Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-16 21:08Z
2025-11-25
2025-11-25 17:00Z
HIGH

Less Praying More Relaying – Enumerating EPA Enforcement for MSSQL and HTTPS

SpecterOps·specterops.io

SpecterOps released RelayInformer, a Python tool and Cobalt Strike BOF suite that enumerates Extended Protection for Authentication (EPA) enforcement across MSSQL, HTTP/S, and LDAPS services. The research demonstrates methodologies for detecting all three EPA enforcement levels (Disabled, Allowed/When Supported, Required) by manipulating NTLM AV pairs and analyzing server responses, enabling attackers to determine relay feasibility before investing in coercion and tunneling infrastructure.

SRFApplicationSRFNetworkTACTA0006TACTA0008VNDMicrosoftVNDIisTYPResearchTYPTechnique
82
Edit Score
2025-11-25
2025-11-25 11:01Z
CRIT

Stop Putting Your Passwords Into Random Websites (Yes, Seriously, You Are The Problem)

watchTowr Labs·labs.watchtowr.com

watchTowr researchers discovered 80,000+ saved JSON/code snippets on public formatter websites (JSONFormatter.org, CodeBeautify.org) containing thousands of exposed secrets including Active Directory credentials, API keys, cloud environment keys, private keys, and sensitive PII from critical infrastructure, government, finance, banking, and cybersecurity organizations. The researchers exploited trivial enumeration of sequential IDs and public "Recent Links" pages to systematically extract credentials, database passwords, CI/CD pipeline tokens, and full KYC banking data across a 5-year historical window.

TACTA0007SRFWebSRFCloudTYPResearchTYPThreat IntelSTGDiscoverySTGCred AccessTECT1552
92
Edit Score
2025-11-24
2025-11-24 21:16Z
HIGH

CVE-2025-52538 — XOCL: Improper input validation within the XOCL driver may allow a local attacker to generate

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-52538

Improper input validation within the XOCL driver may allow a local attacker to generate an integer overflow condition, potentially resulting in loss of confidentiality or availability. CVSSv3.1 8.0 (HIGH) · EPSS 2th percentile

CWECWE 190VNDXoclTYPVulnerability
8.0
CVSS v3.1
90
Edit Score
2025-11-24
2025-11-24 20:15Z
HIGH

CVE-2025-56400 — Tuya Smartlife: Cross-Site Request Forgery (CSRF) vulnerability in the OAuth implementation of the Tuya SDK 6.5.0

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-56400

Cross-Site Request Forgery (CSRF) vulnerability in the OAuth implementation of the Tuya SDK 6.5.0 for Android and iOS, affects the Tuya Smart and Smartlife mobile applications, as well as other third-party applications that integrate the SDK, allows an attacker to link their own Amazon Alexa account to a victim's Tuya account. The applications fail to validate the OAuth state parameter during the account linking flow, enabling a cross-site request forgery (CSRF)-like attack. CVSSv3.1 8.8 (HIGH) · EPSS 3th percentile

CWECWE 352CWECWE 384VNDTuyaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-11-24
2025-11-24 18:15Z
HIGH

CVE-2025-13609 — This action overwrites the legitimate agent's identity, enabling the attacker to impersonate the compromised

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-13609

A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted Platform Module (TPM) device but claiming an existing agent's unique identifier (UUID). This action overwrites the legitimate agent's identity, enabling the attacker to impersonate the compromised agent and potentially bypass security controls. CVSSv3.1 8.2 (HIGH) · EPSS 30th percentile

CWECWE 694TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2025-11-24
2025-11-24 16:15Z
HIGH

CVE-2025-44018 — A specially crafted .tar file can lead to a firmware downgrade.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-44018

A firmware downgrade vulnerability exists in the OTA Update functionality of GL-Inet GL-AXT1800 4.7.0. A specially crafted .tar file can lead to a firmware downgrade. An attacker can perform a man-in-the-middle attack to trigger this vulnerability. CVSSv3.1 8.3 (HIGH) · EPSS 23th percentile

CWECWE 295TYPVulnerability
8.3
CVSS v3.1
92
Edit Score
2025-11-24
2025-11-24 13:16Z
CRIT

CVE-2025-40212 — Linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: fix refcount leak

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-40212

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix refcount leak in nfsd_set_fh_dentry() nfsd exports a "pseudo root filesystem" which is used by NFSv4 to find the various exported filesystems using LOOKUP requests from a known root filehandle. NFSv3 uses the MOUNT protocol to find those exported filesystems and so is not given access to the pseudo root filesystem. If a v3 (or v2) client uses a filehandle from that filesystem, nfsd_set_fh_dentry CVSSv3.1 9.8 (CRITICAL) · EPSS 8th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
728 × 90 / responsive · programmatic ad slot
2025-11-21
2025-11-21 19:16Z
CRIT

CVE-2025-62608 — Ml-explore Mlx: Prior to version 0.29.4, there is a heap buffer overflow in mlx::core::load() when parsing

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-62608

MLX is an array framework for machine learning on Apple silicon. Prior to version 0.29.4, there is a heap buffer overflow in mlx::core::load() when parsing malicious NumPy .npy files. Attacker-controlled file causes 13-byte out-of-bounds read, leading to crash or information disclosure. This issue has been patched in version 0.29.4. CVSSv3.1 9.1 (CRITICAL) · EPSS 43th percentile

CWECWE 122VNDMlxVNDMl ExploreTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2025-11-21
2025-11-21 14:19Z
HIGH

An Evening with Claude (Code)

SpecterOps·specterops.ioCVE-2025-64755

Adam Chester (SpecterOps) discovered CVE-2025-64755, a remote code execution vulnerability in Claude Code v2.0.25 via sed expression injection. The vulnerability allowed attackers to write arbitrary files (including shell initialization files) through prompt injection, bypassing regex-based command filtering. Anthropic patched the issue in v2.0.31 within 7 days of disclosure.

SRFApplicationTACTA0002VNDAnthropicTYPResearchTYPWriteupTYPVulnerabilitySTGExecutionSTGInitial Access
78
Edit Score
2025-11-21
2025-11-21 13:15Z
HIGH

CVE-2025-66095 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-66095

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows SQL Injection.This issue affects KiviCare: from n/a through <= 3.6.13. CVSSv3.1 8.5 (HIGH)

CWECWE 89TYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2025-11-21
2025-11-21 08:15Z
HIGH

CVE-2025-13322 — AUDIO: The WP AUDIO GALLERY plugin for WordPress is vulnerable to arbitrary file deletion due

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-13322

The WP AUDIO GALLERY plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in all versions up to, and including, 2.0. This is due to the `wpag_uploadaudio_callback()` AJAX handler not properly validating user-supplied file paths in the `audio_upload` parameter before passing them to `unlink()`. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, wh CVSSv3.1 8.1 (HIGH) · EPSS 48th percentile

CWECWE 73VNDAudioTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-11-21
2025-11-21 02:15Z
CRIT

CVE-2025-64762 — Workos Authkit-nextjs: In environments where CDN caching is enabled, this can result in session tokens being

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-64762

The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In authkit-nextjs version 2.11.0 and below, authenticated responses do not defensively apply anti-caching headers. In environments where CDN caching is enabled, this can result in session tokens being included in cached responses and subsequently served to multiple users. Next.js applications deployed on Vercel are unaffected unless they m CVSSv3.1 9.1 (CRITICAL) · EPSS 29th percentile

CWECWE 524VNDWorkosVNDAuthkitTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2025-11-20
2025-11-20 20:16Z
HIGH

CVE-2025-48986 — Revive-adserver Revive_adserver: Authorization bypass in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an logged

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-48986

Authorization bypass in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an logged in attacker to change other users' email address and potentialy take over their accounts using the forgot password functionality. CVSSv3.1 8.8 (HIGH) · EPSS 49th percentile

CWECWE 284VNDRevive AdserverTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-11-19
2025-11-19 19:15Z
HIGH

CVE-2025-64759 — Homarr Homarr: Prior to version 1.43.3, stored XSS vulnerability exists, allowing the execution of arbitrary JavaScript

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-64759

Homarr is an open-source dashboard. Prior to version 1.43.3, stored XSS vulnerability exists, allowing the execution of arbitrary JavaScript in a user's browser, with minimal or no user interaction required, due to the rendering of a malicious uploaded SVG file. This could be abused to add an attacker's account to the "credentials-admin" group, giving them full administrative access, if a user logged in as an administrator was to view the page which renders or redirects to th CVSSv3.1 8.1 (HIGH)

CWECWE 434CWECWE 20VNDHomarrTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-11-19
2025-11-19 17:00Z
CRIT

SCCM Hierarchy Takeover via Entra Integration…Because of the Implication

SpecterOps·specterops.ioCVE-2025-21735

SpecterOps disclosed a critical authentication bypass in Microsoft SCCM's Entra ID integration (prior to KB5360093) that allows unauthenticated attackers to impersonate privileged accounts and achieve full hierarchy takeover. The vulnerability stems from insufficient authorization checks in the AdminService REST API—the service validates Entra tokens but trusts UPN claims without verifying the token's associated AD account exists or has appropriate permissions, enabling attackers to craft tokens with spoofed UPNs of site server machine accounts or privileged admins. The attack requires AD domain verification in Entra and ability to manipulate UPNs, but once achieved, grants complete administrative control over the SCCM infrastructure.

SRFApplicationTACTA0004TACTA0001SRFIdentitySRFCloudTACTA0008VNDMicrosoftTYPResearch
92
Edit Score
2025-11-19
2025-11-19 14:00Z
CRIT

Fortinet FortiWeb Authentication Bypass – CVE-2025-64446

Bishop Fox Labs·bishopfox.comCVE-2025-64446in the wild

Bishop Fox disclosed CVE-2025-64446, a critical authentication bypass in Fortinet FortiWeb that allows unauthenticated attackers to create administrative accounts via a single HTTP POST request combining path traversal and a forged CGIINFO header. The vulnerability affects multiple versions (7.0.x, 7.2.x, 7.4.x, 7.6.x, 8.0.x) and is actively exploited in the wild; Fortinet patched it by restricting cgi-bin access in httpd.conf. Bishop Fox released a public scanner and detailed exploit analysis including version-specific vulnerability matrix.

TACTA0001SRFNetwork ApplianceSRFWebTACTA0003VNDFortinetTYPWriteupTYPExploitTYPVulnerability
92
Edit Score
2025-11-19
2025-11-19 13:30Z
CRIT

CVE-2025-32463_chwoot — Escalation of Privilege to the root through sudo binary with chroot option. CVE-2025-32463

GitHub · recent CVE PoCs·github.comGITHUB POCCVE-2025-32463

CVE-2025-32463 is a privilege escalation vulnerability in sudo versions 1.9.14–1.9.17 affecting the chroot (-R) option, allowing unprivileged users to escalate to root. A public proof-of-concept exploit with Docker reproduction environment has been released, demonstrating reliable root shell access on vulnerable systems.

SRFOsTACTA0004VNDSudoTYPWriteupTYPExploitSTGPrivescTECT1548.003EXPPrivilege Escalation
88
Edit Score
2025-11-19
2025-11-19 12:15Z
CRIT

CVE-2025-10437 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-10437

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eksagate Electronic Engineering and Computer Industry Trade Inc. Webpack Management System allows SQL Injection. This issue affects Webpack Management System: through 20251119. CVSSv3.1 9.8 (CRITICAL) · EPSS 11th percentile

CWECWE 89TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-11-18
2025-11-18 10:15Z
HIGH

CVE-2025-13069 — Enable: The Enable SVG, WebP, and ICO Upload plugin for WordPress is vulnerable to arbitrary

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-13069

The Enable SVG, WebP, and ICO Upload plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 1.1.3. This is due to insufficient file type validation detecting ICO files, allowing double extension files with the appropriate magic bytes to bypass sanitization while being accepted as a valid ICO file. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's s CVSSv3.1 8.8 (HIGH)

CWECWE 434VNDEnableTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-11-18
2025-11-18 09:15Z
CRIT

CVE-2025-40548 — Solarwinds Serv-u: A missing validation process exists in Serv U when abused, could give a malicious

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-40548

A missing validation process exists in Serv U when abused, could give a malicious actor with access to admin privileges the ability to execute code. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default. CVSSv3.1 9.1 (CRITICAL) · EPSS 52th percentile

CWECWE 269VNDSolarwindsTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2025-11-18
2025-11-18 05:16Z
HIGH

CVE-2025-48593 — Google Android: In bta_hf_client_cb_init of bta_hf_client_main.cc, there is a possible remote code execution due to a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-48593

In bta_hf_client_cb_init of bta_hf_client_main.cc, there is a possible remote code execution due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. CVSSv3.1 8.0 (HIGH) · EPSS 58th percentile

CWECWE 416VNDGoogleTYPVulnerability
8.0
CVSS v3.1
90
Edit Score
2025-11-18
2025-11-18 00:00Z
HIGH

Breaking Down S3 Ransomware: Variants, Attack Paths and Trend Vision One™ Defenses

Trend Micro Research·trendmicro.com

Trend Micro research documents five S3 ransomware variants targeting AWS environments, ranging from KMS-based encryption attacks to exfiltration-and-deletion tactics. The variants exploit misconfigured IAM policies, leaked credentials, and lesser-known AWS features like SSE-C, external key material imports, and External Key Store (XKS) to render victim data permanently inaccessible. The research includes defensive policy recommendations to restrict dangerous encryption and key management operations.

SRFApplicationTACTA0001TACTA0006SRFCloudTACTA0040VNDAmazonVNDAwsVNDTrend Micro
72
Edit Score
2025-11-17
2025-11-17 23:15Z
HIGH

CVE-2025-13223 — Google Chrome: Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-13223in the wild

Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) CVSSv3.1 8.8 (HIGH) · EPSS 91th percentile

CWECWE 843VNDGoogleVNDTypeTYPVulnerabilitySTAitw exploited
8.8
CVSS v3.1
95
Edit Score
2025-11-17
2025-11-17 20:15Z
HIGH

CVE-2025-36357 — Ibm Planning_analytics_local: Planning Analytics Local 2.1.0 through 2.1.14 could allow a remote authenticated user to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-36357

IBM Planning Analytics Local 2.1.0 through 2.1.14 could allow a remote authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request containing absolute path sequences to view, read, or write arbitrary files on the system. CVSSv3.1 8.0 (HIGH) · EPSS 56th percentile

CWECWE 36VNDIbmTYPVulnerability
8.0
CVSS v3.1
90
Edit Score
2025-11-17
2025-11-17 20:15Z
CRIT

CVE-2024-44659 — Phpgurukul Online_shopping_portal: Online Shopping Portal 2.0 is vulnerable to SQL Injection via the email parameter

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-44659

PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the email parameter in forgot-password.php. CVSSv3.1 9.8 (CRITICAL) · EPSS 35th percentile

CWECWE 89VNDPhpgurukulTYPVulnerability
9.8
CVSS v3.1
99
Edit Score