Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-16 07:44Z
2025-12-15
2025-12-15 06:15Z
CRIT

CVE-2025-14706 — Sgwbox N3_firmware: Such manipulation leads to command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-14706

A vulnerability was identified in Shiguangwu sgwbox N3 2.0.25. This impacts an unknown function of the file /usr/sbin/http_eshell_server of the component NETREBOOT Interface. Such manipulation leads to command injection. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. CVSSv3.1 9.8 (CRITICAL) · EPSS 97th percentile

CWECWE 74CWECWE 77VNDSgwboxVNDShiguangwuTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2025-12-15
2025-12-15 06:15Z
HIGH

CVE-2025-14549 — Eclipse Omr: In the Eclipse OMR compiler component, since release 0.7.0, an optimization enabled for Eclipse

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-14549

In the Eclipse OMR compiler component, since release 0.7.0, an optimization enabled for Eclipse OpenJ9 consumers of OMR on Z processors incorrectly handles NUL (0x00) characters during the Latin-compatible charset (UTF-8, ISO8859-1, ASCII, etc) to IBM-1047/037 translation sequence. This can cause the output byte array to be truncated, discarding the first NUL byte and all subsequent characters, and thereby exposing a possible buffer over-read problem. This issue is fixed in E CVSSv3.1 8.1 (HIGH) · EPSS 21th percentile

CWECWE 125VNDEclipseTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-12-15
2025-12-15 05:15Z
CRIT

CVE-2025-14705 — Sgwbox N3_firmware: This manipulation of the argument params causes command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-14705

A vulnerability was determined in Shiguangwu sgwbox N3 2.0.25. This affects an unknown function of the component SHARESERVER Feature. This manipulation of the argument params causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. CVSSv3.1 9.8 (CRITICAL) · EPSS 97th percentile

CWECWE 74CWECWE 77VNDSgwboxVNDShiguangwuTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2025-12-15
2025-12-15 05:15Z
HIGH

CVE-2025-14704 — Sgwbox N3_firmware: The manipulation results in path traversal.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-14704

A vulnerability was found in Shiguangwu sgwbox N3 2.0.25. The impacted element is an unknown function of the file /eshell of the component API. The manipulation results in path traversal. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. CVSSv3.1 7.3 (HIGH) · EPSS 96th percentile

CWECWE 22VNDSgwboxVNDShiguangwuTYPVulnerability
7.3
CVSS v3.1
90
Edit Score
2025-12-14
2025-12-14 23:15Z
HIGH

CVE-2025-67900 — NXLog: Agent before 6.11 can load a file specified by the OPENSSL_CONF environment variable.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-67900

NXLog Agent before 6.11 can load a file specified by the OPENSSL_CONF environment variable. CVSSv3.1 8.1 (HIGH) · EPSS 2th percentile

CWECWE 829VNDNxlogTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-12-14
2025-12-14 15:15Z
CRIT

CVE-2025-14665 — Tenda Wh450_firmware: The manipulation of the argument page results in stack-based buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-14665

A security flaw has been discovered in Tenda WH450 1.0.0.18. Impacted is an unknown function of the file /goform/DhcpListClient of the component HTTP Request Handler. The manipulation of the argument page results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. CVSSv3.1 9.8 (CRITICAL) · EPSS 61th percentile

CWECWE 121CWECWE 119VNDTendaTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-12-14
2025-12-14 12:16Z
HIGH

CVE-2025-14659 — Dlink Dir-868l_b1_firmware: The manipulation of the argument Hostname results in command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-14659

A vulnerability was detected in D-Link DIR-860LB1 and DIR-868LB1 203b01/203b03. Affected is an unknown function of the component DHCP Daemon. The manipulation of the argument Hostname results in command injection. It is possible to launch the attack remotely. The exploit is now public and may be used. CVSSv3.1 8.8 (HIGH) · EPSS 90th percentile

CWECWE 74CWECWE 77VNDDlinkTYPVulnerability
8.8
CVSS v3.1
95
Edit Score
728 × 90 / responsive · programmatic ad slot
2025-12-14
2025-12-14 11:15Z
HIGH

CVE-2025-14656 — Tenda Ac20_firmware: Executing a manipulation of the argument schedStartTime/schedEndTime can lead to buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-14656

A weakness has been identified in Tenda AC20 16.03.08.12. This affects the function httpd of the file /goform/openSchedWifi. Executing a manipulation of the argument schedStartTime/schedEndTime can lead to buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. CVSSv3.1 8.8 (HIGH) · EPSS 53th percentile

CWECWE 120CWECWE 119VNDTendaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-12-14
2025-12-14 11:15Z
HIGH

CVE-2025-14655 — Tenda Ac20_firmware: Performing a manipulation of the argument rebootTime results in stack-based buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-14655

A security flaw has been discovered in Tenda AC20 16.03.08.12. The impacted element is the function formSetRebootTimer of the file /goform/SetSysAutoRebbotCfg of the component httpd. Performing a manipulation of the argument rebootTime results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. CVSSv3.1 8.8 (HIGH) · EPSS 88th percentile

CWECWE 787CWECWE 121CWECWE 119VNDTendaTYPVulnerability
8.8
CVSS v3.1
95
Edit Score
2025-12-14
2025-12-14 10:15Z
HIGH

CVE-2025-14654 — Tenda Ac20_firmware: Such manipulation of the argument list leads to stack-based buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-14654

A vulnerability was identified in Tenda AC20 16.03.08.12. The affected element is the function formSetPPTPUserList of the file /goform/setPptpUserList of the component httpd. Such manipulation of the argument list leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. CVSSv3.1 8.8 (HIGH) · EPSS 88th percentile

CWECWE 787CWECWE 121CWECWE 119VNDTendaTYPVulnerability
8.8
CVSS v3.1
95
Edit Score
2025-12-13
2025-12-13 16:16Z
CRIT

CVE-2025-36753 — Growatt Shine_lan-x_firmware: The SWD debug interface on the Growatt ShineLan-X communication dongle is available by default

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-36753

The SWD debug interface on the Growatt ShineLan-X communication dongle is available by default, allowing an attacker to attain debug access to the device and to extracting secrets or domains from within the device CVSSv3.1 9.8 (CRITICAL) · EPSS 23th percentile

CWECWE 290VNDGrowattVNDSwdTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-12-13
2025-12-13 16:16Z
CRIT

CVE-2025-36752 — Growatt Shine_lan-x_firmware: ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-36752

Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which allows significant level access to the device, such as allowing any attacker to access the Setting Center. This means that this is effectively backdoor for all devices utilizing a Growatt ShineLan-X communication dongle. CVSSv3.1 9.8 (CRITICAL) · EPSS 23th percentile

CWECWE 798VNDGrowattTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-12-13
2025-12-13 16:16Z
CRIT

CVE-2025-36747 — Growatt Shine_lan-x_firmware: This may allow an attacker to replace legitimate files being deployed to devices with

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-36747

ShineLan-X contains a set of credentials for an FTP server was found within the firmware, allowing testers to establish an insecure FTP connection with the server. This may allow an attacker to replace legitimate files being deployed to devices with their own malicious versions, since the firmware signature verification is not enforced. CVSSv3.1 9.8 (CRITICAL) · EPSS 23th percentile

CWECWE 798VNDGrowattVNDShinelanTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-12-13
2025-12-13 16:16Z
HIGH

CVE-2025-14476 — Doubly: The Doubly – Cross Domain Copy Paste for WordPress plugin for WordPress is vulnerable

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-14476

The Doubly – Cross Domain Copy Paste for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.46 via deserialization of untrusted input from the content.txt file within uploaded ZIP archives. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute arbitrary code, delete files, retrieve sensitiv CVSSv3.1 8.8 (HIGH)

CWECWE 502VNDDoublyTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-12-13
2025-12-13 16:16Z
HIGH

CVE-2025-14475 — Extensive: The Extensive VC Addons for WPBakery page builder plugin for WordPress is vulnerable to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-14475

The Extensive VC Addons for WPBakery page builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9.1 via the `extensive_vc_get_module_template_part` function. This is due to insufficient path normalization and validation of the user-supplied `shortcode_name` parameter in the `extensive_vc_init_shortcode_pagination` AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary PHP files on CVSSv3.1 8.1 (HIGH) · EPSS 48th percentile

CWECWE 98VNDExtensiveTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-12-13
2025-12-13 16:16Z
CRIT

CVE-2025-14440 — JAY: The JAY Login & Register plugin for WordPress is vulnerable to authentication bypass in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-14440

The JAY Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.01. This is due to incorrect authentication checking in the 'jay_login_register_process_switch_back' function with the 'jay_login_register_process_switch_back' cookie value. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id. CVSSv3.1 9.8 (CRITICAL)

CWECWE 565VNDJayTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-12-13
2025-12-13 16:16Z
HIGH

CVE-2025-14397 — Postem: The Postem Ipsum plugin for WordPress is vulnerable to unauthorized modification of data to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-14397

The Postem Ipsum plugin for WordPress is vulnerable to unauthorized modification of data to Privilege Escalation due to a missing capability check on the postem_ipsum_generate_users() function in all versions up to, and including, 3.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary user accounts with the administrator role. CVSSv3.1 8.8 (HIGH) · EPSS 19th percentile

CWECWE 862VNDPostemTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-12-13
2025-12-13 16:16Z
HIGH

CVE-2025-13094 — WP3D: The WP3D Model Import Viewer plugin for WordPress is vulnerable to arbitrary file uploads

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-13094

The WP3D Model Import Viewer plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handle_import_file() function in all versions up to, and including, 1.0.7. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. CVSSv3.1 8.8 (HIGH) · EPSS 42th percentile

CWECWE 434VNDWp3dTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-12-13
2025-12-13 16:16Z
CRIT

CVE-2025-11693 — Export: The Export WP Page to Static HTML & PDF plugin for WordPress is vulnerable

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-11693

The Export WP Page to Static HTML & PDF plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.4 through publicly exposed cookies.txt files containing authentication cookies. This makes it possible for unauthenticated attackers to cookies that may have been injected into the log file if the site administrator triggered a back-up using a specific user role like 'administrator.' CVSSv3.1 9.8 (CRITICAL) · EPSS 81th percentile

CWECWE 200VNDExportTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2025-12-13
2025-12-13 16:16Z
CRIT

CVE-2025-10738 — URL: The URL Shortener Plugin For WordPress plugin for WordPress is vulnerable to SQL Injection

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-10738

The URL Shortener Plugin For WordPress plugin for WordPress is vulnerable to SQL Injection via the ‘analytic_id’ parameter in all versions up to, and including, 3.0.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVSSv3.1 9.8 (CRITICAL) · EPSS 35th percentile

CWECWE 89TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-12-13
2025-12-13 01:15Z
HIGH

CVE-2025-13970 — OpenPLC_V3: is vulnerable to a cross-site request forgery (CSRF) attack due to the absence

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-13970

OpenPLC_V3 is vulnerable to a cross-site request forgery (CSRF) attack due to the absence of proper CSRF validation. This issue allows an unauthenticated attacker to trick a logged-in administrator into visiting a maliciously crafted link, potentially enabling unauthorized modification of PLC settings or the upload of malicious programs which could lead to significant disruption or damage to connected systems. CVSSv3.1 8.0 (HIGH) · EPSS 20th percentile

CWECWE 352VNDOpenplc V3TYPVulnerability
8.0
CVSS v3.1
90
Edit Score
2025-12-12
2025-12-12 21:15Z
HIGH

CVE-2025-67750 — Lightning: Versions 6.10.5 and below allow a maliciously crafted flow metadata file to cause arbitrary

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-67750

Lightning Flow Scanner provides a A CLI plugin, VS Code Extension and GitHub Action for analysis and optimization of Salesforce Flows. Versions 6.10.5 and below allow a maliciously crafted flow metadata file to cause arbitrary JavaScript execution during scanning. The APIVersion rule uses new Function() to evaluate expression strings, enabling an attacker to supply a malicious expression within rule configuration or crafted flow metadata. This could compromise developer machi CVSSv3.1 8.4 (HIGH) · EPSS 8th percentile

CWECWE 94VNDLightningTYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2025-12-12
2025-12-12 21:15Z
HIGH

CVE-2025-43539 — Apple Macos: Processing a file may lead to memory corruption.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-43539

The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing a file may lead to memory corruption. CVSSv3.1 8.8 (HIGH) · EPSS 93th percentile

CWECWE 787CWECWE 119VNDAppleTYPVulnerability
8.8
CVSS v3.1
96
Edit Score
2025-12-12
2025-12-12 21:15Z
MED

CVE-2025-43520 — Apple Ipados: A memory corruption issue was addressed with improved memory handling.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-43520in the wild

A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious application may be able to cause unexpected system termination or write kernel memory. CVSSv3.1 5.5 (MEDIUM) · EPSS 36th percentile

CWECWE 120VNDAppleTYPVulnerabilitySTAitw exploited
5.5
CVSS v3.1
78
Edit Score
2025-12-12
2025-12-12 21:15Z
HIGH

CVE-2025-43510 — Apple Ipados: A memory corruption issue was addressed with improved lock state checking.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-43510in the wild

A memory corruption issue was addressed with improved lock state checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious application may cause unexpected changes in memory shared between processes. CVSSv3.1 7.8 (HIGH) · EPSS 29th percentile

CWECWE 667VNDAppleTYPVulnerabilitySTAitw exploited
7.8
CVSS v3.1
89
Edit Score