Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-16 21:55Z
2025-11-17
2025-11-17 18:15Z
HIGH

CVE-2025-34322 — Nagios Log_server: Log Server versions prior to 2026R1.0.1 contain an authenticated command injection vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-34322

Nagios Log Server versions prior to 2026R1.0.1 contain an authenticated command injection vulnerability in the experimental 'Natural Language Queries' feature. When this feature is configured, certain user-controlled settings—including model selection and connection parameters—are read from the global configuration and concatenated into a shell command that is executed via shell_exec() without proper input handling or command-line argument sanitation. An authenticated user wi CVSSv3.1 7.2 (HIGH) · EPSS 95th percentile

CWECWE 78VNDNagiosTYPVulnerability
7.2
CVSS v3.1
89
Edit Score
2025-11-17
2025-11-17 17:15Z
HIGH

CVE-2025-13319 — An injection vulnerability has been discovered in the API feature in Digi On-Prem Manager

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-13319

An injection vulnerability has been discovered in the API feature in Digi On-Prem Manager, enabling an attacker with valid API tokens to inject SQL via crafted input. The API is not enabled by default, and a valid API token is required to perform the attack. CVSSv3.1 8.8 (HIGH) · EPSS 34th percentile

CWECWE 89CWECWE 20TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-11-17
2025-11-17 16:15Z
HIGH

CVE-2025-63748 — Testmanagement Qatraq: 6.9.2 allows authenticated users to upload arbitrary files via the "Add Attachment" feature

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-63748

QaTraq 6.9.2 allows authenticated users to upload arbitrary files via the "Add Attachment" feature in the "Test Script" module. The application fails to restrict file types, enabling the upload of executable PHP files. Once uploaded, the file can be accessed through the "View Attachment" option, which executes the PHP payload on the server. CVSSv3.1 8.8 (HIGH) · EPSS 30th percentile

CWECWE 434VNDTestmanagementVNDQatraqTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-11-17
2025-11-17 16:15Z
CRIT

CVE-2025-63747 — Testmanagement Qatraq: 6.9.2 ships with administrative account credentials which are enabled in default installations and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-63747

QaTraq 6.9.2 ships with administrative account credentials which are enabled in default installations and permit immediate login via the web application login page. Because the account provides administrative privileges in the default configuration, an attacker who can reach the login page can gain administrative access. CVSSv3.1 9.8 (CRITICAL) · EPSS 33th percentile

CWECWE 521VNDTestmanagementVNDQatraqTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-11-17
2025-11-17 04:15Z
HIGH

CVE-2025-13282 — Cht Tenderdoctransfer: developed by Chunghwa Telecom has a Arbitrary File Delete vulnerability.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-13282

TenderDocTransfer developed by Chunghwa Telecom has a Arbitrary File Delete vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection in the APIs, unauthenticated remote attackers could use these APIs through phishing. Additionally, one of the APIs contains an Absolute Path Traversal vulnerability, allowing attackers to delete arbitrary files on the user's system. CVSSv3.1 8.1 (HIGH) · EPSS 17th percentile

CWECWE 352CWECWE 36VNDChtVNDTenderdoctransferTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-11-15
2025-11-15 22:00Z
HIGH

AMSI-Bypass-via-Page-Guard-Exceptions — Shellcode and In-PowerShell solution for patching AMSI via Page Guard Exceptions

GitHub · EDR bypass / evasion·github.comGITHUB POC

A GitHub repository containing shellcode and in-PowerShell implementations for bypassing Windows Antimalware Scan Interface (AMSI) via page guard exceptions. The technique leverages vectored exception handling to intercept AmsiScanBuffer calls and force clean scan results by manipulating exception handlers and memory protection flags.

SRFOsTACTA0005TYPToolTYPExploitSTGDefense EvasionTECT1562.001STApoc public
76
Edit Score
2025-11-15
2025-11-15 00:15Z
HIGH

CVE-2025-55034 — General: Industrial Controls Lynx+ Gateway is vulnerable to a weak password requirement vulnerability, which

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-55034

General Industrial Controls Lynx+ Gateway is vulnerable to a weak password requirement vulnerability, which may allow an attacker to execute a brute-force attack resulting in unauthorized access and login. CVSSv3.1 8.2 (HIGH) · EPSS 19th percentile

CWECWE 521VNDGeneralTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
728 × 90 / responsive · programmatic ad slot
2025-11-15
2025-11-15 00:00Z
CRIT

RONINGLOADER: DragonBreath’s New Path to PPL Abuse

Elastic Security Labs·elastic.coin the wild

Elastic Security Labs disclosed RONINGLOADER, a multi-stage loader deployed by DragonBreath APT (APT-Q-27) targeting Chinese-speaking users via trojanized NSIS installers. The malware chains multiple evasion techniques including PPL abuse via ClipUp.exe to disable Windows Defender, signed kernel driver exploitation for process termination, custom WDAC policies to block Chinese EDR tools (360 Total Security, Huorong), thread-pool code injection, and phantom DLL side-loading. The campaign demonstrates active weaponization of the August 2025 PPL abuse disclosure and delivers an updated gh0st RAT variant with persistence mechanisms.

SRFApplicationSRFOsTACTA0004TACTA0005TACTA0003OSWindowsSWGh0stVNDMicrosoft
92
Edit Score
2025-11-14
2025-11-14 19:16Z
HIGH

CVE-2025-63680 — Nero Backitup: in the Nero Productline is vulnerable to a path parsing/UI rendering flaw

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-63680

Nero BackItUp in the Nero Productline is vulnerable to a path parsing/UI rendering flaw (CWE-22) that, in combination with Windows ShellExecuteW fallback extension resolution, leads to arbitrary code execution when a user clicks a crafted entry. By creating a trailing-dot folder and placing a same-basename script, Nero BackItUp renders the file as a folder icon and then invokes ShellExecuteW, which executes the script via PATHEXT fallback (.COM/.EXE/.BAT/.CMD). The issue affe CVSSv3.1 8.6 (HIGH) · EPSS 2th percentile

CWECWE 22VNDNeroTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2025-11-14
2025-11-14 18:25Z
INFO

v3.5.1

Nuclei releases·github.com

Nuclei v3.5.1 released with a single maintenance commit removing genproto replace directives from go.mod. This is a minor patch release with no security fixes or feature additions.

VNDProjectdiscoveryTYPTool
15
Edit Score
2025-11-14
2025-11-14 16:54Z
INFO

v3.5.0

Nuclei releases·github.com

Nuclei v3.5.0 released with new features including JSON/XPath headless extractors, VNC authentication, SSH keyboard-interactive support, and Docker execution support. The release includes numerous bug fixes addressing memory leaks, template loading issues, and performance optimizations for concurrent template handling and HTTP probing.

SRFApplicationVNDProjectdiscoveryTYPTool
52
Edit Score
2025-11-14
2025-11-14 14:26Z
CRIT

When The Impersonation Function Gets Used To Impersonate Users (Fortinet FortiWeb Auth. Bypass CVE-2025-64446)

watchTowr Labs·labs.watchtowr.comCVE-2025-64446in the wild

watchTowr Labs disclosed CVE-2025-64446, a critical authentication bypass in Fortinet FortiWeb affecting versions 6.3–8.0.1. The vulnerability chains a path traversal in the API endpoint with an impersonation mechanism in the fwbcgi binary that accepts arbitrary user credentials via a Base64-encoded CGIINFO HTTP header, allowing unauthenticated attackers to assume admin privileges and create persistent backdoor accounts. The vulnerability is actively exploited in the wild; Fortinet silently patched it in version 8.0.2 without explicit advisory, and has now released CVE-2025-64446 with patch guidance.

TACTA0005TACTA0001SRFNetwork ApplianceTACTA0003VNDFortinetTYPWriteupTYPVulnerabilitySTGInitial Access
92
Edit Score
2025-11-14
2025-11-14 13:15Z
HIGH

CVE-2025-8855 — Authorization: Bypass Through User-Controlled Key, Weak Password Recovery Mechanism for Forgotten Password, Authentication Bypass

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-8855

Authorization Bypass Through User-Controlled Key, Weak Password Recovery Mechanism for Forgotten Password, Authentication Bypass by Assumed-Immutable Data vulnerability in Optimus Software Brokerage Automation allows Exploiting Trust in Client, Authentication Bypass, Manipulate Registry Information. This issue affects Brokerage Automation: before 1.1.71. CVSSv3.1 8.1 (HIGH) · EPSS 19th percentile

CWECWE 639CWECWE 640CWECWE 302TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-11-14
2025-11-14 00:00Z
HIGH

Redefining Enterprise Defense in the Era of AI-Led Cyberattacks

Trend Micro Research·trendmicro.comin the wild

Trend Micro research documents the evolution of AI-driven cyberattacks, highlighting a China-aligned group's exploitation of Anthropic's Claude Code to autonomously target 30+ organizations globally through jailbreaking and agentic AI orchestration. The report details how threat actors are progressing from using GenAI for code generation to deploying autonomous AI agents that automate reconnaissance, exploitation, credential harvesting, and data exfiltration with minimal human intervention. The analysis projects a shift toward "Cybercrime as a Servant" models where agentic AI systems manage entire attack campaigns, requiring defenders to adopt similarly automated, agentic defense architectures.

TACTA0004TACTA0005TACTA0001TACTA0002TACTA0006TACTA0007TACTA0003SRFCloud
72
Edit Score
2025-11-13
2025-11-13 20:15Z
HIGH

CVE-2025-60679 — Dlink Dir-816_firmware: A stack buffer overflow vulnerability exists in the D-Link DIR-816A2 router firmware DIR-816A2_FWv1.10CNB05_R1B011D88210.img in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-60679

A stack buffer overflow vulnerability exists in the D-Link DIR-816A2 router firmware DIR-816A2_FWv1.10CNB05_R1B011D88210.img in the upload.cgi module, which handles firmware version information. The vulnerability occurs because /proc/version is read into a 512-byte buffer and then concatenated using sprintf() into another 512-byte buffer containing a 29-byte constant. Input exceeding 481 bytes triggers a stack buffer overflow, allowing an attacker who can control /proc/versio CVSSv3.1 8.8 (HIGH) · EPSS 44th percentile

CWECWE 121VNDDlinkTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-11-13
2025-11-13 17:15Z
HIGH

CVE-2025-60696 — Linksys Re7000_firmware: A stack-based buffer overflow vulnerability exists in the makeRequest.cgi binary of Linksys RE7000 routers

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-60696

A stack-based buffer overflow vulnerability exists in the makeRequest.cgi binary of Linksys RE7000 routers (Firmware FW_v2.0.15_211230_1012). The arplookup function parses lines from /proc/net/arp using sscanf("%16s ... %18s ..."), storing results into buffers v6 (12 bytes) and v7 (20 bytes). Since the format specifiers allow up to 16 and 18 bytes respectively, oversized input can overflow the buffers, resulting in stack corruption. Local attackers controlling /proc/net/arp c CVSSv3.1 8.4 (HIGH) · EPSS 12th percentile

CWECWE 121VNDLinksysTYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2025-11-13
2025-11-13 17:15Z
HIGH

CVE-2025-60692 — Linksys E1200_firmware: A stack-based buffer overflow vulnerability exists in the libshared.so library of Cisco Linksys E1200

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-60692

A stack-based buffer overflow vulnerability exists in the libshared.so library of Cisco Linksys E1200 v2 routers (Firmware E1200_v2.0.11.001_us.tar.gz). The functions get_mac_from_ip and get_ip_from_mac use sscanf with overly permissive "%100s" format specifiers to parse entries from /proc/net/arp into fixed-size buffers (v6: 50 bytes, v7 sub-arrays: 50 bytes). This allows local attackers controlling the contents of /proc/net/arp to overflow stack buffers, leading to memory c CVSSv3.1 8.4 (HIGH) · EPSS 12th percentile

CWECWE 121VNDLinksysTYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2025-11-13
2025-11-13 17:15Z
HIGH

CVE-2025-60691 — Linksys E1200_firmware: A stack-based buffer overflow exists in the httpd binary of Linksys E1200 v2 routers

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-60691

A stack-based buffer overflow exists in the httpd binary of Linksys E1200 v2 routers (Firmware E1200_v2.0.11.001_us.tar.gz). The apply_cgi and block_cgi functions copy user-supplied input from the "url" CGI parameter into stack buffers (v36, v29) using sprintf without bounds checking. Because these buffers are allocated as single-byte variables, any non-empty input will trigger a buffer overflow. Remote attackers can exploit this vulnerability via crafted HTTP requests to exe CVSSv3.1 8.8 (HIGH) · EPSS 50th percentile

CWECWE 121VNDLinksysTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-11-13
2025-11-13 17:15Z
HIGH

CVE-2025-60690 — Linksys E1200_firmware: A stack-based buffer overflow exists in the get_merge_ipaddr function of the httpd binary on

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-60690

A stack-based buffer overflow exists in the get_merge_ipaddr function of the httpd binary on Linksys E1200 v2 routers (Firmware E1200_v2.0.11.001_us.tar.gz). The function concatenates up to four user-supplied CGI parameters matching <parameter>_0~3 into a fixed-size buffer (a2) without bounds checking. Remote attackers can exploit this vulnerability via specially crafted HTTP requests to execute arbitrary code or cause denial of service without authentication. CVSSv3.1 8.8 (HIGH) · EPSS 91th percentile

CWECWE 121VNDLinksysTYPVulnerability
8.8
CVSS v3.1
95
Edit Score
2025-11-13
2025-11-13 16:15Z
HIGH

CVE-2025-62484 — Zoom Meeting_software_development_kit: Inefficient regular expression complexity in certain Zoom Workplace Clients before version 6.5.10 may allow

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-62484

Inefficient regular expression complexity in certain Zoom Workplace Clients before version 6.5.10 may allow an unauthenticated user to conduct an escalation of privilege via network access. CVSSv3.1 8.1 (HIGH) · EPSS 21th percentile

CWECWE 1333VNDZoomVNDInefficientTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-11-13
2025-11-13 00:00Z
HIGH

Increase in Lumma Stealer Activity Coincides with Use of Adaptive Browser Fingerprinting Tactics

Trend Micro Research·trendmicro.comin the wild

Trend Micro reports a resurgence in Lumma Stealer (Water Kurita) activity since October 20, 2025, following the doxxing of its core members. The malware now employs adaptive browser fingerprinting via JavaScript payloads to profile victim environments (system specs, hardware, WebGL, canvas, WebRTC data) while maintaining traditional C&C protocols, enabling enhanced evasion, selective payload deployment, and detection avoidance through legitimate browser process injection.

SRFOsTACTA0011TACTA0009SRFBrowserVNDTrend MicroTYPResearchTYPThreat IntelSTGDefense Evasion
72
Edit Score
2025-11-12
2025-11-12 22:15Z
HIGH

CVE-2025-40204 — Linux: In the Linux kernel, the following vulnerability has been resolved: sctp: Fix MAC comparison

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-40204

In the Linux kernel, the following vulnerability has been resolved: sctp: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this. CVSSv3.1 8.1 (HIGH) · EPSS 9th percentile

TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-11-12
2025-11-12 22:15Z
HIGH

CVE-2025-40186 — Linux: [0]: refcount_t: underflow; use-after-free.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-40186

In the Linux kernel, the following vulnerability has been resolved: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). syzbot reported the splat below in tcp_conn_request(). [0] If a listener is close()d while a TFO socket is being processed in tcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk and calls inet_child_forget(), which calls tcp_disconnect() for the TFO socket. After the cited commit, tcp_disconnect() calls reqsk_fastopen_remove( CVSSv3.1 8.1 (HIGH) · EPSS 11th percentile

TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-11-12
2025-11-12 19:15Z
CRIT

CVE-2025-56385 — Wellsky Harmony: A SQL injection vulnerability exists in the login functionality of WellSky Harmony version 4.1.0.2.83

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-56385

A SQL injection vulnerability exists in the login functionality of WellSky Harmony version 4.1.0.2.83 within the 'xmHarmony.asp' endpoint. User-supplied input to the 'TXTUSERID' parameter is not properly sanitized before being incorporated into a SQL query. Successful authentication may lead to authentication bypass, data leakage, or full system compromise of backend database contents. CVSSv3.1 9.8 (CRITICAL) · EPSS 36th percentile

CWECWE 89VNDWellskyTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-11-12
2025-11-12 17:15Z
HIGH

CVE-2025-59088 — If kdcproxy receives a request for a realm which does not have server addresses

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-59088

If kdcproxy receives a request for a realm which does not have server addresses defined in its configuration, by default, it will query SRV records in the DNS zone matching the requested realm name. This creates a server-side request forgery vulnerability, since an attacker could send a request for a realm matching a DNS zone where they created SRV records pointing to arbitrary ports and hostnames (which may resolve to loopback or internal IP addresses). This vulnerability ca CVSSv3.1 8.6 (HIGH) · EPSS 32th percentile

CWECWE 918TYPVulnerability
8.6
CVSS v3.1
93
Edit Score