Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-17 09:49Z
2025-10-17
2025-10-17 19:15Z
CRIT

CVE-2025-34282 — Thingsboard Thingsboard: versions < 4.2.1 contain a server-side request forgery (SSRF) vulnerability in the dashboard's

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-34282

ThingsBoard versions < 4.2.1 contain a server-side request forgery (SSRF) vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload a malicious SVG file that references a remote URL. If the server processes the SVG file in a way that parses external references, it may initiate unintended outbound requests. This can be used to access internal services or resources. CVSSv3.1 9.1 (CRITICAL) · EPSS 74th percentile

CWECWE 918VNDThingsboardTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2025-10-17
2025-10-17 16:15Z
CRIT

CVE-2025-57567 — RCE: A remote code execution (RCE) vulnerability exists in the PluXml CMS theme editor, specifically

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-57567

A remote code execution (RCE) vulnerability exists in the PluXml CMS theme editor, specifically in the minify.php file located under the default theme directory (/themes/defaut/css/minify.php). An authenticated administrator user can overwrite this file with arbitrary PHP code via the admin panel, enabling execution of system commands. CVSSv3.1 9.1 (CRITICAL) · EPSS 55th percentile

CWECWE 94CWECWE 284VNDRceTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2025-10-17
2025-10-17 13:00Z
HIGH

Small Actions, Big Breaches: The Silent Offensive Against Your data

Bishop Fox Labs·bishopfox.com

Bishop Fox's Enterprise AI and SaaS Data Security Report reveals that 77% of employees paste sensitive data into unmanaged generative-AI tools, with 82% using personal accounts and 39% uploading files containing PII/PCI. The research reinforces that human behavior—not advanced exploits—remains the primary breach vector, with 60% of breaches involving user error or misuse per Verizon DBIR data.

TACTA0007SRFCloudTACTA0009SRFBrowserSRFAiTYPResearchTYPThreat IntelSTGDiscovery
72
Edit Score
2025-10-17
2025-10-17 06:15Z
CRIT

CVE-2025-55100 — Eclipse Threadx_usbx: In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-55100

In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _ux_host_class_audio10_sam_parse_func() when parsing a list of sampling frequencies. CVSSv3.1 9.1 (CRITICAL) · EPSS 45th percentile

CWECWE 125VNDEclipseVNDUsbxTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2025-10-17
2025-10-17 05:15Z
CRIT

CVE-2025-11849 — Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-11849

Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth before 1.11.0; versions of the package org.zwobble.mammoth:mammoth before 1.11.0 are vulnerable to Directory Traversal due to the lack of path or file type validation when processing a docx file containing an image with an external link (r:link attribute instead of embedded r:embed). The library resolves the URI to a fil CVSSv3.1 9.3 (CRITICAL) · EPSS 46th percentile

CWECWE 22TYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2025-10-17
2025-10-17 04:16Z
HIGH

CVE-2025-11899 — Agentflow: developed by Flowring has an Use of Hard-coded Cryptographic Key vulnerability, allowing unauthenticated

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-11899

Agentflow developed by Flowring has an Use of Hard-coded Cryptographic Key vulnerability, allowing unauthenticated remote attackers to exploit the fixed key to generate verification information, thereby logging into the system as any user. Attacker must first obtain an user ID in order to exploit this vulnerability. CVSSv3.1 8.1 (HIGH) · EPSS 51th percentile

CWECWE 321VNDAgentflowTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-10-16
2025-10-16 19:15Z
HIGH

CVE-2025-62425 — MAS: A logic flaw in matrix-authentication-service 0.20.0 through 1.4.0 allows an attacker with access to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-62425

MAS (Matrix Authentication Service) is a user management and authentication service for Matrix homeservers, written and maintained by Element. A logic flaw in matrix-authentication-service 0.20.0 through 1.4.0 allows an attacker with access to an authenticated MAS session to perform sensitive operations without entering the current password. These include changing the current password, adding or removing an e-mail address and deactivating the account. The vulnerability only a CVSSv3.1 8.3 (HIGH) · EPSS 37th percentile

CWECWE 620VNDMasTYPVulnerability
8.3
CVSS v3.1
92
Edit Score
728 × 90 / responsive · programmatic ad slot
2025-10-16
2025-10-16 19:15Z
HIGH

CVE-2025-11493 — Connectwise Automate: The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-11493

The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, such as updates, dependencies, and integrations. This creates a risk where an on-path attacker could perform a man-in-the-middle attack and substitute malicious files for legitimate ones by impersonating a legitimate server. This risk is mitigated when HTTPS is enforced and is related to CVE-2025-11492. CVSSv3.1 8.8 (HIGH) · EPSS 12th percentile

CWECWE 494VNDConnectwiseTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-10-16
2025-10-16 19:15Z
CRIT

CVE-2025-11492 — Connectwise Automate: In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-11492

In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor with a man-in-the-middle network position could intercept, modify, or replay agent-server traffic. Additionally, the encryption method used to obfuscate some communications over the HTTP channel is updated in the Automate 2025.9 patch to enforce HTTPS for all agent communications. CVSSv3.1 9.6 (CRITICAL) · EPSS 10th percentile

CWECWE 319VNDConnectwiseTYPVulnerability
9.6
CVSS v3.1
98
Edit Score
2025-10-16
2025-10-16 18:15Z
CRIT

CVE-2025-62586 — Opexustech Foiaxpress: OPEXUS FOIAXpress allows a remote, unauthenticated attacker to reset the administrator password.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-62586

OPEXUS FOIAXpress allows a remote, unauthenticated attacker to reset the administrator password. Fixed in FOIAXpress version 11.13.2.0. CVSSv3.1 9.8 (CRITICAL) · EPSS 52th percentile

CWECWE 306VNDOpexustechVNDOpexusTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-10-16
2025-10-16 18:15Z
CRIT

CVE-2025-61922 — Prestashop Prestashop_checkout: Starting in version 1.3.0 and prior to versions 4.4.1 and 5.0.5, missing validation on

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-61922

PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. Starting in version 1.3.0 and prior to versions 4.4.1 and 5.0.5, missing validation on the Express Checkout feature allows silent login, enabling account takeover via email. The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist. CVSSv3.1 9.1 (CRITICAL) · EPSS 41th percentile

CWECWE 287VNDPrestashopTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2025-10-16
2025-10-16 18:15Z
CRIT

CVE-2025-34516 — Ilevia Eve_x1_server_firmware: EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a use of default credentials

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-34516

Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a use of default credentials vulnerability that allows an unauthenticated attacker to obtain remote access. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet. CVSSv3.1 9.8 (CRITICAL) · EPSS 46th percentile

CWECWE 1392VNDIleviaTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-10-16
2025-10-16 18:15Z
CRIT

CVE-2025-34515 — Ilevia Eve_x1_server_firmware: EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an execution with unnecessary privileges

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-34515

Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an execution with unnecessary privileges vulnerability in sync_project.sh that allows an attacker to escalate privileges to root. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet. CVSSv3.1 9.8 (CRITICAL) · EPSS 95th percentile

CWECWE 250VNDIleviaTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2025-10-16
2025-10-16 18:15Z
HIGH

CVE-2025-34514 — Ilevia Eve_x1_server_firmware: EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain authenticated OS command injection vulnerabilities

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-34514

Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain authenticated OS command injection vulnerabilities in multiple web-accessible PHP scripts that call exec() and allow an authenticated attacker to execute arbitrary commands. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet. CVSSv3.1 8.8 (HIGH) · EPSS 80th percentile

CWECWE 78VNDIleviaTYPVulnerability
8.8
CVSS v3.1
95
Edit Score
2025-10-16
2025-10-16 18:15Z
CRIT

CVE-2025-34513 — Ilevia Eve_x1_server_firmware: EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an OS command injection vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-34513

Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an OS command injection vulnerability in mbus_build_from_csv.php that allows an unauthenticated attacker to execute arbitrary code. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet. CVSSv3.1 9.8 (CRITICAL) · EPSS 94th percentile

CWECWE 78VNDIleviaTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2025-10-16
2025-10-16 13:15Z
CRIT

CVE-2025-9804 — Wso2 Api_control_plane: An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-9804

An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information. This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected. CVSSv3.1 9.6 (CRITICAL) · EPSS 45th percentile

CWECWE 284VNDWso2TYPVulnerability
9.6
CVSS v3.1
98
Edit Score
2025-10-16
2025-10-16 09:15Z
CRIT

CVE-2025-54539 — Apache Activemq_nms_amqp: A Deserialization of Untrusted Data vulnerability exists in the Apache ActiveMQ NMS AMQP Client.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-54539

A Deserialization of Untrusted Data vulnerability exists in the Apache ActiveMQ NMS AMQP Client. This issue affects all versions of Apache ActiveMQ NMS AMQP up to and including 2.3.0, when establishing connections to untrusted AMQP servers. Malicious servers could exploit unbounded deserialization logic present in the client to craft responses that may lead to arbitrary code execution on the client side. Although version 2.1.0 introduced a mechanism to restrict deserializat CVSSv3.1 9.8 (CRITICAL) · EPSS 81th percentile

CWECWE 502VNDApacheTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2025-10-16
2025-10-16 08:15Z
CRIT

CVE-2025-41018 — Sergestec Exito: SQL injection in Sergestec's Exito v8.0.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-41018

SQL injection in Sergestec's Exito v8.0. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'cat' parameter in '/public.php'. CVSSv3.1 9.8 (CRITICAL) · EPSS 39th percentile

CWECWE 89VNDSergestecTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-10-16
2025-10-16 07:15Z
CRIT

CVE-2025-62583 — Navercorp Whale: Browser before 4.33.325.17 allows an attacker to escape the iframe sandbox in a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-62583

Whale Browser before 4.33.325.17 allows an attacker to escape the iframe sandbox in a dual-tab environment. CVSSv3.1 9.8 (CRITICAL) · EPSS 42th percentile

CWECWE 358VNDNavercorpVNDWhaleTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-10-16
2025-10-16 07:15Z
CRIT

CVE-2025-55089 — Eclipse Threadx_filex: In FileX before 6.4.2, the file support module for Eclipse Foundation ThreadX, there was

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-55089

In FileX before 6.4.2, the file support module for Eclipse Foundation ThreadX, there was a possible buffer overflow in the FileX RAM disk driver. It could cause a remote execurtion after receiving a crafted sequence of packets CVSSv3.1 9.8 (CRITICAL) · EPSS 42th percentile

CWECWE 119VNDEclipseVNDFilexTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-10-16
2025-10-16 07:15Z
CRIT

CVE-2025-10850 — Felan: The Felan Framework plugin for WordPress is vulnerable to improper authentication in versions up

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-10850

The Felan Framework plugin for WordPress is vulnerable to improper authentication in versions up to, and including, 1.1.4. This is due to the hardcoded password in the 'fb_ajax_login_or_register' function and in the 'google_ajax_login_or_register' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, if they registered with facebook or google social login and did not change their password. CVE-2025-23504 is likely a duplica CVSSv3.1 9.8 (CRITICAL)

CWECWE 798VNDFelanTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-10-16
2025-10-16 07:15Z
CRIT

CVE-2025-10742 — Truelysell: The Truelysell Core plugin for WordPress is vulnerable to Arbitrary User Password Change in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-10742

The Truelysell Core plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.8.6. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts. Note: This can only be exploited unauthenticated if the attacker knows which page cont CVSSv3.1 9.8 (CRITICAL) · EPSS 44th percentile

CWECWE 639VNDTruelysellTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-10-16
2025-10-16 07:15Z
HIGH

CVE-2025-10706 — Classified: The Classified Pro theme for WordPress is vulnerable to unauthorized plugin installation due to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-10706

The Classified Pro theme for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check in the 'cwp_addons_update_plugin_cb' function in all versions up to, and including, 1.0.14. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins on the affected site's server which may make remote code execution possible. Note: The required nonce for the vulnerability is in the CubeWP Fra CVSSv3.1 8.8 (HIGH) · EPSS 49th percentile

CWECWE 862VNDClassifiedTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-10-16
2025-10-16 00:00Z
HIGH

Shifts in the Underground: The Impact of Water Kurita’s (Lumma Stealer) Doxxing

Trend Micro Research·trendmicro.com

Trend Micro reports a significant decline in Lumma Stealer (Water Kurita) activity following a targeted doxxing campaign in late August–October 2025 that exposed alleged core members' personal and operational details, coinciding with Telegram account compromise on September 17. The disruption has triggered a migration of customers to competing infostealer MaaS platforms, primarily Vidar and StealC, while related services like Amadey saw reduced activity. The incident illustrates the volatile nature of the cybercriminal ecosystem where dominance attracts both law enforcement and rival threat actors.

SRFApplicationTACTA0006TACTA0009VNDAmadeyVNDLumma StealerVNDStealcVNDVidarTYPResearch
72
Edit Score
2025-10-15
2025-10-15 20:15Z
HIGH

CVE-2025-11619 — Devolutions Devolutions_server: Improper certificate validation when connecting to gateways in Devolutions Server 2025.3.2 and earlier allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-11619

Improper certificate validation when connecting to gateways in Devolutions Server 2025.3.2 and earlier allows attackers in MitM position to intercept traffic. CVSSv3.1 8.8 (HIGH) · EPSS 14th percentile

CWECWE 295VNDDevolutionsTYPVulnerability
8.8
CVSS v3.1
94
Edit Score