Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-17 07:23Z
2025-10-22
2025-10-22 15:15Z
CRIT

CVE-2025-57870 — Esri Arcgis_server: A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-57870

A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and Kubernetes. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary SQL commands via a specific ArcGIS Feature Service operation. Successful exploitation can potentially result in unauthorized access, modification, or deletion of data from the underlying Enterprise Geodatabase. CVSSv3.1 10.0 (CRITICAL) · EPSS 42th percentile

CWECWE 89VNDEsriTYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2025-10-22
2025-10-22 15:15Z
HIGH

CVE-2025-53428 — Incorrect: Privilege Assignment vulnerability in N-Media Simple User Registration wp-registration allows Privilege Escalation.This issue

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-53428

Incorrect Privilege Assignment vulnerability in N-Media Simple User Registration wp-registration allows Privilege Escalation.This issue affects Simple User Registration: from n/a through <= 6.8. CVSSv3.1 8.8 (HIGH) · EPSS 28th percentile

CWECWE 266TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-10-22
2025-10-22 15:15Z
CRIT

CVE-2025-52758 — Upload: Unrestricted Upload of File with Dangerous Type vulnerability in Gesundheit Bewegt GmbH Zippy zippy

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-52758

Unrestricted Upload of File with Dangerous Type vulnerability in Gesundheit Bewegt GmbH Zippy zippy allows Using Malicious Files.This issue affects Zippy: from n/a through <= 1.7.0. CVSSv3.1 9.1 (CRITICAL)

CWECWE 434TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2025-10-22
2025-10-22 15:15Z
HIGH

CVE-2025-52740 — Deserialization: of Untrusted Data vulnerability in Hernan Villanueva Boldermail boldermail allows Object Injection.This issue

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-52740

Deserialization of Untrusted Data vulnerability in Hernan Villanueva Boldermail boldermail allows Object Injection.This issue affects Boldermail: from n/a through <= 2.4.0. CVSSv3.1 8.8 (HIGH) · EPSS 43th percentile

CWECWE 502TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-10-22
2025-10-22 15:15Z
HIGH

CVE-2025-52737 — Deserialization: of Untrusted Data vulnerability in Tijmen Smit WP Store Locator wp-store-locator allows Object

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-52737

Deserialization of Untrusted Data vulnerability in Tijmen Smit WP Store Locator wp-store-locator allows Object Injection.This issue affects WP Store Locator: from n/a through <= 2.2.260. CVSSv3.1 8.8 (HIGH) · EPSS 38th percentile

CWECWE 502TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-10-22
2025-10-22 15:15Z
CRIT

CVE-2025-49931 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-49931

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetSearch jet-search allows Blind SQL Injection.This issue affects JetSearch: from n/a through <= 3.5.10. CVSSv3.1 9.3 (CRITICAL)

CWECWE 89TYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2025-10-22
2025-10-22 15:15Z
HIGH

CVE-2025-49916 — Authorization: Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Accessing Functionality Not Properly Constrained by

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-49916

Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects MultiVendorX: from n/a through <= 4.2.23. CVSSv3.1 8.6 (HIGH)

CWECWE 862TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
728 × 90 / responsive · programmatic ad slot
2025-10-22
2025-10-22 15:15Z
CRIT

CVE-2025-49915 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-49915

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allows SQL Injection.This issue affects SMS Alert Order Notifications: from n/a through <= 3.8.5. CVSSv3.1 9.3 (CRITICAL)

CWECWE 89TYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2025-10-22
2025-10-22 15:15Z
HIGH

CVE-2025-49910 — Authorization: Missing Authorization vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows Accessing Functionality Not Properly

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-49910

Missing Authorization vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPGuppy: from n/a through <= 1.1.4. CVSSv3.1 8.2 (HIGH) · EPSS 22th percentile

CWECWE 862TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2025-10-22
2025-10-22 15:15Z
CRIT

CVE-2025-49901 — Authentication: Bypass Using an Alternate Path or Channel vulnerability in quantumcloud Simple Link Directory

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-49901

Authentication Bypass Using an Alternate Path or Channel vulnerability in quantumcloud Simple Link Directory qc-simple-link-directory allows Authentication Abuse.This issue affects Simple Link Directory: from n/a through < 14.8.1. CVSSv3.1 9.8 (CRITICAL) · EPSS 53th percentile

CWECWE 288TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-10-22
2025-10-22 15:15Z
CRIT

CVE-2025-49380 — Deserialization: of Untrusted Data vulnerability in wpinstinct WooCommerce Vehicle Parts Finder woo-vehicle-parts-finder allows Object

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-49380

Deserialization of Untrusted Data vulnerability in wpinstinct WooCommerce Vehicle Parts Finder woo-vehicle-parts-finder allows Object Injection.This issue affects WooCommerce Vehicle Parts Finder: from n/a through <= 3.7. CVSSv3.1 9.8 (CRITICAL)

CWECWE 502TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-10-22
2025-10-22 15:15Z
HIGH

CVE-2025-49378 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-49378

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Hydra Booking hydra-booking allows SQL Injection.This issue affects Hydra Booking: from n/a through <= 1.1.10. CVSSv3.1 8.5 (HIGH)

CWECWE 89TYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2025-10-22
2025-10-22 15:15Z
CRIT

CVE-2025-49060 — Upload: Unrestricted Upload of File with Dangerous Type vulnerability in CMSSuperHeroes Wastia wastia allows Upload

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-49060

Unrestricted Upload of File with Dangerous Type vulnerability in CMSSuperHeroes Wastia wastia allows Upload a Web Shell to a Web Server.This issue affects Wastia: from n/a through < 1.1.3. CVSSv3.1 10.0 (CRITICAL) · EPSS 36th percentile

CWECWE 434TYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2025-10-22
2025-10-22 15:15Z
CRIT

CVE-2025-48106 — Upload: Unrestricted Upload of File with Dangerous Type vulnerability in CMSSuperHeroes Clanora clanora allows Using

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-48106

Unrestricted Upload of File with Dangerous Type vulnerability in CMSSuperHeroes Clanora clanora allows Using Malicious Files.This issue affects Clanora: from n/a through < 1.3.1. CVSSv3.1 10.0 (CRITICAL) · EPSS 46th percentile

CWECWE 434TYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2025-10-22
2025-10-22 15:15Z
HIGH

CVE-2025-48091 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-48091

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alexander AnyComment anycomment allows SQL Injection.This issue affects AnyComment: from n/a through <= 0.3.6. CVSSv3.1 8.5 (HIGH)

CWECWE 89TYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2025-10-22
2025-10-22 15:15Z
HIGH

CVE-2025-32283 — Deserialization: of Untrusted Data vulnerability in designthemes Solar Energy solar allows Object Injection.This issue

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-32283

Deserialization of Untrusted Data vulnerability in designthemes Solar Energy solar allows Object Injection.This issue affects Solar Energy: from n/a through <= 3.5. CVSSv3.1 8.8 (HIGH) · EPSS 48th percentile

CWECWE 502TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-10-22
2025-10-22 15:15Z
HIGH

CVE-2025-31634 — Deserialization: of Untrusted Data vulnerability in designthemes Insurance insurance allows Object Injection.This issue affects

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-31634

Deserialization of Untrusted Data vulnerability in designthemes Insurance insurance allows Object Injection.This issue affects Insurance: from n/a through <= 3.5. CVSSv3.1 8.8 (HIGH) · EPSS 48th percentile

CWECWE 502TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-10-22
2025-10-22 14:15Z
CRIT

CVE-2025-56447 — TM2: Monitoring v3.04 contains an authentication bypass and plaintext credential disclosure.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-56447

TM2 Monitoring v3.04 contains an authentication bypass and plaintext credential disclosure. CVSSv3.1 9.8 (CRITICAL) · EPSS 24th percentile

CWECWE 319CWECWE 287VNDTm2TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-10-22
2025-10-22 14:15Z
HIGH

CVE-2023-53711 — Linux: In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a potential

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-53711

In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a potential data corruption We must ensure that the subrequests are joined back into the head before we can retransmit a request. If the head was not on the commit lists, because the server wrote it synchronously, we still need to add it back to the retransmission list. Add a call that mirrors the effect of nfs_cancel_remove_inode() for O_DIRECT. CVSSv3.1 8.2 (HIGH) · EPSS 9th percentile

TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2025-10-22
2025-10-22 14:15Z
HIGH

CVE-2023-53705 — Linux: In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix out-of-bounds access

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-53705

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix out-of-bounds access in ipv6_find_tlv() optlen is fetched without checking whether there is more than one byte to parse. It can lead to out-of-bounds access. Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with SVACE. CVSSv3.1 8.2 (HIGH) · EPSS 12th percentile

TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2025-10-22
2025-10-22 12:15Z
HIGH

CVE-2025-11086 — Academy: The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-11086

The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.3.7. This is due to the plugin not properly validating a user's role prior to registering a user via the Social Login addon. This makes it possible for unauthenticated attackers to update their role to Administrator when registering on the site. CVSSv3.1 8.1 (HIGH) · EPSS 32th percentile

CWECWE 269VNDAcademyTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-10-22
2025-10-22 10:19Z
CRIT

Pwn2Own Ireland 2025 - Day Two Results

Zero Day Initiative·thezdi.com0day

Pwn2Own Ireland 2025 Day Two concluded with 56 unique 0-day vulnerabilities disclosed across IoT, mobile, and network appliances, awarding $792,750 total. Notable exploits included a Samsung Galaxy S25 RCE chain (5 bugs, $50k), multiple printer/bridge buffer overflows, and an auth-bypass leading to root on Synology NAS. The Summoning Team maintains the Master of Pwn lead heading into Day Three, with a high-value WhatsApp exploit pending.

SRFMobileSRFNetwork ApplianceSRFHardwareVNDAmazonVNDSamsungVNDSynologyVNDCanonVNDQnap
72
Edit Score
2025-10-22
2025-10-22 09:15Z
HIGH

CVE-2025-41110 — Ghostrobotics Vision_60_firmware: This vulnerability allows an attacker to connect to the robot's WiFi and view all

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-41110

Encrypted WiFi and SSH credentials were found in the Ghost Robotics Vision 60 v0.27.2 APK. This vulnerability allows an attacker to connect to the robot's WiFi and view all its data, as it runs on ROS 2 without default authentication. In addition, the attacker can connect via SSH and gain full control of the robot, which could cause physical damage to the robot itself or its environment. CVSSv3.1 8.8 (HIGH) · EPSS 15th percentile

CWECWE 306CWECWE 287VNDGhostroboticsVNDEncryptedTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-10-22
2025-10-22 09:15Z
CRIT

CVE-2025-41108 — Ghostrobotics Vision_60_firmware: The communication protocol implemented in Ghost Robotics Vision 60 v0.27.2 could allow an attacker

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-41108

The communication protocol implemented in Ghost Robotics Vision 60 v0.27.2 could allow an attacker to send commands to the robot from an external attack station, impersonating the control station (tablet) and gaining unauthorised full control of the robot. The absence of encryption and authentication mechanisms in the communication protocol allows an attacker to capture legitimate traffic between the robot and the controller, replicate it, and send any valid command to the ro CVSSv3.1 9.8 (CRITICAL) · EPSS 22th percentile

CWECWE 287VNDGhostVNDGhostroboticsTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-10-22
2025-10-22 04:16Z
HIGH

CVE-2025-62775 — Mercku: M6a devices through 2.1.0 allow root TELNET logins via the web admin password.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-62775

Mercku M6a devices through 2.1.0 allow root TELNET logins via the web admin password. CVSSv3.1 8.0 (HIGH) · EPSS 19th percentile

CWECWE 669VNDMerckuTYPVulnerability
8.0
CVSS v3.1
90
Edit Score