Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-15 18:29Z
2026-01-06
2026-01-06 05:16Z
CRIT

CVE-2025-15001 — Registration: The FS Registration Password plugin for WordPress is vulnerable to privilege escalation via account

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-15001

The FS Registration Password plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account. CVSSv3.1 9.8 (CRITICAL) · EPSS 33th percentile

CWECWE 639VNDRegistrationTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-01-06
2026-01-06 05:16Z
HIGH

CVE-2025-14997 — BuddyPress: The BuddyPress Xprofile Custom Field Types plugin for WordPress is vulnerable to arbitrary file

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-14997

The BuddyPress Xprofile Custom Field Types plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete_field' function in all versions up to, and including, 1.2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). CVSSv3.1 8.8 (HIGH)

CWECWE 22VNDBuddypressTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-01-06
2026-01-06 05:15Z
CRIT

CVE-2025-14996 — Password: The AS Password Field In Default Registration Form plugin for WordPress is vulnerable to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-14996

The AS Password Field In Default Registration Form plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account. CVSSv3.1 9.8 (CRITICAL) · EPSS 27th percentile

CWECWE 639TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-01-06
2026-01-06 02:15Z
CRIT

CVE-2025-15385 — Tecno Boomplay: Insufficient Verification of Data Authenticity vulnerability in TECNO Mobile com.Afmobi.Boomplayer allows Authentication Bypass.This issue

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-15385

Insufficient Verification of Data Authenticity vulnerability in TECNO Mobile com.Afmobi.Boomplayer allows Authentication Bypass.This issue affects com.Afmobi.Boomplayer: 7.4.63. CVSSv3.1 9.8 (CRITICAL) · EPSS 14th percentile

CWECWE 345VNDVerificationVNDTecnoTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-01-06
2026-01-06 01:16Z
CRIT

CVE-2025-15444 — Iamb Crypt\: The libsodium vulnerability states: In atypical use cases involving certain custom cryptography or untrusted

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-15444

Crypt::Sodium::XS module versions prior to 0.000042, for Perl, include a vulnerable version of libsodium libsodium <= 1.0.20 or a version of libsodium released before December 30, 2025 contains a vulnerability documented as CVE-2025-69277  https://www.cve.org/CVERecord?id=CVE-2025-69277 . The libsodium vulnerability states: In atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an e CVSSv3.1 9.8 (CRITICAL) · EPSS 17th percentile

CWECWE 347VNDCryptVNDIambTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-01-05
2026-01-05 22:15Z
CRIT

CVE-2025-68456 — Craftcms Craft_cms: In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16, unauthenticated users can trigger database

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-68456

Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16, unauthenticated users can trigger database backup operations via specific admin actions, potentially leading to resource exhaustion or information disclosure. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue. Craft 3 users should update to the latest Craft 4 and 5 releases, which include the fixes. CVSSv3.1 9.1 (CRITICAL) · EPSS 45th percentile

CWECWE 770CWECWE 202VNDCraftVNDCraftcmsTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-01-05
2026-01-05 22:15Z
HIGH

CVE-2025-68454 — Craftcms Craft_cms: Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated Remote

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-68454

Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated Remote Code Execution via Twig SSTI. For this to work, users must have administrator access to the Craft Control Panel, and allowAdminChanges must be enabled, which is against Craft CMS' recommendations for any non-dev environment. Alternatively, a non-administrator account with allowAdminChanges disabled can be used, CVSSv3.1 8.8 (HIGH) · EPSS 59th percentile

CWECWE 1336VNDCraftVNDCraftcmsTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-01-05
2026-01-05 22:15Z
HIGH

CVE-2025-65110 — Vega_project Vega: Second, they allow user-defined Vega `JSON` definitions (vs JSON that was is only provided

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-65110

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to versions 6.1.2 and 5.6.3, applications meeting two conditions are at risk of arbitrary JavaScript code execution, even if "safe mode" expressionInterpreter is used. First, they use `vega` in an application that attaches both `vega` library and a `vega.View` instance similar to the Vega Editor to the global `window`, or has any other satisfactory CVSSv3.1 8.1 (HIGH) · EPSS 42th percentile

CWECWE 79VNDVegaVNDVega ProjectTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-01-05
2026-01-05 21:16Z
HIGH

CVE-2025-64425 — Coollabs Coolify: In Coolify versions up to and including v4.0.0-beta.434, an attacker can initiate a password

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-64425

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, an attacker can initiate a password reset for a victim, and modify the host header of the request to a malicious value. The victim will receive a password reset email, with a link to the malicious host. If the victim clicks this link, their reset token is sent to the attacker's server, allowing the attacker to use it to c CVSSv3.1 8.1 (HIGH) · EPSS 36th percentile

CWECWE 644VNDCoolifyVNDCoollabsTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-01-05
2026-01-05 21:16Z
HIGH

CVE-2025-64424 — Coollabs Coolify: In Coolify versions up to and including v4.0.0-beta.434, a command injection vulnerability exists in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-64424

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a command injection vulnerability exists in the git source input fields of a resource, allowing a low privileged user (member) to execute system commands as root on the Coolify instance. As of time of publication, it is unclear if a patch is available. CVSSv3.1 8.8 (HIGH) · EPSS 81th percentile

CWECWE 77VNDCoolifyVNDCoollabsTYPVulnerability
8.8
CVSS v3.1
95
Edit Score
2026-01-05
2026-01-05 21:16Z
HIGH

CVE-2025-64423 — Coollabs Coolify: In Coolify versions up to and including v4.0.0-beta.434, a low privileged user (member) can

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-64423

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a low privileged user (member) can see and use invitation links sent to an administrator. When they use the link before the legitimate recipient does, they are able to log in as an administrator, meaning they have successfully escalated their privileges. As of time of publication, it is unclear if a patch is available. CVSSv3.1 8.8 (HIGH) · EPSS 25th percentile

CWECWE 287VNDCoolifyVNDCoollabsTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-01-05
2026-01-05 20:16Z
HIGH

CVE-2025-64421 — Coollabs Coolify: In Coolify versions up to and including v4.0.0-beta.434, a low privileged user (member) can

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-64421

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a low privileged user (member) can invite a high privileged user. At first, the application will throw an error, but if the attacker clicks the invite button a second time, it actually works. This way, a low privileged user can invite themselves as an administrator to the Coolify instance. After the high privileged user i CVSSv3.1 8.0 (HIGH) · EPSS 20th percentile

CWECWE 863VNDCoolifyVNDCoollabsTYPVulnerability
8.0
CVSS v3.1
90
Edit Score
2026-01-05
2026-01-05 20:16Z
CRIT

CVE-2025-64420 — Coollabs Coolify: This allows them to ssh to the server and authenticate as root user, using

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-64420

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions prior to and including v4.0.0-beta.434, low privileged users are able to see the private key of the root user on the Coolify instance. This allows them to ssh to the server and authenticate as root user, using the private key. As of time of publication, it is unclear if a patch is available. CVSSv3.1 9.9 (CRITICAL) · EPSS 43th percentile

CWECWE 522VNDCoolifyVNDCoollabsTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-01-05
2026-01-05 20:16Z
CRIT

CVE-2025-64419 — Coollabs Coolify: Prior to version 4.0.0-beta.445, parameters coming from docker-compose.yaml are not sanitized when used in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-64419

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.445, parameters coming from docker-compose.yaml are not sanitized when used in commands. If a victim user creates an application from an attacker repository (using build pack "docker compose"), the attacker can execute commands on the Coolify instance as root. Version 4.0.0-beta.445 fixes the issue. CVSSv3.1 9.6 (CRITICAL) · EPSS 49th percentile

CWECWE 77VNDCoolifyVNDCoollabsTYPVulnerability
9.6
CVSS v3.1
98
Edit Score
2026-01-05
2026-01-05 18:15Z
HIGH

CVE-2025-59158 — Coollabs Coolify: versions prior to and including v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-59158

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting (XSS) attack in the project creation workflow. An authenticated user with low privileges (e.g., member role) can create a project with a maliciously crafted name containing embedded JavaScript. When an administrator later attempts to delete the project or its associated res CVSSv3.1 8.0 (HIGH) · EPSS 41th percentile

CWECWE 79CWECWE 116VNDCoolifyVNDCoollabsTYPVulnerability
8.0
CVSS v3.1
90
Edit Score
2026-01-05
2026-01-05 18:15Z
CRIT

CVE-2025-59157 — Coollabs Coolify: Prior to version 4.0.0-beta.420.7, the Git Repository field during project creation is vulnerable to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-59157

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.420.7, the Git Repository field during project creation is vulnerable to command injection. User input is not properly sanitized, allowing attackers to inject arbitrary shell commands that execute on the underlying server during the deployment workflow. A regular member user can exploit this vulnerability. Version 4.0.0-beta.420.7 contains a patch fo CVSSv3.1 9.9 (CRITICAL) · EPSS 78th percentile

CWECWE 78VNDCoolifyVNDCoollabsTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2026-01-05
2026-01-05 18:15Z
HIGH

CVE-2025-59156 — Coollabs Coolify: Prior to version 4.0.0-beta.420.7, a Remote Code Execution (RCE)*vulnerability exists in Coolify's application deployment

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-59156

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.420.7, a Remote Code Execution (RCE)*vulnerability exists in Coolify's application deployment workflow. This flaw allows a low-privileged member to inject arbitrary Docker Compose directives during project creation or updates. By defining a malicious service that mounts the host filesystem, an attacker can achieve root-level command execution on the CVSSv3.1 8.8 (HIGH) · EPSS 61th percentile

CWECWE 78VNDCoolifyVNDCoollabsTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-01-05
2026-01-05 18:15Z
HIGH

CVE-2025-55204 — Muffon Muffon: Versions prior to 2.3.0 have a one-click Remote Code Execution (RCE) vulnerability in.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-55204

muffon is a cross-platform music streaming client for desktop. Versions prior to 2.3.0 have a one-click Remote Code Execution (RCE) vulnerability in. An attacker can exploit this issue by embedding a specially crafted `muffon://` link on any website they control. When a victim visits the site or clicks the link, the browser triggers Muffon’s custom URL handler, causing the application to launch and process the URL. This leads to RCE on the victim's machine without further int CVSSv3.1 8.8 (HIGH) · EPSS 52th percentile

CWECWE 94CWECWE 79VNDMuffonTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-01-05
2026-01-05 17:15Z
CRIT

CVE-2025-39484 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-39484

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Waituk Entrada entrada allows SQL Injection.This issue affects Entrada: from n/a through <= 5.7.7. CVSSv3.1 9.3 (CRITICAL)

CWECWE 89TYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2026-01-05
2026-01-05 15:15Z
HIGH

CVE-2025-66376 — Synacor Zimbra_collaboration_suite: Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-66376in the wild

Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message. CVSSv3.1 7.2 (HIGH) · EPSS 97th percentile

CWECWE 79VNDZimbraVNDSynacorTYPVulnerabilitySTAitw exploited
7.2
CVSS v3.1
92
Edit Score
2026-01-05
2026-01-05 15:15Z
CRIT

CVE-2025-15029 — Centreon Awie: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-15029

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra Monitoring (Awie export modules) allows SQL Injection to unauthenticated user. This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.3, from 24.04.0 before 24.04.3. CVSSv3.1 9.8 (CRITICAL) · EPSS 96th percentile

CWECWE 89VNDCentreonTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2026-01-05
2026-01-05 15:15Z
CRIT

CVE-2025-15026 — Centreon Awie: Missing Authentication for Critical Function vulnerability in Centreon Infra Monitoring centreon-awie (Awie import module)

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-15026

Missing Authentication for Critical Function vulnerability in Centreon Infra Monitoring centreon-awie (Awie import module) allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.3, from 24.04.0 before 24.04.3. CVSSv3.1 9.8 (CRITICAL) · EPSS 36th percentile

CWECWE 306VNDCentreonTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-01-05
2026-01-05 11:17Z
HIGH

CVE-2025-69087 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-69087

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes FreeAgent freeagent allows PHP Local File Inclusion.This issue affects FreeAgent: from n/a through <= 2.1.2. CVSSv3.1 8.1 (HIGH)

CWECWE 98TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-01-05
2026-01-05 11:17Z
CRIT

CVE-2025-68865 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-68865

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Infility Infility Global infility-global allows SQL Injection.This issue affects Infility Global: from n/a through <= 2.15.11. CVSSv3.1 9.3 (CRITICAL)

CWECWE 89TYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2026-01-05
2026-01-05 11:17Z
HIGH

CVE-2025-68044 — Authorization: Bypass Through User-Controlled Key vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-68044

Authorization Bypass Through User-Controlled Key vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Five Star Restaurant Reservations: from n/a through <= 2.7.4. CVSSv3.1 8.6 (HIGH)

CWECWE 639TYPVulnerability
8.6
CVSS v3.1
93
Edit Score