Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-17 05:05Z
2025-10-27
2025-10-27 04:15Z
HIGH

CVE-2025-12212 — Tenda O3_firmware1.0.0.10\(2478\): This manipulation of the argument upnpEn causes stack-based buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-12212

A weakness has been identified in Tenda O3 1.0.0.10(2478). This affects the function SetValue/GetValue of the file /goform/setNetworkService. This manipulation of the argument upnpEn causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. CVSSv3.1 8.8 (HIGH) · EPSS 55th percentile

CWECWE 121CWECWE 119VNDTendaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-10-27
2025-10-27 04:15Z
HIGH

CVE-2025-12211 — Tenda O3_firmware1.0.0.10\(2478\): The manipulation of the argument dmzIP results in stack-based buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-12211

A security flaw has been discovered in Tenda O3 1.0.0.10(2478). Affected by this issue is the function SetValue/GetValue of the file /goform/setDmzInfo. The manipulation of the argument dmzIP results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. CVSSv3.1 8.8 (HIGH) · EPSS 56th percentile

CWECWE 121CWECWE 119VNDTendaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-10-27
2025-10-27 03:15Z
HIGH

CVE-2025-12210 — Tenda O3_firmware1.0.0.10\(2478\): The manipulation of the argument lanIp leads to stack-based buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-12210

A vulnerability was identified in Tenda O3 1.0.0.10(2478). Affected by this vulnerability is the function SetValue/GetValue of the file /goform/AdvSetLanip. The manipulation of the argument lanIp leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. CVSSv3.1 8.8 (HIGH) · EPSS 61th percentile

CWECWE 121CWECWE 119VNDTendaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-10-27
2025-10-27 03:15Z
HIGH

CVE-2025-12209 — Tenda O3_firmware1.0.0.10\(2478\): Executing a manipulation of the argument dhcpEn can lead to stack-based buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-12209

A vulnerability was determined in Tenda O3 1.0.0.10(2478). Affected is the function SetValue/GetValue of the file /goform/setDhcpConfig. Executing a manipulation of the argument dhcpEn can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. CVSSv3.1 8.8 (HIGH) · EPSS 63th percentile

CWECWE 121CWECWE 119VNDTendaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-10-27
2025-10-27 02:15Z
CRIT

CVE-2025-62959 — Control: Improper Control of Generation of Code ('Code Injection') vulnerability in videowhisper Paid Videochat Turnkey

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-62959

Improper Control of Generation of Code ('Code Injection') vulnerability in videowhisper Paid Videochat Turnkey Site ppv-live-webcams allows Remote Code Inclusion.This issue affects Paid Videochat Turnkey Site: from n/a through <= 7.3.23. CVSSv3.1 9.1 (CRITICAL) · EPSS 38th percentile

CWECWE 94TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2025-10-27
2025-10-27 00:00Z
CRIT

Active Water Saci Campaign Spreading Via WhatsApp Features Multi-Vector Persistence and Sophisticated C&C

Trend Micro Research·trendmicro.comin the wild

Trend Micro disclosed an active Water Saci malware campaign spreading via WhatsApp that employs a new script-based infection chain using VBS downloaders and PowerShell payloads to hijack WhatsApp Web sessions, harvest contacts, and establish persistent botnet control. The malware features a sophisticated dual-channel C&C architecture combining email-based (IMAP) infrastructure with HTTP polling, multi-vector persistence mechanisms, and real-time remote command capabilities including pause/resume functionality for coordinated attacks across multiple machines. The campaign targets Portuguese-language systems in Brazil with anti-analysis checks and is likely linked to the Coyote banking trojan, representing an evolution in Brazilian cybercriminal tactics from compiled binaries to browser automation and social engineering at scale.

SRFApplicationTACTA0005TACTA0001TACTA0002TACTA0006TACTA0007SRFWebTACTA0003
82
Edit Score
2025-10-27
2025-10-27 00:00Z
MED

TOR Exit Node Monitoring Overview

Elastic Security Labs·elastic.co

Elastic Security Labs published a technical guide on monitoring TOR exit node activity within enterprise networks. The post provides step-by-step instructions for deploying a TOR node monitoring integration using Elastic-Agent, including ingest pipeline configuration, index templates, and API polling against the TOR Project's Onionoo endpoint to detect reconnaissance, C2 communications, and data exfiltration attempts.

SRFApplicationSRFNetworkTACTA0011TACTA0043SWElasticsearchSWKibanaVNDElasticTYPResearch
68
Edit Score
728 × 90 / responsive · programmatic ad slot
2025-10-25
2025-10-25 07:15Z
HIGH

CVE-2025-10488 — Directorist: The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-10488

The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to arbitrary file move due to insufficient file path validation in the add_listing_action AJAX action in all versions up to, and including, 8.4.8. This makes it possible for unauthenticated attackers to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php). CVSSv3.1 8.1 (HIGH) · EPSS 59th percentile

CWECWE 22VNDDirectoristTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-10-25
2025-10-25 06:15Z
HIGH

CVE-2025-12095 — Simple: The Simple Registration for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-12095

The Simple Registration for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.8. This is due to missing nonce validation on the role requests admin page handler in the includes/display-role-admin.php file. This makes it possible for unauthenticated attackers to approve pending role requests and escalate user privileges via a forged request granted they can trick a site administrator into performing an action CVSSv3.1 8.8 (HIGH) · EPSS 9th percentile

CWECWE 352VNDSimpleTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-10-24
2025-10-24 20:17Z
HIGH

CVE-2025-62716 — Plane: Prior to version 1.1.0, an open redirect vulnerability in the ?next_path query parameter allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-62716

Plane is open-source project management software. Prior to version 1.1.0, an open redirect vulnerability in the ?next_path query parameter allows attackers to supply arbitrary schemes (e.g., javascript:) that are passed directly to router.push. This results in a cross-site scripting (XSS) vulnerability, enabling attackers to execute arbitrary JavaScript in the victim’s browser. The issue can be exploited without authentication and has severe impact, including information disc CVSSv3.1 8.1 (HIGH) · EPSS 23th percentile

CWECWE 79CWECWE 601VNDPlaneTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-10-24
2025-10-24 15:15Z
CRIT

CVE-2025-43995 — Dell Storage_manager: An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-43995

Dell Storage Center - Dell Storage Manager, version(s) 20.1.21, contain(s) an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass. Authentication Bypass in DSM Data Collector. An unauthenticated remote attacker can access APIs exposed by ApiProxy.war in DataCollectorEar.ear by using a special SessionKey and UserId. These userid are special users created in co CVSSv3.1 9.8 (CRITICAL) · EPSS 56th percentile

CWECWE 287VNDDellTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-10-24
2025-10-24 15:15Z
HIGH

CVE-2025-43994 — Dell Storage_manager: Storage Center - Dell Storage Manager, version(s) DSM 20.1.21, contain(s) a Missing Authentication

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-43994

Dell Storage Center - Dell Storage Manager, version(s) DSM 20.1.21, contain(s) a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure. CVSSv3.1 8.6 (HIGH) · EPSS 47th percentile

CWECWE 306VNDDellTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2025-10-24
2025-10-24 09:15Z
HIGH

CVE-2025-12028 — IndieAuth: The IndieAuth plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-12028

The IndieAuth plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4. This is due to missing nonce verification on the `login_form_indieauth()` function and the authorization endpoint at wp-login.php?action=indieauth. This makes it possible for unauthenticated attackers to force authenticated users to approve OAuth authorization requests for attacker-controlled applications via a forged request granted they can trick a use CVSSv3.1 8.8 (HIGH)

CWECWE 352VNDIndieauthTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-10-24
2025-10-24 09:15Z
CRIT

CVE-2025-11253 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-11253

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aksis Technology Inc. Netty ERP allows SQL Injection. This issue affects Netty ERP: before V.1.1000. CVSSv3.1 9.8 (CRITICAL) · EPSS 12th percentile

CWECWE 89TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-10-24
2025-10-24 08:15Z
CRIT

CVE-2025-6440 — WooCommerce: The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-6440

The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'wcdp_save_canvas_design_ajax' function in all versions up to, and including, 1.9.26. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. CVSSv3.1 9.8 (CRITICAL) · EPSS 98th percentile

CWECWE 434VNDWoocommerceTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2025-10-24
2025-10-24 08:15Z
HIGH

CVE-2025-62868 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-62868

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Edge CPT allows PHP Local File Inclusion.This issue affects Edge CPT: from n/a through 1.4. CVSSv3.1 8.1 (HIGH) · EPSS 38th percentile

CWECWE 98TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-10-23
2025-10-23 22:15Z
CRIT

CVE-2025-59503 — Microsoft Azure_compute_resource_provider: Server-side request forgery (ssrf) in Azure Compute Gallery allows an unauthorized attacker to elevate

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-59503

Server-side request forgery (ssrf) in Azure Compute Gallery allows an unauthorized attacker to elevate privileges over a network. CVSSv3.1 10.0 (CRITICAL) · EPSS 54th percentile

CWECWE 918VNDMicrosoftTYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2025-10-23
2025-10-23 20:15Z
CRIT

CVE-2025-58428 — TLS4B: This vulnerability enables remote attackers with valid credentials to execute system-level commands on the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-58428

The TLS4B ATG system's SOAP-based interface is vulnerable due to its accessibility through the web services handler. This vulnerability enables remote attackers with valid credentials to execute system-level commands on the underlying Linux system. This could allow the attacker to achieve remote command execution, full shell access, and potential lateral movement within the network. CVSSv3.1 9.9 (CRITICAL) · EPSS 71th percentile

CWECWE 77VNDTls4bTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2025-10-23
2025-10-23 19:15Z
HIGH

CVE-2025-6979 — Captive: Portal can allow authentication bypass

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-6979

Captive Portal can allow authentication bypass CVSSv3.1 8.8 (HIGH) · EPSS 43th percentile

CWECWE 287VNDCaptiveTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-10-23
2025-10-23 19:15Z
HIGH

CVE-2025-6978 — Diagnostics: command injection vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-6978

Diagnostics command injection vulnerability CVSSv3.1 7.2 (HIGH) · EPSS 96th percentile

CWECWE 78VNDDiagnosticsTYPVulnerability
7.2
CVSS v3.1
90
Edit Score
2025-10-23
2025-10-23 16:17Z
HIGH

CVE-2025-62169 — OctoPrint: In versions 1.8.0a2 and older of the testing branch and versions 1.7.7 and older

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-62169

OctoPrint-SpoolManager is a plugin for managing spools and all their usage metadata. In versions 1.8.0a2 and older of the testing branch and versions 1.7.7 and older of the stable branch, the APIs of the OctoPrint-SpoolManager plugin do not correctly enforce authentication or authorization checks. This issue has been patched in versions 1.8.0a3 of the testing branch and 1.7.8 of the stable branch. The impact of this vulnerability is greatly reduced when using OctoPrint versio CVSSv3.1 8.1 (HIGH) · EPSS 37th percentile

CWECWE 287VNDOctoprintTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-10-23
2025-10-23 16:16Z
HIGH

CVE-2025-59048 — Openbao Aws_plugin: Prior to version 0.1.1, the AWS Plugin is vulnerable to cross-account IAM role Impersonation

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-59048

OpenBao's AWS Plugin generates AWS access credentials based on IAM policies. Prior to version 0.1.1, the AWS Plugin is vulnerable to cross-account IAM role Impersonation in the AWS auth method. The vulnerability allows an IAM role from an untrusted AWS account to authenticate by impersonating a role with the same name in a trusted account, leading to unauthorized access. This impacts all users of the auth-aws plugin who operate in a multi-account AWS environment where IAM rol CVSSv3.1 8.1 (HIGH) · EPSS 17th percentile

CWECWE 863CWECWE 694VNDAwsVNDOpenbaoTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-10-23
2025-10-23 15:08Z
HIGH

autobloody — Tool to automatically exploit Active Directory privilege escalation paths shown by BloodHound

GitHub · LPE exploits·github.comGITHUB POC

autobloody is a Python tool that automates Active Directory privilege escalation exploitation by parsing BloodHound graph data and executing attack chains via the bloodyAD package. It uses Neo4j's Dijkstra algorithm to identify optimal privesc paths, then automatically executes them against domain controllers using LDAP, supporting multiple authentication methods (cleartext, pass-the-hash, pass-the-ticket, certificates).

TACTA0004TACTA0005SRFNetworkSRFIdentityVNDBloodhoundVNDNeo4jTYPToolTYPExploit
72
Edit Score
2025-10-23
2025-10-23 13:15Z
CRIT

CVE-2025-11023 — Inclusion: AcBakImzala allows PHP Local File Inclusion.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-11023

Inclusion of Functionality from Untrusted Control Sphere, Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ArkSigner Software and Hardware Inc. AcBakImzala allows PHP Local File Inclusion. This issue affects AcBakImzala: before v5.1.4. CVSSv3.1 9.8 (CRITICAL) · EPSS 36th percentile

CWECWE 98CWECWE 829VNDInclusionTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-10-23
2025-10-23 09:41Z
CRIT

Pwn2Own Ireland 2025: Day Three and Master of Pwn

Zero Day Initiative·thezdi.com0day

Pwn2Own Ireland 2025 concluded with 73 unique 0-day vulnerabilities disclosed across three days, awarding $1,024,750 in total bounties. The Summoning Team won Master of Pwn with successful exploits spanning multiple device categories including smartphones, IoT devices, printers, and smart home systems. Notable wins included Samsung Galaxy S25 camera/location hijacking via improper input validation, QNAP NAS takeover via hardcoded credentials and injection, and Phillips Hue Bridge compromise through authentication bypass and heap overflow chains.

SRFApplicationSRFOsSRFNetwork ApplianceVNDSamsungVNDSynologyVNDMetaVNDCanonVNDQnap
72
Edit Score