An arbitrary file rename vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below allows attackers to execute arbitrary code via renaming a PHP file to a SVG format. CVSSv3.1 9.8 (CRITICAL)
An arbitrary file rename vulnerability in the /admin/filer.php component of EasyImages 2.0 v2.8.6 and below allows attackers with Administrator privileges to execute arbitrary code via injecting a crafted payload into an uploaded file name. CVSSv3.1 9.1 (CRITICAL) · EPSS 45th percentile
A Cross-Site Request Forgery (CSRF) in the /admin/admin.inc.php component of EasyImages 2.0 v2.8.6 and below allows attackers to escalate privileges to Administrator via user interaction with a malicious web page. CVSSv3.1 8.8 (HIGH) · EPSS 10th percentile
An arbitrary file upload vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below allows attackers to execute arbitrary code via uploading a crafted PHP file. CVSSv3.1 8.8 (HIGH) · EPSS 43th percentile
A security flaw has been discovered in Tenda CH22 1.0.0.1. This affects the function frmL7ImForm of the file /goform/L7Im. Performing a manipulation of the argument page results in buffer overflow. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. CVSSv3.1 8.8 (HIGH) · EPSS 54th percentile
Authentication Bypass by Spoofing vulnerability in HYPR Server allows Identity Spoofing.This issue affects Server: before 10.1. CVSSv3.1 8.8 (HIGH)
SpecterOps demonstrates a complete attack chain from on-premises Active Directory to Azure Global Administrator compromise, leveraging Azure Seamless SSO as an authentication pivot when cookie theft fails. The attack exploits BloodHound graph analysis to identify a path through a synced AD user, resource group ownership, automation runbooks, and service principal privilege escalation to achieve tenant-wide compromise.
In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this behavior could result in the execution of custom code on the server or unauthorized access to application configuration data. This issue affects only the ScreenConnect server component; host and guest clients are not impacted. CVSSv3.1 9.1 (CRITICAL) · EPSS 29th percentile
A flaw in libsoup’s HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing. Common front proxies often honor the first Host: header, so this mismatch can cause vhost confusion where a proxy routes a request to one backend but the backend interprets it as destined for another host. This discrepancy enables request-smuggling style attacks, cache poisoning, or bypassing host-based access controls when an attacke CVSSv3.1 8.2 (HIGH) · EPSS 39th percentile
A vulnerability in TeamViewer DEX Client (former 1E client) - Content Distribution Service (NomadBranch.exe) prior version 25.11 for Windows allows malicious actors to bypass file integrity validation via a crafted request. By providing a valid hash for a malicious file, an attacker can cause the service to incorrectly validate and process the file as trusted, enabling arbitrary code execution under the Nomad Branch service context. CVSSv3.1 8.8 (HIGH) · EPSS 21th percentile
Trail of Bits released mrva, a terminal-first CLI tool for running CodeQL multi-repository variant analysis locally across thousands of projects. The tool downloads pre-built CodeQL databases from GitHub's API, runs custom queries, and outputs results to stdout, offering an alternative to GitHub's VS Code-dependent MRVA implementation with full local control and privacy.
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have, under certain circumstances, allowed an unauthenticated user to perform unauthorized actions on behalf of another user by injecting malicious external scripts into the Swagger UI." CVSSv3.1 8.0 (HIGH) · EPSS 43th percentile
squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if Webmin's Squid module and its Cache Manager feature are available, and an untrusted party is able to authenticate to Webmin and has certain Cache Manager permissions (the "cms" security option). CVSSv3.1 8.5 (HIGH) · EPSS 28th percentile
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that, under certain conditions could have allowed an authenticated user to perform unauthorized actions on behalf of another user by creating wiki pages with malicious content. CVSSv3.1 8.7 (HIGH) · EPSS 35th percentile
The WP CarDealer plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.16. This is due to the 'WP_CarDealer_User::process_register' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site. CVSSv3.1 9.8 (CRITICAL) · EPSS 26th percentile
Cybersecurity AI (CAI) is an open-source framework for building and deploying AI-powered offensive and defensive automation. Versions 0.5.9 and below are vulnerable to Command Injection through the run_ssh_command_with_credentials() function, which is available to AI agents. Only password and command inputs are escaped in run_ssh_command_with_credentials to prevent shell injection; while username, host and port values are injectable. This issue does not have a fix at the tim CVSSv3.1 9.6 (CRITICAL) · EPSS 80th percentile
Trend Micro disclosed SHADOW-VOID-042, a targeted spear-phishing campaign in October–November 2025 targeting defense, energy, chemical, cybersecurity, and ICT sectors using Trend-themed lures and HR complaint social engineering. The campaign employed multi-stage shellcode exploits (including a 2018 Chrome CVE), custom API hashing, machine-specific encryption, and C&C communication; attribution to Void Rabisu remains unconfirmed pending final payload recovery. Trend Vision One blocked the campaign early in the kill chain, preventing payload delivery.
Elastic Security Labs discovered NANOREMOTE, a fully-featured Windows backdoor linked to the FINALDRAFT implant and espionage-focused threat actors. The malware features command execution, file transfer via Google Drive API, custom PE loading for evasion, and task-based file management with pause/resume capabilities. NANOREMOTE uses AES-CBC encryption, Zlib compression, and integrates open-source libraries (libPeConv, Microsoft Detours) for stealth and resilience.
Neuron is a PHP framework for creating and orchestrating AI Agents. In versions 2.8.11 and below, the MySQLWriteTool executes arbitrary SQL provided by the caller using PDO::prepare() + execute() without semantic restrictions. This is consistent with the name (“write tool”), but in an LLM/agent context it becomes a high-risk capability: prompt injection or indirect prompt manipulation can cause execution of destructive queries such as DROP TABLE, TRUNCATE, DELETE, ALTER, or p CVSSv3.1 9.4 (CRITICAL) · EPSS 35th percentile
Neuron is a PHP framework for creating and orchestrating AI Agents. Versions 2.8.11 and below use MySQLSelectTool, which is vulnerable to Read-Only Bypass. MySQLSelectTool is intended to be a read-only SQL tool (e.g., for LLM agent querying, however, validation based on the first keyword (e.g., SELECT) and a forbidden-keyword list does not block file-writing constructs such as INTO OUTFILE / INTO DUMPFILE. As a result, an attacker who can influence the tool input (e.g., via CVSSv3.1 8.2 (HIGH) · EPSS 22th percentile
Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request’s response to influence another request’s response. This issue is fixed in version 20.0.1. CVSSv3.1 8.4 (HIGH) · EPSS 11th percentile
XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Versions 16.10.9 and below, 17.0.0-rc-1 through 17.4.2 and 17.5.0-rc-1 through 17.5.0 have insufficient protection against {{/html}} injection, which attackers can exploit through RCE. Any user who can edit their own profile or any other document can execute arbitrary script macros, including Groovy and Python macros, which ena CVSSv3.1 8.8 (HIGH) · EPSS 62th percentile
Multiple vulnerabilities in Aqara Hub firmware update process in the Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 devices, allow attackers to install malicious firmware without proper verification. The device fails to validate firmware signatures during updates, uses outdated cryptographic methods that can be exploited to forge valid signatures, and exposes information through improperly initialized memory. CVSSv3.1 8.1 (HIGH) · EPSS 15th percentile
Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 contain an undocumented remote access mechanism enabling unrestricted remote command execution. CVSSv3.1 9.8 (CRITICAL) · EPSS 61th percentile
WBCE CMS version 1.6.2 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the Elfinder file manager. Attackers can exploit the file upload functionality in the elfinder connector to upload a web shell and execute arbitrary system commands through a user-controlled parameter. CVSSv3.1 8.8 (HIGH) · EPSS 50th percentile