01-08 10:15Z

HIGH

CVE-2025-14431 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-14431

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in THEMELOGI Navian navian allows PHP Local File Inclusion.This issue affects Navian: from n/a through <= 1.5.4. CVSSv3.1 8.1 (HIGH)

CWECWE 98TYPVulnerability

8.1

CVSS v3.1

Edit Score

2026-01-08

2026-01-08 10:15Z

HIGH

CVE-2025-14430 — Thememove Brook: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-14430

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Brook brook allows PHP Local File Inclusion.This issue affects Brook: from n/a through <= 2.9.0. CVSSv3.1 8.1 (HIGH)

CWECWE 98VNDThememoveTYPVulnerability

8.1

CVSS v3.1

Edit Score

Latest intel// live feed

CVE-2026-0719 — This results in incorrect memory allocation on the stack, followed by unsafe memory copying.

CVE-2025-69258 — Trendmicro Apex_central: A LoadLibraryEX vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker

CVE-2025-62877 — Projects: using the SUSE Virtualization (Harvester) environment may expose the OS default ssh login

CVE-2025-66001 — NeuVector: supports login authentication through OpenID Connect.

CVE-2025-67937 — Qodeinteractive Hendon: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

CVE-2025-67936 — Qodeinteractive Curly: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

CVE-2025-67935 — Qodeinteractive Optimize: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

CVE-2025-67934 — Qodeinteractive Wellspring: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

CVE-2025-67928 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

CVE-2025-67924 — Upload: Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Corpkit corpkit allows Upload

CVE-2025-67921 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

CVE-2025-67920 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

CVE-2025-67915 — Authentication: Bypass Using an Alternate Path or Channel vulnerability in Arraytics Timetics timetics allows

CVE-2025-67911 — Deserialization: of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue

CVE-2025-67910 — Upload: Unrestricted Upload of File with Dangerous Type vulnerability in contentstudio Contentstudio contentstudio allows Upload

CVE-2025-23993 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

CVE-2025-23504 — Authentication: Bypass Using an Alternate Path or Channel vulnerability in RiceTheme Felan Framework felan-framework

CVE-2025-22728 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

CVE-2025-22713 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

CVE-2025-22712 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

CVE-2025-22708 — Thememove Mitech: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

CVE-2025-22707 — Thememove Moody: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

CVE-2025-22509 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

CVE-2025-14431 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

CVE-2025-14430 — Thememove Brook: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')