Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-17 00:17Z
2025-11-08
2025-11-08 06:15Z
HIGH

CVE-2025-9334 — Better: The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-9334

The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 1.7.7. This is due to insufficient input validation and restriction on the 'rtafar_ajax' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to call arbitrary plugin functions and execute code within those functions. CVSSv3.1 8.8 (HIGH)

CWECWE 94VNDBetterTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-11-08
2025-11-08 04:15Z
HIGH

CVE-2025-12161 — Smart: The Smart Auto Upload Images plugin for WordPress is vulnerable to arbitrary file uploads

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-12161

The Smart Auto Upload Images plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the auto-image creation functionality in all versions up to, and including, 1.2.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. CVSSv3.1 8.8 (HIGH) · EPSS 43th percentile

CWECWE 434VNDSmartTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-11-08
2025-11-08 00:15Z
HIGH

CVE-2025-12907 — Google Chrome: Insufficient validation of untrusted input in Devtools in Google Chrome prior to 140.0.7339.80 allowed

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-12907

Insufficient validation of untrusted input in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to execute arbitrary code via user action in Devtools. (Chromium security severity: Low) CVSSv3.1 8.8 (HIGH) · EPSS 19th percentile

CWECWE 20VNDGoogleTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-11-07
2025-11-07 23:15Z
HIGH

CVE-2025-37736 — Elastic Elastic_cloud_enterprise: Improper Authorization in Elastic Cloud Enterprise can lead to Privilege Escalation where the built-in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-37736

Improper Authorization in Elastic Cloud Enterprise can lead to Privilege Escalation where the built-in readonly user can call APIs that should not be allowed. The list of APIs that are affected by this issue is: post:/platform/configuration/security/service-accounts delete:/platform/configuration/security/service-accounts/{user_id} patch:/platform/configuration/security/service-accounts/{user_id} post:/platform/configuration/security/service-accounts/{user_id}/keys delet CVSSv3.1 8.8 (HIGH) · EPSS 29th percentile

CWECWE 863VNDElasticTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-11-07
2025-11-07 20:15Z
CRIT

CVE-2025-10230 — Samba: A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-10230

A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from registration packets are passed to a shell without proper validation or escaping. Unsanitized NetBIOS name data from WINS registration packets are inserted into a shell command and executed by the Samba Active Directory Domain Controller’s wins hook, allowing an unauthenticated network attacker to achieve remote command execution as the Samba process. CVSSv3.1 10.0 (CRITICAL) · EPSS 98th percentile

CWECWE 78VNDSambaTYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2025-11-07
2025-11-07 13:15Z
HIGH

CVE-2025-10968 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE -

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-10968

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE - 564 - SQL Injection: Hibernate vulnerability in GG Soft Software Services Inc. PaperWork allows Blind SQL Injection, SQL Injection. This issue affects PaperWork: from 6.1.0.9390 before 6.1.0.9398. CVSSv3.1 8.8 (HIGH) · EPSS 12th percentile

CWECWE 89TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-11-07
2025-11-07 11:00Z
CRIT

What’s That Coming Over The Hill? (Monsta FTP Remote Code Execution CVE-2025-34299)

watchTowr Labs·labs.watchtowr.comCVE-2025-34299CVE-2022-31827CVE-2022-27469CVE-2022-27468in the wild

watchTowr Labs discovered CVE-2025-34299, a pre-authenticated remote code execution vulnerability in Monsta FTP affecting versions up to 2.11.2. The vulnerability chains an SFTP connection mechanism with arbitrary file write via the downloadFile action, allowing attackers to write malicious PHP files to the web root. The flaw persisted unfixed across multiple versions despite prior CVE disclosures for similar issues, and was patched in version 2.11.3 released 26 August 2025.

SRFApplicationTACTA0001TACTA0002SRFWebVNDMonsta FtpTYPWriteupTYPVulnerabilitySTGExecution
82
Edit Score
728 × 90 / responsive · programmatic ad slot
2025-11-07
2025-11-07 05:16Z
CRIT

CVE-2025-64338 — Oxygenz Clipbucket: In versions 5.5.2 - #156 and below, an authenticated regular user can create a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-64338

ClipBucket v5 is an open source video sharing platform. In versions 5.5.2 - #156 and below, an authenticated regular user can create a photo collection whose Collection Name contains HTML/JavaScript payloads, which making ClipBucket’s Manage Photos feature vulnerable to Stored XSS. The payload is rendered unsafely in the Admin → Manage Photos interface, causing it to execute in the administrator’s browser, therefore allowing an attacker to target administrators and perform ac CVSSv3.1 9.0 (CRITICAL) · EPSS 40th percentile

CWECWE 269CWECWE 79VNDClipbucketVNDOxygenzTYPVulnerability
9.0
CVSS v3.1
95
Edit Score
2025-11-07
2025-11-07 05:16Z
HIGH

CVE-2025-4519 — Themeatelier Idonate: The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-4519

The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the idonate_donor_password() function in versions 2.1.5 to 2.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to initiate a password reset for any user (including administrators) and elevate their privileges for full site takeover. CVSSv3.1 8.8 (HIGH) · EPSS 25th percentile

CWECWE 285VNDThemeatelierVNDIdonateTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-11-07
2025-11-07 04:15Z
HIGH

CVE-2025-64328 — Sangoma Filestore: In versions 17.0.2.36 and above before 17.0.3, the filestore module within the Administrative interface

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-64328in the wild

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions 17.0.2.36 and above before 17.0.3, the filestore module within the Administrative interface is vulnerable to a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to obtain remote access to the system as an asterisk user. This issue is fixed in version 17.0.3. CVSSv3.1 7.2 (HIGH) · EPSS 100th percentile

CWECWE 78VNDFreepbxVNDSangomaTYPVulnerabilitySTAitw exploited
7.2
CVSS v3.1
100
Edit Score
2025-11-07
2025-11-07 04:15Z
HIGH

CVE-2025-5483 — Wizard: The LC Wizard plugin for WordPress is vulnerable to Privilege Escalation due to a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-5483

The LC Wizard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check in the ghl-wizard/inc/wp_user.php file in versions 1.2.10 to 1.3.0. This makes it possible for unauthenticated attackers to create new user accounts with the administrator role when the PRO functionality is enabled. CVSSv3.1 8.1 (HIGH) · EPSS 22th percentile

CWECWE 862VNDWizardTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-11-06
2025-11-06 23:15Z
HIGH

CVE-2025-62630 — Advantech Deviceon\/iedge: Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-62630

Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to traverse directories and achieve remote code execution with system-level permissions. CVSSv3.1 8.8 (HIGH) · EPSS 53th percentile

CWECWE 22VNDAdvantechTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-11-06
2025-11-06 23:15Z
HIGH

CVE-2025-58423 — Advantech Deviceon\/iedge: Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-58423

Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to cause a denial-of-service condition, traverse directories, or read/write files, within the context of the local system account. CVSSv3.1 8.8 (HIGH) · EPSS 45th percentile

CWECWE 22VNDAdvantechTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-11-06
2025-11-06 23:15Z
HIGH

CVE-2025-12036 — Google Chrome: Out of bounds memory access in V8 in Google Chrome prior to 141.0.7390.122 allowed

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-12036

Out of bounds memory access in V8 in Google Chrome prior to 141.0.7390.122 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High) CVSSv3.1 8.8 (HIGH) · EPSS 89th percentile

CWECWE 125VNDGoogleTYPVulnerability
8.8
CVSS v3.1
95
Edit Score
2025-11-06
2025-11-06 23:15Z
HIGH

CVE-2025-11756 — Google Chrome: Use after free in Safe Browsing in Google Chrome prior to 141.0.7390.107 allowed a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-11756

Use after free in Safe Browsing in Google Chrome prior to 141.0.7390.107 allowed a remote attacker who had compromised the renderer process to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High) CVSSv3.1 8.8 (HIGH) · EPSS 34th percentile

CWECWE 416VNDGoogleTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-11-06
2025-11-06 23:15Z
HIGH

CVE-2025-11460 — Google Chrome: Use after free in Storage in Google Chrome prior to 141.0.7390.65 allowed a remote

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-11460

Use after free in Storage in Google Chrome prior to 141.0.7390.65 allowed a remote attacker to execute arbitrary code via a crafted video file. (Chromium security severity: High) CVSSv3.1 8.8 (HIGH) · EPSS 25th percentile

CWECWE 416VNDGoogleTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-11-06
2025-11-06 23:15Z
HIGH

CVE-2025-11458 — Google Chrome: Heap buffer overflow in Sync in Google Chrome prior to 141.0.7390.65 allowed a remote

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-11458

Heap buffer overflow in Sync in Google Chrome prior to 141.0.7390.65 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High) CVSSv3.1 8.1 (HIGH) · EPSS 21th percentile

CWECWE 787CWECWE 122VNDGoogleVNDHeapTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-11-06
2025-11-06 22:15Z
HIGH

CVE-2025-11209 — Google Chrome: Inappropriate implementation in Omnibox in Google Chrome on Android prior to 141.0.7390.54 allowed a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-11209

Inappropriate implementation in Omnibox in Google Chrome on Android prior to 141.0.7390.54 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium) CVSSv3.1 8.2 (HIGH) · EPSS 16th percentile

CWECWE 290VNDGoogleVNDInappropriateTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2025-11-06
2025-11-06 22:15Z
HIGH

CVE-2025-11205 — Google Chrome: Heap buffer overflow in WebGPU in Google Chrome prior to 141.0.7390.54 allowed a remote

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-11205

Heap buffer overflow in WebGPU in Google Chrome prior to 141.0.7390.54 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) CVSSv3.1 8.8 (HIGH) · EPSS 23th percentile

CWECWE 787CWECWE 122VNDGoogleVNDHeapTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-11-06
2025-11-06 21:15Z
HIGH

CVE-2025-12486 — Heimdall: Data Database Proxy Cross-Site Scripting Remote Code Execution Vulnerability.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-12486

Heimdall Data Database Proxy Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Heimdall Data Database Proxy. Minimal user interaction is required to exploit this vulnerability. The specific flaw exists within the handling of the database event logs. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of arbitrary sc CVSSv3.1 8.8 (HIGH) · EPSS 40th percentile

CWECWE 79VNDHeimdallTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-11-06
2025-11-06 20:15Z
HIGH

CVE-2025-12490 — Netgate: pfSense CE Suricata Path Traversal Remote Code Execution Vulnerability.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-12490

Netgate pfSense CE Suricata Path Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of Netgate pfSense. Authentication is required to exploit this vulnerability. The specific flaw exists within the Suricata package. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create fil CVSSv3.1 8.8 (HIGH) · EPSS 97th percentile

CWECWE 22VNDNetgateTYPVulnerability
8.8
CVSS v3.1
99
Edit Score
2025-11-06
2025-11-06 20:15Z
CRIT

CVE-2022-50589 — Salesagility Suitecrm: versions prior to 7.12.6 contain a SQL injection vulnerability within the processing of

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-50589

SuiteCRM versions prior to 7.12.6 contain a SQL injection vulnerability within the processing of the ‘uid’ parameter within the ‘export’ functionality. Successful exploitation allows remote unauthenticated attackers to ultimately execute arbitrary code. CVSSv3.1 9.8 (CRITICAL) · EPSS 46th percentile

CWECWE 89VNDSalesagilityVNDSuitecrmTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-11-06
2025-11-06 17:15Z
HIGH

CVE-2025-12485 — Devolutions Devolutions_server: Improper privilege management during pre-MFA cookie handling in Devolutions Server allows a low-privileged authenticated

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-12485

Improper privilege management during pre-MFA cookie handling in Devolutions Server allows a low-privileged authenticated user to impersonate another account by replaying the pre-MFA cookie.This does not bypass the target account MFA verification step. This issue affects the following versions : * Devolutions Server 2025.3.2.0 through 2025.3.5.0 * Devolutions Server 2025.2.15.0 and earlier CVSSv3.1 8.8 (HIGH) · EPSS 47th percentile

CWECWE 269VNDDevolutionsVNDMfaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-11-06
2025-11-06 16:16Z
HIGH

CVE-2025-64287 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-64287

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Alloggio - Hotel Booking alloggio allows PHP Local File Inclusion.This issue affects Alloggio - Hotel Booking: from n/a through <= 1.8. CVSSv3.1 8.1 (HIGH)

CWECWE 98TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-11-06
2025-11-06 16:16Z
HIGH

CVE-2025-62067 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-62067

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Savory savory.This issue affects Savory: from n/a through <= 2.5. CVSSv3.1 8.1 (HIGH)

CWECWE 98TYPVulnerability
8.1
CVSS v3.1
91
Edit Score