Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-16 08:48Z
2025-12-12
2025-12-12 04:15Z
HIGH

CVE-2025-14044 — Visitor: The Visitor Logic Lite plugin for WordPress is vulnerable to PHP Object Injection in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-14044

The Visitor Logic Lite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.3 via deserialization of untrusted input from the `lpblocks` cookie. This is due to the `lp_track()` function passing unsanitized cookie data directly to the `unserialize()` function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an addi CVSSv3.1 8.1 (HIGH) · EPSS 44th percentile

CWECWE 502VNDVisitorTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-12-12
2025-12-12 04:15Z
HIGH

CVE-2025-13334 — Blaze: The Blaze Demo Importer plugin for WordPress is vulnerable to unauthorized database resets and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-13334

The Blaze Demo Importer plugin for WordPress is vulnerable to unauthorized database resets and file deletion due to a missing capability check on the "blaze_demo_importer_install_demo" function in all versions up to, and including, 1.0.13. This makes it possible for authenticated attackers, with subscriber level access and above, to reset the database by truncating all tables (except options, usermeta, and users), delete all sidebar widgets, theme modifications, and content o CVSSv3.1 8.1 (HIGH) · EPSS 17th percentile

CWECWE 862VNDBlazeTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-12-12
2025-12-12 04:15Z
HIGH

CVE-2025-12968 — Infility: The Infility Global plugin for WordPress is vulnerable to arbitrary file uploads due to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-12968

The Infility Global plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and capability checks in all versions up to, and including, 2.14.42. This is due to the `upload_file` function in the `infility_import_file` class only validating the MIME type which can be easily spoofed, and the `import_data` function missing capability checks. This makes it possible for authenticated attackers, with subscriber level access and above, to uplo CVSSv3.1 8.8 (HIGH)

CWECWE 434VNDInfilityTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-12-12
2025-12-12 04:15Z
CRIT

CVE-2025-12963 — LazyTasks: The LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart plugin

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-12963

The LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.2.29. This is due to the plugin not properly validating a user's identity via the 'wp-json/lazytasks/api/v1/user/role/edit/' REST API endpoint prior to updating their details like email address. This makes it possible for unauthenticated attackers to change arbitrary user's CVSSv3.1 9.8 (CRITICAL) · EPSS 28th percentile

CWECWE 862VNDLazytasksTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-12-12
2025-12-12 04:15Z
HIGH

CVE-2025-12824 — Player: The Player Leaderboard plugin for WordPress is vulnerable to Local File Inclusion in all

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-12824

The Player Leaderboard plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0.2 via the 'player_leaderboard' shortcode. This is due to the plugin using an unsanitized user-supplied value from the shortcode's 'mode' attribute in a call to include() without proper path validation. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary PHP files on the server, all CVSSv3.1 8.8 (HIGH) · EPSS 55th percentile

CWECWE 22VNDPlayerTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-12-12
2025-12-12 01:15Z
HIGH

CVE-2025-10451 — Unchecked: output buffer may allowed arbitrary code execution in SMM and potentially result in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-10451

Unchecked output buffer may allowed arbitrary code execution in SMM and potentially result in SMM memory corruption. CVSSv3.1 8.2 (HIGH) · EPSS 3th percentile

CWECWE 787VNDUncheckedTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2025-12-12
2025-12-12 00:15Z
HIGH

CVE-2025-67779 — Facebook React: It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-67779

It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allowing unsafe deserialization of payloads from HTTP requests to Server Function endpoints. This can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served. CVSSv3.1 7.5 (HIGH) · EPSS 97th percentile

CWECWE 502CWECWE 400VNDVercelVNDFacebookTYPVulnerability
7.5
CVSS v3.1
93
Edit Score
728 × 90 / responsive · programmatic ad slot
2025-12-11
2025-12-11 22:15Z
HIGH

CVE-2025-66446 — Maxkb Maxkb: Versions 2.3.1 and below have improper file permissions which allow attackers to overwrite the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-66446

MaxKB is an open-source AI assistant for enterprise. Versions 2.3.1 and below have improper file permissions which allow attackers to overwrite the built-in dynamic linker and other critical files, potentially resulting in privilege escalation. This issue is fixed in version 2.4.0. CVSSv3.1 8.8 (HIGH) · EPSS 26th percentile

CWECWE 362VNDMaxkbTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-12-11
2025-12-11 22:15Z
HIGH

CVE-2025-66419 — Maxkb Maxkb: In versions 2.3.1 and below, the tool module allows an attacker to escape the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-66419

MaxKB is an open-source AI assistant for enterprise. In versions 2.3.1 and below, the tool module allows an attacker to escape the sandbox environment and escalate privileges under certain concurrent conditions. This issue is fixed in version 2.4.0. CVSSv3.1 8.8 (HIGH) · EPSS 22th percentile

CWECWE 362VNDMaxkbTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-12-11
2025-12-11 22:15Z
CRIT

CVE-2025-64721 — Sandboxie-plus Sandboxie: This allows sandboxed processes to execute arbitrary code as SYSTEM, fully compromising the host.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-64721

Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. In versions 1.16.6 and below, the SYSTEM-level service SbieSvc.exe exposes SbieIniServer::RC4Crypt to sandboxed processes. The handler adds a fixed header size to a caller-controlled value_len without overflow checking. A large value_len (e.g., 0xFFFFFFF0) wraps the allocation size, causing a heap overflow when attacker data is copied into the undersized buffer. This allo CVSSv3.1 10.0 (CRITICAL) · EPSS 53th percentile

CWECWE 190VNDSandboxie PlusVNDSandboxieTYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2025-12-11
2025-12-11 22:15Z
HIGH

CVE-2025-34506 — Wbce Wbce_cms: CMS version 1.6.3 and prior contains an authenticated remote code execution vulnerability that

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-34506

WBCE CMS version 1.6.3 and prior contains an authenticated remote code execution vulnerability that allows administrators to upload malicious modules. Attackers can craft a specially designed ZIP module with embedded PHP reverse shell code to gain remote system access when the module is installed. CVSSv3.1 8.8 (HIGH) · EPSS 59th percentile

CWECWE 434VNDWbceTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-12-11
2025-12-11 21:15Z
CRIT

CVE-2025-66589 — Azeotech Daqfactory: In AzeoTech DAQFactory release 20.7 (Build 2555), an Out-of-bounds Read vulnerability can be exploited

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-66589

In AzeoTech DAQFactory release 20.7 (Build 2555), an Out-of-bounds Read vulnerability can be exploited by an attacker to cause the program to read data past the end of an allocated buffer. This could allow an attacker to disclose information or cause a system crash. CVSSv3.1 9.1 (CRITICAL) · EPSS 29th percentile

CWECWE 125VNDAzeotechTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2025-12-11
2025-12-11 21:15Z
HIGH

CVE-2025-66429 — Cpanel Cpanel: A directory traversal vulnerability within the Team Manager API allows for overwrite of an

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-66429

An issue was discovered in cPanel 110 through 132. A directory traversal vulnerability within the Team Manager API allows for overwrite of an arbitrary file. This can allow for privilege escalation to the root user. CVSSv3.1 8.8 (HIGH) · EPSS 56th percentile

CWECWE 22VNDCpanelTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-12-11
2025-12-11 20:16Z
HIGH

CVE-2025-55184 — Facebook React: A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-55184

A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints, which can cause an infinite loop that hangs the server process and may prevent future HTTP requests from bein CVSSv3.1 7.5 (HIGH) · EPSS 99th percentile

CWECWE 502VNDVercelVNDFacebookTYPVulnerability
7.5
CVSS v3.1
100
Edit Score
2025-12-11
2025-12-11 20:16Z
MED

CVE-2025-55183 — Vercel Next.js: An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-55183

An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which expli CVSSv3.1 5.3 (MEDIUM) · EPSS 99th percentile

VNDVercelTYPVulnerability
5.3
CVSS v3.1
96
Edit Score
2025-12-11
2025-12-11 20:15Z
CRIT

CVE-2025-36937 — Google Android: In AudioDecoder::HandleProduceRequest of audio_decoder.cc, there is a possible out of bounds write due to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-36937

In AudioDecoder::HandleProduceRequest of audio_decoder.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. CVSSv3.1 9.8 (CRITICAL) · EPSS 20th percentile

CWECWE 787VNDGoogleVNDAudiodecoderTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-12-11
2025-12-11 20:15Z
HIGH

CVE-2025-36924 — Google Android: In ss_DecodeLcsAssistDataReqMsg(void) of ss_LcsManagement.c, there is a possible out of bounds write due to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-36924

In ss_DecodeLcsAssistDataReqMsg(void) of ss_LcsManagement.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. CVSSv3.1 8.0 (HIGH) · EPSS 2th percentile

CWECWE 120CWECWE 787VNDGoogleTYPVulnerability
8.0
CVSS v3.1
90
Edit Score
2025-12-11
2025-12-11 20:15Z
HIGH

CVE-2025-36923 — Google Android: In NrmmDecoder::DecodeSORTransparentContext of cn_NrmmDecoder.cpp, there is a possible out of bounds write due to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-36923

In NrmmDecoder::DecodeSORTransparentContext of cn_NrmmDecoder.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. CVSSv3.1 8.0 (HIGH) · EPSS 2th percentile

CWECWE 122VNDGoogleVNDNrmmdecoderTYPVulnerability
8.0
CVSS v3.1
90
Edit Score
2025-12-11
2025-12-11 20:15Z
CRIT

CVE-2025-14535 — Utt 512w_firmware: The manipulation of the argument ssid leads to buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-14535

A vulnerability was identified in UTT 进取 512W up to 3.1.7.7-171114. Affected is the function strcpy of the file /goform/formConfigFastDirectionW. The manipulation of the argument ssid leads to buffer overflow. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. CVSSv3.1 9.8 (CRITICAL) · EPSS 93th percentile

CWECWE 120CWECWE 119VNDUttTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2025-12-11
2025-12-11 20:15Z
HIGH

CVE-2025-13481 — Ibm Aspera_orchestrator: Aspera Orchestrator 4.0.0 through 4.1.0 could allow an authenticated user to execute arbitrary

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-13481

IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input. CVSSv3.1 8.8 (HIGH) · EPSS 39th percentile

CWECWE 78VNDIbmTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-12-11
2025-12-11 20:15Z
HIGH

CVE-2025-13148 — Ibm Aspera_orchestrator: Aspera Orchestrator 4.0.0 through 4.1.0 could allow could an authenticated user to change

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-13148

IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow could an authenticated user to change the password of another user without prior knowledge of that password. CVSSv3.1 8.1 (HIGH) · EPSS 18th percentile

CWECWE 620VNDIbmTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-12-11
2025-12-11 19:15Z
HIGH

CVE-2025-56130 — Ruijie Rg-nbs5100-24gt4sfp_firmware: OS Command Injection vulnerability in Ruijie RG-S1930 S1930SWITCH_3.0(1)B11P230 allowing attackers to execute arbitrary commands

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-56130

OS Command Injection vulnerability in Ruijie RG-S1930 S1930SWITCH_3.0(1)B11P230 allowing attackers to execute arbitrary commands via a crafted POST request to the module_update in file /usr/local/lua/dev_config/ace_sw.lua. CVSSv3.1 8.8 (HIGH) · EPSS 81th percentile

CWECWE 78VNDCommandVNDRuijieTYPVulnerability
8.8
CVSS v3.1
95
Edit Score
2025-12-11
2025-12-11 19:15Z
HIGH

CVE-2025-56129 — Ruijie Rg-bcr860_firmware: OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-56129

OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to the action_diagnosis in file /usr/lib/lua/luci/controller/admin/diagnosis.lua. CVSSv3.1 8.8 (HIGH) · EPSS 85th percentile

CWECWE 78VNDCommandVNDRuijieTYPVulnerability
8.8
CVSS v3.1
95
Edit Score
2025-12-11
2025-12-11 19:15Z
HIGH

CVE-2025-56127 — Ruijie Rg-bcr600w_firmware: OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-56127

OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request to the get_wanobj in file /usr/lib/lua/luci/controller/admin/common.lua. CVSSv3.1 8.8 (HIGH) · EPSS 88th percentile

CWECWE 78VNDCommandVNDRuijieTYPVulnerability
8.8
CVSS v3.1
95
Edit Score
2025-12-11
2025-12-11 19:15Z
HIGH

CVE-2025-56123 — Ruijie Rg-ew1200g_pro_firmware: OS Command Injection vulnerability in Ruijie RG-EW1200G PRO RG-EW1200G PRO V1.00/V2.00/V3.00/V4.00 allowing attackers to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-56123

OS Command Injection vulnerability in Ruijie RG-EW1200G PRO RG-EW1200G PRO V1.00/V2.00/V3.00/V4.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/networkConnect.lua. CVSSv3.1 8.8 (HIGH) · EPSS 85th percentile

CWECWE 78VNDCommandVNDRuijieTYPVulnerability
8.8
CVSS v3.1
95
Edit Score