Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-16 01:54Z
2025-12-18
2025-12-18 17:15Z
HIGH

CVE-2025-14884 — Dlink Dir-605_firmware: Performing manipulation results in command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-14884

A vulnerability was detected in D-Link DIR-605 202WWB03. Affected by this issue is some unknown functionality of the component Firmware Update Service. Performing manipulation results in command injection. The attack can be initiated remotely. The exploit is now public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. CVSSv3.1 7.2 (HIGH) · EPSS 96th percentile

CWECWE 74CWECWE 77VNDDlinkTYPVulnerability
7.2
CVSS v3.1
89
Edit Score
2025-12-18
2025-12-18 16:15Z
HIGH

CVE-2025-68278 — Ssw Tinacms: In tinacms prior to version 3.1.1, tinacms uses the gray-matter package in an insecure

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-68278

Tina is a headless content management system. In tinacms prior to version 3.1.1, tinacms uses the gray-matter package in an insecure way allowing attackers that can control the content of the processed markdown files, e.g., blog posts, to execute arbitrary code. tinacms version 3.1.1, @tinacms/cli version 2.0.4, and @tinacms/graphql version 2.0.3 contain a fix for the issue. CVSSv3.1 8.8 (HIGH)

CWECWE 94VNDSswVNDTinaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-12-18
2025-12-18 16:15Z
CRIT

CVE-2025-63389 — Ollama Ollama: A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-63389

A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers to perform unauthorized model management operations. CVSSv3.1 9.8 (CRITICAL) · EPSS 52th percentile

CWECWE 306VNDOllamaTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-12-18
2025-12-18 16:15Z
CRIT

CVE-2025-63388 — Langgenius Dify: The endpoint implements an overly permissive CORS policy that reflects arbitrary Origin headers and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-63388

A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/system-features endpoint. The endpoint implements an overly permissive CORS policy that reflects arbitrary Origin headers and sets Access-Control-Allow-Credentials: true, allowing any external domain to make authenticated cross-origin requests. NOTE: the Supplier disputes this, providing the rationale of "sending requests with credentials does not provide any additi CVSSv3.1 9.1 (CRITICAL) · EPSS 12th percentile

CWECWE 346VNDOriginVNDLanggeniusTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2025-12-18
2025-12-18 16:15Z
CRIT

CVE-2025-63386 — Langgenius Dify: The endpoint implements an insecure CORS policy that reflects any Origin header and enables

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-63386

A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup endpoint. The endpoint implements an insecure CORS policy that reflects any Origin header and enables Access-Control-Allow-Credentials: true, permitting arbitrary external domains to make authenticated requests. NOTE: the Supplier disputes this because the endpoint configuration is intentional to support bootstrap. CVSSv3.1 9.1 (CRITICAL) · EPSS 13th percentile

CWECWE 346VNDOriginVNDLanggeniusTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2025-12-18
2025-12-18 15:15Z
HIGH

CVE-2025-14861 — Mozilla Firefox: Some of these bugs showed evidence of memory corruption and we presume that with

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-14861

Memory safety bugs present in Firefox 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 146.0.1. CVSSv3.1 8.8 (HIGH)

CWECWE 119VNDMozillaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-12-18
2025-12-18 15:15Z
CRIT

CVE-2025-14860 — Mozilla Firefox: Use-after-free in the Disability Access APIs component.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-14860

Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 146.0.1. CVSSv3.1 9.8 (CRITICAL)

CWECWE 416VNDMozillaTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
728 × 90 / responsive · programmatic ad slot
2025-12-18
2025-12-18 14:15Z
HIGH

CVE-2025-40898 — Nozominetworks Cmc: A path traversal vulnerability was discovered in the Import Arc data archive functionality due

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-40898

A path traversal vulnerability was discovered in the Import Arc data archive functionality due to insufficient validation of the input file. An authenticated user with limited privileges, by uploading a specifically-crafted Arc data archive, can potentially write arbitrary files in arbitrary paths, altering the device configuration and/or affecting its availability. CVSSv3.1 8.1 (HIGH)

CWECWE 22VNDNozominetworksTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-12-18
2025-12-18 14:15Z
HIGH

CVE-2025-40892 — Nozominetworks Cmc: A Stored Cross-Site Scripting vulnerability was discovered in the Reports functionality due to improper

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-40892

A Stored Cross-Site Scripting vulnerability was discovered in the Reports functionality due to improper validation of an input parameter. An authenticated user with report privileges can define a malicious report containing a JavaScript payload, or a victim can be socially engineered to import a malicious report template. When the victim views or imports the report, the XSS executes in their browser context, allowing the attacker to perform unauthorized actions as the victim, CVSSv3.1 8.9 (HIGH)

CWECWE 79VNDNozominetworksVNDStoredTYPVulnerability
8.9
CVSS v3.1
95
Edit Score
2025-12-18
2025-12-18 08:16Z
CRIT

CVE-2025-66078 — Control: Improper Control of Generation of Code ('Code Injection') vulnerability in jetmonsters Hotel Booking Lite

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-66078

Improper Control of Generation of Code ('Code Injection') vulnerability in jetmonsters Hotel Booking Lite motopress-hotel-booking-lite allows Remote Code Inclusion.This issue affects Hotel Booking Lite: from n/a through <= 5.2.3. CVSSv3.1 9.1 (CRITICAL)

CWECWE 94TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2025-12-18
2025-12-18 08:16Z
CRIT

CVE-2025-66074 — Upload: Unrestricted Upload of File with Dangerous Type vulnerability in Cozmoslabs WP Webhooks wp-webhooks allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-66074

Unrestricted Upload of File with Dangerous Type vulnerability in Cozmoslabs WP Webhooks wp-webhooks allows Path Traversal.This issue affects WP Webhooks: from n/a through <= 3.3.8. CVSSv3.1 9.0 (CRITICAL)

CWECWE 434TYPVulnerability
9.0
CVSS v3.1
95
Edit Score
2025-12-18
2025-12-18 08:16Z
CRIT

CVE-2025-64374 — Upload: Unrestricted Upload of File with Dangerous Type vulnerability in StylemixThemes Motors motors allows Using

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-64374

Unrestricted Upload of File with Dangerous Type vulnerability in StylemixThemes Motors motors allows Using Malicious Files.This issue affects Motors: from n/a through <= 5.6.81. CVSSv3.1 9.9 (CRITICAL) · EPSS 30th percentile

CWECWE 434TYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2025-12-18
2025-12-18 08:16Z
HIGH

CVE-2025-64373 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-64373

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in shinetheme Traveler traveler allows PHP Local File Inclusion.This issue affects Traveler: from n/a through < 3.2.6. CVSSv3.1 8.1 (HIGH)

CWECWE 98TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-12-18
2025-12-18 08:16Z
HIGH

CVE-2025-64371 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-64371

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through < 3.2.6. CVSSv3.1 8.5 (HIGH)

CWECWE 89TYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2025-12-18
2025-12-18 08:16Z
CRIT

CVE-2025-64233 — Deserialization: of Untrusted Data vulnerability in BoldThemes Codiqa codiqa allows Object Injection.This issue affects

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-64233

Deserialization of Untrusted Data vulnerability in BoldThemes Codiqa codiqa allows Object Injection.This issue affects Codiqa: from n/a through < 1.2.8. CVSSv3.1 9.8 (CRITICAL) · EPSS 32th percentile

CWECWE 502TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-12-18
2025-12-18 08:16Z
CRIT

CVE-2025-64231 — Upload: Unrestricted Upload of File with Dangerous Type vulnerability in RedefiningTheWeb WordPress Contact Form 7

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-64231

Unrestricted Upload of File with Dangerous Type vulnerability in RedefiningTheWeb WordPress Contact Form 7 PDF, Google Sheet & Database rtwwcfp-wordpress-contact-form-7-pdf allows Using Malicious Files.This issue affects WordPress Contact Form 7 PDF, Google Sheet & Database: from n/a through <= 3.0.0. CVSSv3.1 9.9 (CRITICAL)

CWECWE 434TYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2025-12-18
2025-12-18 08:16Z
CRIT

CVE-2025-64227 — Deserialization: of Untrusted Data vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-64227

Deserialization of Untrusted Data vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Object Injection.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.7. CVSSv3.1 9.8 (CRITICAL) · EPSS 32th percentile

CWECWE 502TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-12-18
2025-12-18 08:16Z
HIGH

CVE-2025-64205 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-64205

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TieLabs Jannah jannah allows PHP Local File Inclusion.This issue affects Jannah: from n/a through <= 7.6.0. CVSSv3.1 8.1 (HIGH)

CWECWE 98TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-12-18
2025-12-18 08:16Z
CRIT

CVE-2025-64188 — Incorrect: Privilege Assignment vulnerability in PenciDesign Soledad soledad allows Privilege Escalation.This issue affects Soledad

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-64188

Incorrect Privilege Assignment vulnerability in PenciDesign Soledad soledad allows Privilege Escalation.This issue affects Soledad: from n/a through <= 8.6.9. CVSSv3.1 9.8 (CRITICAL) · EPSS 37th percentile

CWECWE 266TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-12-18
2025-12-18 08:16Z
HIGH

CVE-2025-60084 — Deserialization: of Untrusted Data vulnerability in add-ons.org PDF for Elementor Forms + Drag And

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-60084

Deserialization of Untrusted Data vulnerability in add-ons.org PDF for Elementor Forms + Drag And Drop Template Builder pdf-for-elementor-forms allows Object Injection.This issue affects PDF for Elementor Forms + Drag And Drop Template Builder: from n/a through <= 6.5.0. CVSSv3.1 8.8 (HIGH)

CWECWE 502TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-12-18
2025-12-18 08:16Z
HIGH

CVE-2025-60083 — Deserialization: of Untrusted Data vulnerability in add-ons.org PDF Invoice Builder for WooCommerce pdf-for-woocommerce allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-60083

Deserialization of Untrusted Data vulnerability in add-ons.org PDF Invoice Builder for WooCommerce pdf-for-woocommerce allows Object Injection.This issue affects PDF Invoice Builder for WooCommerce: from n/a through <= 6.5.0. CVSSv3.1 8.8 (HIGH) · EPSS 37th percentile

CWECWE 502TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-12-18
2025-12-18 08:16Z
HIGH

CVE-2025-60072 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-60072

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Processby Anchor smooth scroll anchor-smooth-scroll allows PHP Local File Inclusion.This issue affects Anchor smooth scroll: from n/a through <= 1.0.2. CVSSv3.1 8.1 (HIGH)

CWECWE 98TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-12-18
2025-12-18 08:16Z
HIGH

CVE-2025-60071 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-60071

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in don-themes Riode riode allows PHP Local File Inclusion.This issue affects Riode: from n/a through <= 1.6.23. CVSSv3.1 8.1 (HIGH)

CWECWE 98TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-12-18
2025-12-18 08:16Z
HIGH

CVE-2025-60069 — Thememove Minimogwp: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-60069

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove MinimogWP minimog allows PHP Local File Inclusion.This issue affects MinimogWP: from n/a through <= 3.9.6. CVSSv3.1 8.1 (HIGH)

CWECWE 98VNDThememoveTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-12-18
2025-12-18 08:16Z
HIGH

CVE-2025-60067 — Axiomthemes Giardino: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-60067

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Giardino giardino allows PHP Local File Inclusion.This issue affects Giardino: from n/a through <= 1.1.10. CVSSv3.1 8.1 (HIGH)

CWECWE 98VNDAxiomthemesTYPVulnerability
8.1
CVSS v3.1
91
Edit Score