Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-16 14:29Z
2025-12-07
2025-12-07 16:15Z
HIGH

CVE-2025-14196 — This manipulation of the argument param causes buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-14196

A weakness has been identified in H3C Magic B1 up to 100R004. The affected element is the function sub_44de0 of the file /goform/aspForm. This manipulation of the argument param causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way. CVSSv3.1 8.8 (HIGH) · EPSS 43th percentile

CWECWE 120CWECWE 119TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-12-07
2025-12-07 13:15Z
HIGH

CVE-2025-14191 — Utt 512w_firmware: Such manipulation of the argument except leads to buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-14191

A vulnerability has been found in UTT 进取 512W up to 1.7.7-171114. Affected by this issue is the function strcpy of the file /goform/formP2PLimitConfig. Such manipulation of the argument except leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. CVSSv3.1 8.8 (HIGH) · EPSS 56th percentile

CWECWE 120CWECWE 119VNDUttTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-12-07
2025-12-07 04:16Z
CRIT

react2shell-scanner — High Fidelity Detection Mechanism for RSC/Next.js RCE (CVE-2025-55182 & CVE-2025-66478)

GitHub · recent CVE PoCs·github.comGITHUB POCCVE-2025-55182CVE-2025-66478in the wild

Assetnote released react2shell-scanner, a Python tool for detecting critical RCE vulnerabilities (CVE-2025-55182 and CVE-2025-66478) in Next.js applications using React Server Components. The scanner executes a deterministic PoC payload and detects vulnerability via response header reflection, with optional safe-check mode, WAF bypass techniques, and multi-threaded scanning capabilities.

SRFApplicationTACTA0002SRFWebVNDReactVNDNext JsTYPToolTYPExploitSTGExecution
92
Edit Score
2025-12-06
2025-12-06 22:15Z
HIGH

CVE-2025-40282 — Linux: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: reset link-local

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-40282

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: reset link-local header on ipv6 recv path Bluetooth 6lowpan.c netdev has header_ops, so it must set link-local header for RX skb, otherwise things crash, eg. with AF_PACKET SOCK_RAW Add missing skb_reset_mac_header() for uncompressed ipv6 RX path. For the compressed one, it is done in lowpan_header_decompress(). Log: (BlueZ 6lowpan-tester Client Recv Raw - Success) ------ kernel BUG a CVSSv3.1 8.8 (HIGH) · EPSS 7th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-12-06
2025-12-06 22:15Z
HIGH

CVE-2025-40273 — Linux: It leads to the open state being freed thru release_openowner-> nfs4_free_ol_stateid() and it finds

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-40273

In the Linux kernel, the following vulnerability has been resolved: NFSD: free copynotify stateid in nfs4_free_ol_stateid() Typically copynotify stateid is freed either when parent's stateid is being close/freed or in nfsd4_laundromat if the stateid hasn't been used in a lease period. However, in case when the server got an OPEN (which created a parent stateid), followed by a COPY_NOTIFY using that stateid, followed by a client reboot. New client instance while doing CREAT CVSSv3.1 8.8 (HIGH) · EPSS 7th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-12-06
2025-12-06 16:15Z
HIGH

CVE-2025-14141 — Utt 520w_firmware: Executing manipulation of the argument pools can lead to buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-14141

A flaw has been found in UTT 进取 520W 1.7.7-180627. The impacted element is the function strcpy of the file /goform/formArpBindConfig. Executing manipulation of the argument pools can lead to buffer overflow. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. CVSSv3.1 8.8 (HIGH) · EPSS 56th percentile

CWECWE 120CWECWE 119VNDUttTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-12-06
2025-12-06 13:15Z
HIGH

CVE-2025-14136 — Linksys Re6500_firmware: The manipulation of the argument clientsname_0 results in stack-based buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-14136

A security flaw has been discovered in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This vulnerability affects the function RE2000v2Repeater_get_wired_clientlist_setClientsName of the file mod_form.so. The manipulation of the argument clientsname_0 results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been released to the public and may be exploited. The vendor was con CVSSv3.1 8.8 (HIGH) · EPSS 65th percentile

CWECWE 787CWECWE 121CWECWE 119VNDLinksysTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
728 × 90 / responsive · programmatic ad slot
2025-12-06
2025-12-06 12:15Z
HIGH

CVE-2025-14135 — Linksys Re6500_firmware: The manipulation of the argument clientsname_0 leads to stack-based buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-14135

A vulnerability was identified in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This affects the function AP_get_wired_clientlist_setClientsName of the file mod_form.so. The manipulation of the argument clientsname_0 leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not CVSSv3.1 8.8 (HIGH) · EPSS 57th percentile

CWECWE 787CWECWE 121CWECWE 119VNDLinksysTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-12-06
2025-12-06 12:04Z
CRIT

Nuclei Templates v10.3.5 - Release Notes

Nuclei templates·github.comCVE-2025-55182CVE-2024-6220CVE-2023-37999CVE-2023-30869CVE-2023-3277CVE-2023-2734CVE-2022-34487CVE-2022-33198CVE-2021-36888CVE-2021-4073CVE-2019-25213CVE-2025-51586CVE-2025-47445CVE-2025-11307CVE-2025-10211CVE-2025-10210CVE-2025-5301CVE-2024-47308CVE-2024-9161CVE-2024-6555CVE-2023-41954CVE-2023-40211CVE-2023-38875CVE-2023-5815CVE-2022-31101CVE-2022-28666CVE-2022-0879CVE-2021-23394CVE-2020-11732CVE-2019-17671CVE-2019-14950CVE-2019-10647CVE-2018-17082

Nuclei Templates v10.3.5 adds 57 new detection templates covering 33 CVEs, with critical focus on React Server Components RCE (CVE-2025-55182), WordPress plugin vulnerabilities (auth bypass, arbitrary file upload, privilege escalation), and PrestaShop/CMS exploits. The release includes bug fixes reducing false positives/negatives and enhanced detection accuracy across WordPress ecosystem, PHP applications, and infrastructure services.

SRFApplicationTACTA0004TACTA0001TACTA0002SRFWebVNDProjectdiscoveryTYPToolTYPVulnerability
9.8
CVSS v3.1
72
Edit Score
2025-12-06
2025-12-06 11:15Z
HIGH

CVE-2025-14133 — Linksys Re6500_firmware: Performing manipulation of the argument clientsname_0 results in stack-based buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-14133

A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. Affected by this vulnerability is the function AP_get_wireless_clientlist_setClientsName of the file mod_form.so. Performing manipulation of the argument clientsname_0 results in stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about t CVSSv3.1 8.8 (HIGH) · EPSS 57th percentile

CWECWE 787CWECWE 121CWECWE 119VNDLinksysTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-12-06
2025-12-06 10:16Z
HIGH

CVE-2025-14126 — Such manipulation leads to hard-coded credentials.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-14126

A vulnerability has been found in TOZED ZLT M30S and ZLT M30S PRO 1.47/3.09.06. Affected is an unknown function of the component Web Interface. Such manipulation leads to hard-coded credentials. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. CVSSv3.1 8.8 (HIGH) · EPSS 12th percentile

CWECWE 798CWECWE 259TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-12-06
2025-12-06 10:16Z
HIGH

CVE-2025-13065 — Starter: The Starter Templates plugin for WordPress is vulnerable to arbitrary file upload in all

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-13065

The Starter Templates plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 4.4.41. This is due to insufficient file type validation detecting WXR files, allowing double extension files to bypass sanitization while being accepted as a valid WXR file. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution poss CVSSv3.1 8.8 (HIGH) · EPSS 96th percentile

CWECWE 434VNDStarterTYPVulnerability
8.8
CVSS v3.1
98
Edit Score
2025-12-06
2025-12-06 10:16Z
HIGH

CVE-2025-12966 — One: The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file uploads due

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-12966

The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the resolve_import_directory() function in versions 4.5.4 to 4.5.7. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. CVSSv3.1 8.8 (HIGH) · EPSS 42th percentile

CWECWE 434VNDOneTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-12-06
2025-12-06 07:15Z
CRIT

CVE-2025-13377 — 10web 10web_booster: The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-13377

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to arbitrary folder deletion due to insufficient file path validation in the get_cache_dir_for_page_from_url() function in all versions up to, and including, 2.32.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary folders on the server, which can easily lead to a loss of data or a denial of service cond CVSSv3.1 9.6 (CRITICAL) · EPSS 41th percentile

CWECWE 22VNDBoosterVND10webTYPVulnerability
9.6
CVSS v3.1
98
Edit Score
2025-12-06
2025-12-06 06:15Z
CRIT

CVE-2025-12673 — Flex: The Flex QR Code Generator plugin for WordPress is vulnerable to arbitrary file uploads

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-12673

The Flex QR Code Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_qr_code() function in all versions up to, and including, 1.2.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. CVSSv3.1 9.8 (CRITICAL)

CWECWE 434VNDFlexTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-12-06
2025-12-06 01:27Z
CRIT

CVE-2025-55182 — RSC/Next.js RCE Vulnerability Detector & PoC Chrome Extension – CVE-2025-55182 & CVE-2025-66478

GitHub · recent CVE PoCs·github.comGITHUB POCCVE-2025-55182CVE-2025-66478in the wild

A public GitHub repository released a Chrome extension and Shodan scanner toolkit for detecting and exploiting CVE-2025-55182 and CVE-2025-66478, critical RCE vulnerabilities in React Server Components (RSC) and Next.js applications. The toolkit includes automated vulnerability detection, proof-of-concept exploitation capabilities, and a CORS-bypass proxy for remote testing.

SRFApplicationTACTA0002SRFWebTACTA0003VNDReactVNDNext JsTYPToolTYPWriteup
88
Edit Score
2025-12-05
2025-12-05 23:15Z
HIGH

CVE-2025-34291 — Langflow Langflow: versions up to and including 1.6.9 contain a chained vulnerability that enables account

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-34291

Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_t CVSSv3.1 8.8 (HIGH) · EPSS 93th percentile

CWECWE 346VNDLangflowTYPVulnerability
8.8
CVSS v3.1
97
Edit Score
2025-12-05
2025-12-05 22:15Z
HIGH

CVE-2025-14108 — Zspace Q2c_nas_firmware: This manipulation of the argument safe_dir causes command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-14108

A weakness has been identified in ZSPACE Q2C NAS up to 1.1.0210050. Affected by this issue is the function zfilev2_api.OpenSafe of the file /v2/file/safe/open of the component HTTP POST Request Handler. This manipulation of the argument safe_dir causes command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure and confirmed the existence of th CVSSv3.1 8.8 (HIGH) · EPSS 96th percentile

CWECWE 74CWECWE 77VNDZspaceTYPVulnerability
8.8
CVSS v3.1
97
Edit Score
2025-12-05
2025-12-05 22:15Z
HIGH

CVE-2025-14107 — Zspace Q2c_nas_firmware: The manipulation of the argument safe_dir results in command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-14107

A security flaw has been discovered in ZSPACE Q2C NAS up to 1.1.0210050. Affected by this vulnerability is the function zfilev2_api.SafeStatus of the file /v2/file/safe/status of the component HTTP POST Request Handler. The manipulation of the argument safe_dir results in command injection. The attack may be performed from remote. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure and confirmed the existence CVSSv3.1 8.8 (HIGH) · EPSS 96th percentile

CWECWE 74CWECWE 77VNDZspaceTYPVulnerability
8.8
CVSS v3.1
98
Edit Score
2025-12-05
2025-12-05 22:15Z
HIGH

CVE-2025-14106 — Zspace Q2c_nas_firmware: The manipulation of the argument safe_dir leads to command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-14106

A vulnerability was identified in ZSPACE Q2C NAS up to 1.1.0210050. Affected is the function zfilev2_api.CloseSafe of the file /v2/file/safe/close of the component HTTP POST Request Handler. The manipulation of the argument safe_dir leads to command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability. A technical CVSSv3.1 8.8 (HIGH) · EPSS 96th percentile

CWECWE 74CWECWE 77VNDZspaceTYPVulnerability
8.8
CVSS v3.1
98
Edit Score
2025-12-05
2025-12-05 18:15Z
CRIT

CVE-2025-66562 — Aiql Tuui: Prior to 1.3.4, a critical Remote Code Execution (RCE) vulnerability exists in Tuui due

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-66562

TUUI is a desktop MCP client designed as a tool unitary utility integration. Prior to 1.3.4, a critical Remote Code Execution (RCE) vulnerability exists in Tuui due to an unsafe Cross-Site Scripting (XSS) flaw in the Markdown rendering component. Tuui allows the execution of arbitrary JavaScript within ECharts code blocks. Combined with an exposed IPC interface that allows spawning processes, an attacker can execute arbitrary system commands on the victim's machine simply by CVSSv3.1 9.6 (CRITICAL) · EPSS 43th percentile

CWECWE 94CWECWE 79VNDAiqlVNDTuuiTYPVulnerability
9.6
CVSS v3.1
98
Edit Score
2025-12-05
2025-12-05 17:48Z
INFO

Ghostwriter v6.1 — Playing Fetch with BloodHound

SpecterOps·specterops.io

SpecterOps released Ghostwriter v6.1, introducing native BloodHound integration that allows direct import of BloodHound data and findings into assessment projects. The release also adds collaborative project notes, improved caption editor objects, dark mode, expanded SSO/MFA options including WebAuthn groundwork, and programmatic evidence downloads via GraphQL.

SRFApplicationVNDBloodhoundVNDGhostwriterTYPToolSTGLat MovementSTGCollection
62
Edit Score
2025-12-05
2025-12-05 17:16Z
HIGH

CVE-2025-65879 — Yeqifu Warehouse_management_system: Warehouse Management System 1.2 contains an authenticated arbitrary file deletion vulnerability.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-65879

Warehouse Management System 1.2 contains an authenticated arbitrary file deletion vulnerability. The /goods/deleteGoods endpoint accepts a user-controlled goodsimg parameter, which is directly concatenated with the server's UPLOAD_PATH and passed to File.delete() without validation. A remote authenticated attacker can delete arbitrary files on the server by supplying directory traversal payloads. CVSSv3.1 8.1 (HIGH) · EPSS 55th percentile

CWECWE 22VNDYeqifuVNDWarehouseTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-12-05
2025-12-05 17:16Z
HIGH

CVE-2025-65036 — Xwiki Pro_macros: Prior to 1.27.1, the macro executes Velocity from the details pages without checking for

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-65036

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to 1.27.1, the macro executes Velocity from the details pages without checking for permissions, which can lead to remote code execution. This vulnerability is fixed in 1.27.1. CVSSv3.1 8.3 (HIGH) · EPSS 34th percentile

CWECWE 862VNDXwikiTYPVulnerability
8.3
CVSS v3.1
92
Edit Score
2025-12-05
2025-12-05 16:15Z
HIGH

CVE-2025-65897 — Zhaoyachao Zdh_web: In zdh_web thru 5.6.17, insufficient validation of file upload paths in the application allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-65897

zdh_web is a data collection, processing, monitoring, scheduling, and management platform. In zdh_web thru 5.6.17, insufficient validation of file upload paths in the application allows an authenticated user to write arbitrary files to the server file system, potentially overwriting existing files and leading to privilege escalation or remote code execution. CVSSv3.1 8.8 (HIGH) · EPSS 54th percentile

CWECWE 434CWECWE 22VNDZhaoyachaoTYPVulnerability
8.8
CVSS v3.1
94
Edit Score