Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-16 17:12Z
2025-12-03
2025-12-03 00:00Z
HIGH

PureRAT Campaign Targets Job Seekers, Abuses Foxit PDF Reader for DLL Side-loading

Trend Micro Research·trendmicro.comin the wild

Trend Micro disclosed an active PureRAT campaign targeting job seekers via spear-phishing emails containing weaponized archives. The attack chain abuses Foxit PDF Reader through DLL side-loading (msimg32.dll), deploys a hidden Python environment via nested directory obfuscation, and achieves persistence through registry autorun entries. The RAT exfiltrates browser credentials and maintains C&C communication using self-signed certificates with anomalous validity periods.

SRFApplicationSRFOsTACTA0005TACTA0001TACTA0002TACTA0003TACTA0009VNDFoxit
72
Edit Score
2025-12-02
2025-12-02 21:15Z
HIGH

CVE-2025-64642 — Mirion Biodose\/nmis: NMIS/BioDose V22.02 and previous versions' installation directory paths by default have insecure file permissions

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-64642

NMIS/BioDose V22.02 and previous versions' installation directory paths by default have insecure file permissions, which in certain deployment scenarios can enable users on client workstations to modify the program executables and libraries. CVSSv3.1 8.0 (HIGH) · EPSS 2th percentile

CWECWE 732VNDMirionVNDV22TYPVulnerability
8.0
CVSS v3.1
90
Edit Score
2025-12-02
2025-12-02 21:15Z
HIGH

CVE-2025-64298 — Mirion Biodose\/nmis: By default, this directory has insecure directory paths that allow access to the SQL

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-64298

NMIS/BioDose V22.02 and previous version installations where the embedded Microsoft SQLServer Express is used are exposed in the Windows share accessed by clients in networked installs. By default, this directory has insecure directory paths that allow access to the SQL Server database and configuration files, which can contain sensitive data. CVSSv3.1 8.4 (HIGH) · EPSS 15th percentile

CWECWE 732VNDMirionVNDV22TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2025-12-02
2025-12-02 21:15Z
HIGH

CVE-2025-62575 — Mirion Biodose\/nmis: This can lead to remote code execution through the use of certain built-in stored

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-62575

NMIS/BioDose V22.02 and previous versions rely on a Microsoft SQL Server database. The SQL user account 'nmdbuser' and other created accounts by default have the sysadmin role. This can lead to remote code execution through the use of certain built-in stored procedures. CVSSv3.1 8.3 (HIGH)

CWECWE 732VNDMirionVNDV22TYPVulnerability
8.3
CVSS v3.1
92
Edit Score
2025-12-02
2025-12-02 21:15Z
HIGH

CVE-2025-61940 — Mirion Biodose\/nmis: NMIS/BioDose V22.02 and previous versions rely on a common SQL Server user account to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-61940

NMIS/BioDose V22.02 and previous versions rely on a common SQL Server user account to access data in the database. User access in the client application is restricted by a password authentication check in the client software but the underlying database connection always has access. The latest version of NMIS/BioDose introduces an option to use Windows user authentication with the database, which would restrict this database connection. CVSSv3.1 8.3 (HIGH) · EPSS 26th percentile

CWECWE 603VNDMirionVNDV22TYPVulnerability
8.3
CVSS v3.1
92
Edit Score
2025-12-02
2025-12-02 19:15Z
HIGH

CVE-2025-13720 — Google Chrome: Bad cast in Loader in Google Chrome prior to 143.0.7499.41 allowed a remote attacker

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-13720

Bad cast in Loader in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) CVSSv3.1 8.8 (HIGH) · EPSS 19th percentile

CWECWE 704VNDGoogleVNDBadTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-12-02
2025-12-02 19:15Z
HIGH

CVE-2025-13639 — Google Chrome: Inappropriate implementation in WebRTC in Google Chrome prior to 143.0.7499.41 allowed a remote attacker

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-13639

Inappropriate implementation in WebRTC in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: Low) CVSSv3.1 8.1 (HIGH) · EPSS 17th percentile

CWECWE 79VNDGoogleVNDInappropriateTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
728 × 90 / responsive · programmatic ad slot
2025-12-02
2025-12-02 19:15Z
HIGH

CVE-2025-13638 — Google Chrome: Use after free in Media Stream in Google Chrome prior to 143.0.7499.41 allowed a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-13638

Use after free in Media Stream in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low) CVSSv3.1 8.8 (HIGH) · EPSS 18th percentile

CWECWE 416VNDGoogleTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-12-02
2025-12-02 19:15Z
HIGH

CVE-2025-13633 — Google Chrome: Use after free in Digital Credentials in Google Chrome prior to 143.0.7499.41 allowed a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-13633

Use after free in Digital Credentials in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) CVSSv3.1 8.8 (HIGH) · EPSS 35th percentile

CWECWE 416VNDGoogleTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-12-02
2025-12-02 19:15Z
HIGH

CVE-2025-13631 — Google Chrome: Inappropriate implementation in Google Updater in Google Chrome on Mac prior to 143.0.7499.41 allowed

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-13631

Inappropriate implementation in Google Updater in Google Chrome on Mac prior to 143.0.7499.41 allowed a remote attacker to perform privilege escalation via a crafted file. (Chromium security severity: High) CVSSv3.1 8.8 (HIGH) · EPSS 28th percentile

VNDGoogleVNDInappropriateTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-12-02
2025-12-02 16:15Z
CRIT

CVE-2025-59703 — Entrust Nshield_5c_firmware: nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-59703

Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a Physically Proximate Attacker to access the internal components of the appliance, without leaving tamper evidence. To exploit this, the attacker needs to remove the tamper label and all fixing screws from the device without damaging it. This is called an F14 attack. CVSSv3.1 9.1 (CRITICAL)

CWECWE 284VNDEntrustTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2025-12-02
2025-12-02 15:15Z
CRIT

CVE-2025-59695 — Entrust Nshield_5c_firmware: nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-59695

Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a user with OS root access to alter firmware on the Chassis Management Board (without Authentication). This is called F04. CVSSv3.1 9.8 (CRITICAL)

CWECWE 306VNDEntrustTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-12-02
2025-12-02 15:15Z
CRIT

CVE-2025-59693 — Entrust Nshield_5c_firmware: The Chassis Management Board in Entrust nShield Connect XC, nShield 5c, and nShield HSMi

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-59693

The Chassis Management Board in Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allows a physically proximate attacker to obtain debug access and escalate privileges by bypassing the tamper label and opening the chassis without leaving evidence, and accessing the JTAG connector. This is called F02. CVSSv3.1 9.8 (CRITICAL)

CWECWE 269VNDEntrustVNDChassisTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-12-02
2025-12-02 14:16Z
CRIT

CVE-2025-41013 — Tcman Gim: SQL injection vulnerability in TCMAN GIM v11 in version 20250304.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-41013

SQL injection vulnerability in TCMAN GIM v11 in version 20250304. This vulnerability allows an attacker to retrieve, create, update, and delete databases by sending a GET request using the 'idmant' parameter in '/PC/frmEPIS.aspx'. CVSSv3.1 9.8 (CRITICAL) · EPSS 21th percentile

CWECWE 89VNDTcmanTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-12-02
2025-12-02 13:15Z
CRIT

CVE-2025-11788 — Circutor Sge-plc1000_firmware: Heap-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-11788

Heap-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. In the 'ShowSupervisorParameters()' function, there is an unlimited user input that is copied to a fixed-size buffer via 'sprintf()'. The 'GetParameter(meter)' function retrieves the user input, which is directly incorporated into a buffer without size validation. An attacker can provide an excessively large input for the 'meter' parameter. CVSSv3.1 9.8 (CRITICAL) · EPSS 26th percentile

CWECWE 122VNDHeapVNDCircutorTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-12-02
2025-12-02 13:15Z
HIGH

CVE-2025-11787 — Circutor Sge-plc1000_firmware: Command injection vulnerability in the operating system in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2 through the 'GetDNS()'

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-11787

Command injection vulnerability in the operating system in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2 through the 'GetDNS()', 'CheckPing()' and 'TraceRoute()' functions. CVSSv3.1 8.8 (HIGH) · EPSS 62th percentile

CWECWE 78VNDCommandVNDCircutorTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-12-02
2025-12-02 13:15Z
CRIT

CVE-2025-11786 — Circutor Sge-plc1000_firmware: Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-11786

Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. In the 'SetUserPassword()' function, the 'newPassword' parameter is directly embedded in a shell command string using 'sprintf()' without any sanitisation or validation, and then executed using 'system()'. This allows an attacker to inject arbitrary shell commands that will be executed with the same privileges as the application. CVSSv3.1 9.8 (CRITICAL) · EPSS 31th percentile

CWECWE 121VNDStackVNDCircutorTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-12-02
2025-12-02 13:15Z
CRIT

CVE-2025-11784 — Circutor Sge-plc1000_firmware: Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-11784

Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. In the 'ShowMeterDatabase()' function, there is an unlimited user input that is copied to a fixed-size buffer via 'sprintf()'. The 'GetParameter(meter)' function retrieves the user input, which is directly incorporated into a buffer without size validation. An attacker can provide an excessively large input for the 'meter' parameter. CVSSv3.1 9.8 (CRITICAL) · EPSS 31th percentile

CWECWE 121VNDStackVNDCircutorTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-12-02
2025-12-02 13:15Z
CRIT

CVE-2025-11783 — Circutor Sge-plc1000_firmware: Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-11783

Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. The vulnerability is found in the 'AddEvent()' function when copying the user-controlled username input to a fixed-size buffer (48 bytes) without boundary checking. This can lead to memory corruption, resulting in possible remote code execution. CVSSv3.1 9.8 (CRITICAL) · EPSS 46th percentile

CWECWE 121VNDStackVNDCircutorTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-12-02
2025-12-02 13:15Z
CRIT

CVE-2025-11782 — Circutor Sge-plc1000_firmware: Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-11782

Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. The 'ShowDownload()' function uses “sprintf()” to format a string that includes the user-controlled input of 'GetParameter(meter)' in the fixed-size buffer 'acStack_4c' (64 bytes) without checking the length. An attacker can provide an excessively long value for the 'meter' parameter that exceeds the 64-byte buffer size. CVSSv3.1 9.8 (CRITICAL) · EPSS 31th percentile

CWECWE 121VNDStackVNDCircutorTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-12-02
2025-12-02 13:15Z
CRIT

CVE-2025-11779 — Circutor Sge-plc1000_firmware: Stack-based buffer overflow vulnerability in CircutorSGE-PLC1000/SGE-PLC50 v9.0.2.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-11779

Stack-based buffer overflow vulnerability in CircutorSGE-PLC1000/SGE-PLC50 v9.0.2. The 'SetLan' function is invoked when a new configuration is applied. This new configuration function is activated by a management web request, which can be invoked by a user when making changes to the 'index.cgi' web application. The parameters are not being sanitised, which could lead to command injection. CVSSv3.1 9.8 (CRITICAL) · EPSS 68th percentile

CWECWE 121VNDStackVNDCircutorTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-12-02
2025-12-02 11:15Z
CRIT

CVE-2025-41744 — Sprecher-automation Sprecon-e-c_firmware: Sprecher Automations SPRECON-E series uses default cryptographic keys that allow an unprivileged remote attacker

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-41744

Sprecher Automations SPRECON-E series uses default cryptographic keys that allow an unprivileged remote attacker to access all encrypted communications, thereby compromising confidentiality and integrity. CVSSv3.1 9.1 (CRITICAL) · EPSS 35th percentile

CWECWE 1394VNDSprecher AutomationVNDSprecherTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2025-12-02
2025-12-02 11:15Z
CRIT

CVE-2025-41742 — Sprecher-automation Sprecon-e-c_firmware: Sprecher Automations SPRECON-E-C, SPRECON-E-P, SPRECON-E-T3 is vulnerable to attack by an unauthorized remote attacker

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-41742

Sprecher Automations SPRECON-E-C,  SPRECON-E-P, SPRECON-E-T3 is vulnerable to attack by an unauthorized remote attacker via default cryptographic keys. The use of these keys allows the attacker to read, modify, and write projects and data, or to access any device via remote maintenance. CVSSv3.1 9.8 (CRITICAL) · EPSS 39th percentile

CWECWE 1394VNDSprecher AutomationVNDSprecherTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-12-02
2025-12-02 10:16Z
CRIT

CVE-2025-13872 — Objectplanet Opinio: Blind Server-Side Request Forgery (SSRF) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-13872

Blind Server-Side Request Forgery (SSRF) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on Web-based platforms allows an attacker to force the server to perform HTTP GET requests via crafted import requests to an arbitrary destination. CVSSv3.1 9.1 (CRITICAL) · EPSS 23th percentile

CWECWE 918VNDObjectplanetVNDBlindTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2025-12-02
2025-12-02 10:16Z
HIGH

CVE-2025-13871 — Objectplanet Opinio: Cross-Site Request Forgery (CSRF) in the resource-management feature of ObjectPlanet Opinio 7.26 rev12562 allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-13871

Cross-Site Request Forgery (CSRF) in the resource-management feature of ObjectPlanet Opinio 7.26 rev12562 allows to upload files on behalf of the connected users and then access such files without authentication. CVSSv3.1 8.8 (HIGH) · EPSS 8th percentile

CWECWE 352VNDObjectplanetTYPVulnerability
8.8
CVSS v3.1
94
Edit Score