Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-16 08:23Z
2025-12-13
2025-12-13 01:15Z
HIGH

CVE-2025-13970 — OpenPLC_V3: is vulnerable to a cross-site request forgery (CSRF) attack due to the absence

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-13970

OpenPLC_V3 is vulnerable to a cross-site request forgery (CSRF) attack due to the absence of proper CSRF validation. This issue allows an unauthenticated attacker to trick a logged-in administrator into visiting a maliciously crafted link, potentially enabling unauthorized modification of PLC settings or the upload of malicious programs which could lead to significant disruption or damage to connected systems. CVSSv3.1 8.0 (HIGH) · EPSS 20th percentile

CWECWE 352VNDOpenplc V3TYPVulnerability
8.0
CVSS v3.1
90
Edit Score
2025-12-12
2025-12-12 21:15Z
HIGH

CVE-2025-67750 — Lightning: Versions 6.10.5 and below allow a maliciously crafted flow metadata file to cause arbitrary

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-67750

Lightning Flow Scanner provides a A CLI plugin, VS Code Extension and GitHub Action for analysis and optimization of Salesforce Flows. Versions 6.10.5 and below allow a maliciously crafted flow metadata file to cause arbitrary JavaScript execution during scanning. The APIVersion rule uses new Function() to evaluate expression strings, enabling an attacker to supply a malicious expression within rule configuration or crafted flow metadata. This could compromise developer machi CVSSv3.1 8.4 (HIGH) · EPSS 8th percentile

CWECWE 94VNDLightningTYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2025-12-12
2025-12-12 21:15Z
HIGH

CVE-2025-43539 — Apple Macos: Processing a file may lead to memory corruption.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-43539

The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing a file may lead to memory corruption. CVSSv3.1 8.8 (HIGH) · EPSS 93th percentile

CWECWE 787CWECWE 119VNDAppleTYPVulnerability
8.8
CVSS v3.1
96
Edit Score
2025-12-12
2025-12-12 21:15Z
MED

CVE-2025-43520 — Apple Ipados: A memory corruption issue was addressed with improved memory handling.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-43520in the wild

A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious application may be able to cause unexpected system termination or write kernel memory. CVSSv3.1 5.5 (MEDIUM) · EPSS 36th percentile

CWECWE 120VNDAppleTYPVulnerabilitySTAitw exploited
5.5
CVSS v3.1
78
Edit Score
2025-12-12
2025-12-12 21:15Z
HIGH

CVE-2025-43510 — Apple Ipados: A memory corruption issue was addressed with improved lock state checking.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-43510in the wild

A memory corruption issue was addressed with improved lock state checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious application may cause unexpected changes in memory shared between processes. CVSSv3.1 7.8 (HIGH) · EPSS 29th percentile

CWECWE 667VNDAppleTYPVulnerabilitySTAitw exploited
7.8
CVSS v3.1
89
Edit Score
2025-12-12
2025-12-12 21:15Z
CRIT

CVE-2025-14611 — Gladinet Centrestack: and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-14611in the wild

Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. This degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication. This opens the door for future exploitation and can be leveraged with previous vulnerabilities to gain a full system compromise. CVSSv3.1 9.8 (CRITICAL) · EPSS 99th percentile

CWECWE 798VNDGladinetTYPVulnerabilitySTAitw exploited
9.8
CVSS v3.1
100
Edit Score
2025-12-12
2025-12-12 20:15Z
HIGH

CVE-2025-8083 — Preset: The Preset configuration https://v2.vuetifyjs.com/en/features/presets feature of Vuetify is vulnerable to Prototype Pollution https://cheatsheetseries.owasp.org/cheatsheets/Pro

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-8083

The Preset configuration https://v2.vuetifyjs.com/en/features/presets  feature of Vuetify is vulnerable to Prototype Pollution https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html  due to the internal 'mergeDeep' utility function used to merge options with defaults. Using a specially-crafted, malicious preset can result in polluting all JavaScript objects with arbitrary properties, which can further negatively affect all aspects of CVSSv3.1 8.6 (HIGH) · EPSS 25th percentile

CWECWE 1321VNDPresetTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
728 × 90 / responsive · programmatic ad slot
2025-12-12
2025-12-12 20:15Z
HIGH

CVE-2025-14572 — Utt 512w_firmware: Performing manipulation of the argument hidcontact results in memory corruption.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-14572

A vulnerability was found in UTT 进取 512W up to 1.7.7-171114. This affects an unknown part of the file /goform/formWebAuthGlobalConfig. Performing manipulation of the argument hidcontact results in memory corruption. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. CVSSv3.1 8.8 (HIGH) · EPSS 89th percentile

CWECWE 119VNDUttTYPVulnerability
8.8
CVSS v3.1
95
Edit Score
2025-12-12
2025-12-12 20:15Z
HIGH

CVE-2025-14174 — Google Chrome: Out of bounds memory access in ANGLE in Google Chrome on Mac prior to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-14174in the wild

Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High) CVSSv3.1 8.8 (HIGH) · EPSS 98th percentile

CWECWE 787CWECWE 119VNDAppleVNDGoogleTYPVulnerabilitySTAitw exploited
8.8
CVSS v3.1
100
Edit Score
2025-12-12
2025-12-12 20:15Z
CRIT

CVE-2024-14010 — Typora: 1.7.4 contains a command injection vulnerability in the PDF export preferences that allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-14010

Typora 1.7.4 contains a command injection vulnerability in the PDF export preferences that allows attackers to execute arbitrary system commands. Attackers can inject malicious commands into the 'run command' input field during PDF export to achieve remote code execution. CVSSv3.1 9.8 (CRITICAL) · EPSS 66th percentile

CWECWE 78VNDTyporaTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-12-12
2025-12-12 16:15Z
CRIT

CVE-2025-66430 — Plesk Plesk: 18.0 has Incorrect Access Control.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-66430

Plesk 18.0 has Incorrect Access Control. CVSSv3.1 9.1 (CRITICAL) · EPSS 44th percentile

CWECWE 284VNDPleskTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2025-12-12
2025-12-12 16:15Z
CRIT

CVE-2025-65854 — Mineadmin Mineadmin: Insecure permissions in the scheduled tasks feature of MineAdmin v3.x allows attackers to execute

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-65854

Insecure permissions in the scheduled tasks feature of MineAdmin v3.x allows attackers to execute arbitrary commands and execute a full account takeover. CVSSv3.1 9.8 (CRITICAL) · EPSS 37th percentile

CWECWE 94VNDMineadminTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-12-12
2025-12-12 16:15Z
HIGH

CVE-2025-65530 — Cloudlinux Ai-bolit: An eval injection in the malware de-obfuscation routines of CloudLinux ai-bolit before v32.7.4 allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-65530

An eval injection in the malware de-obfuscation routines of CloudLinux ai-bolit before v32.7.4 allows attackers to overwrite arbitrary files as root via scanning a crafted file. CVSSv3.1 8.8 (HIGH) · EPSS 21th percentile

CWECWE 95VNDCloudlinuxTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-12-12
2025-12-12 15:15Z
HIGH

CVE-2025-58770 — Ami Aptio_v: APTIOV contains a vulnerability in BIOS where a user may cause “Improper Handling of

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-58770

APTIOV contains a vulnerability in BIOS where a user may cause “Improper Handling of Insufficient Permissions or Privileges” by local access. Successful exploitation of this vulnerability can lead to escalation of authorization and potentially impact Integrity and Availability. CVSSv3.1 8.8 (HIGH) · EPSS 1th percentile

CWECWE 280VNDAmiVNDAptiovTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-12-12
2025-12-12 15:15Z
CRIT

CVE-2025-54947 — Apache Streampark: In Apache StreamPark versions 2.0.0 through 2.1.7, a security vulnerability involving a hard-coded encryption

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-54947

In Apache StreamPark versions 2.0.0 through 2.1.7, a security vulnerability involving a hard-coded encryption key exists. This vulnerability occurs because the system uses a fixed, immutable key for encryption instead of dynamically generating or securely configuring the key. Attackers may obtain this key through reverse engineering or code analysis, potentially decrypting sensitive data or forging encrypted information, leading to information disclosure or unauthorized syste CVSSv3.1 9.8 (CRITICAL) · EPSS 39th percentile

CWECWE 798CWECWE 321VNDApacheTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-12-12
2025-12-12 13:15Z
HIGH

CVE-2025-13506 — Execution: Nebim V3 ERP allows Expanding Control over the Operating System from the Database.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-13506

Execution with Unnecessary Privileges vulnerability in Nebim Neyir Computer Industry and Services Inc. Nebim V3 ERP allows Expanding Control over the Operating System from the Database. This issue affects Nebim V3 ERP: from 2.0.59 before 3.0.1. CVSSv3.1 8.8 (HIGH) · EPSS 26th percentile

CWECWE 250VNDExecutionTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-12-12
2025-12-12 12:00Z
HIGH

Catching malicious package releases using a transparency log

Trail of Bits·blog.trailofbits.com

Trail of Bits released rekor-monitor, a production-ready tool for monitoring Sigstore's Rekor transparency log to detect unauthorized package releases and compromised signing identities. The work, funded by OpenSSF, adds Rekor v2 support, certificate validation, TUF integration, and GitHub Actions workflows to enable maintainers to detect supply-chain compromises in real-time rather than relying on post-hoc detection.

TACTA0001SRFSupply ChainVNDOpenssfVNDSigstoreTYPResearchTYPToolSTGDefense EvasionSTGInitial Access
72
Edit Score
2025-12-12
2025-12-12 10:15Z
HIGH

CVE-2025-58137 — Apache Fineract: Authorization Bypass Through User-Controlled Key vulnerability in Apache Fineract.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-58137

Authorization Bypass Through User-Controlled Key vulnerability in Apache Fineract. This issue affects Apache Fineract: through 1.11.0. The issue is fixed in version 1.12.1. Users are encouraged to upgrade to version 1.13.0, the latest release. CVSSv3.1 8.1 (HIGH) · EPSS 31th percentile

CWECWE 639VNDApacheTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-12-12
2025-12-12 10:15Z
CRIT

CVE-2025-58130 — Apache Fineract: Insufficiently Protected Credentials vulnerability in Apache Fineract.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-58130

Insufficiently Protected Credentials vulnerability in Apache Fineract. This issue affects Apache Fineract: through 1.11.0. The issue is fixed in version 1.12.1. Users are encouraged to upgrade to version 1.13.0, the latest release. CVSSv3.1 9.1 (CRITICAL) · EPSS 35th percentile

CWECWE 522VNDApacheVNDInsufficientlyTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2025-12-12
2025-12-12 10:15Z
HIGH

CVE-2025-26866 — Apache Hugegraph: A remote code execution vulnerability exists where a malicious Raft node can exploit insecure

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-26866

A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict cluster membership and implements a strict class whitelist to harden the Hessian serialization process against object injection attacks. Users are recommended to upgrade to version 1.7.0, which fixes the issue. CVSSv3.1 8.8 (HIGH) · EPSS 58th percentile

CWECWE 502VNDApacheTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-12-12
2025-12-12 07:15Z
CRIT

CVE-2025-67728 — Shaneisrael Fireshare: Versions 1.2.30 and below allow an authenticated user, or unauthenticated user if the Public

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-67728

Fireshare facilitates self-hosted media and link sharing. Versions 1.2.30 and below allow an authenticated user, or unauthenticated user if the Public Uploads setting is enabled, to craft a malicious filename when uploading a video file. The malicious filename is then concatenated directly into a shell command, which can be used for uploading files to arbitrary directories via path traversal, or executing system commands for Remote Code Execution (RCE). This issue is fixed in CVSSv3.1 9.8 (CRITICAL) · EPSS 51th percentile

CWECWE 77VNDShaneisraelVNDFireshareTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-12-12
2025-12-12 07:15Z
CRIT

CVE-2025-67727 — Parseplatform Parse-server: In versions prior to 8.6.0-alpha.2, a GitHub CI workflow is triggered in a way

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-67727

Parse Server is an open source backend that can be deployed to any infrastructure that runs Node.js. In versions prior to 8.6.0-alpha.2, a GitHub CI workflow is triggered in a way that grants the GitHub Actions workflow elevated permissions, giving it access to GitHub secrets and write permissions which are defined in the workflow. Code from a fork or lifecycle scripts is potentially included. Only the repository's CI/CD infrastructure is affected, including any public GitHub CVSSv3.1 9.8 (CRITICAL) · EPSS 34th percentile

CWECWE 94CWECWE 269VNDParseplatformVNDParseTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-12-12
2025-12-12 06:15Z
HIGH

CVE-2025-67508 — Linuxfoundation Gardenctl: When using non‑POSIX shells such as Fish and PowerShell, versions 2.11.0 and below of

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-67508

gardenctl is a command-line client for the Gardener which configures access to clusters and cloud provider CLI tools. When using non‑POSIX shells such as Fish and PowerShell, versions 2.11.0 and below of gardenctl allow an attacker with administrative privileges for a Gardener project to craft malicious credential values. The forged credential values are used in infrastructure Secret objects that break out of the intended string context when evaluated in Fish or PowerShell en CVSSv3.1 8.4 (HIGH) · EPSS 14th percentile

CWECWE 77VNDLinuxfoundationTYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2025-12-12
2025-12-12 05:16Z
HIGH

CVE-2025-66492 — Masacms Masacms: Versions 7.2.8 and below, 7.3.1 through 7.3.13, 7.4.0-alpha.1 through 7.4.8 and 7.5.0 through 7.5.1

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-66492

Masa CMS is an open source Enterprise Content Management platform. Versions 7.2.8 and below, 7.3.1 through 7.3.13, 7.4.0-alpha.1 through 7.4.8 and 7.5.0 through 7.5.1 are vulnerable to XSS when an unsanitized value of the ajax URL query parameter is directly included within the <head> section of the HTML page. An attacker can execute arbitrary scripts in the context of the user's session, potentially leading to Session Hijacking, Data Theft, Defacement and Malware Distributio CVSSv3.1 8.2 (HIGH) · EPSS 15th percentile

CWECWE 79VNDMasacmsVNDMasaTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2025-12-12
2025-12-12 04:15Z
CRIT

CVE-2025-14344 — Multi: The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to arbitrary file

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-14344

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'plupload_ajax_delete_file' function in all versions up to, and including, 1.1.7. This makes it possible for unauthenticated attackers to delete arbitrary files on the server. CVSSv3.1 9.8 (CRITICAL)

CWECWE 22VNDMultiTYPVulnerability
9.8
CVSS v3.1
99
Edit Score