Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-17 11:12Z
2025-10-14
2025-10-14 21:15Z
HIGH

CVE-2025-54263 — Adobe Commerce: versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-54263

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability. A low-privileged attacker could leverage this vulnerability to bypass security measures and maintain unauthorized access. Exploitation of this issue does not require user interaction. CVSSv3.1 8.1 (HIGH) · EPSS 47th percentile

CWECWE 863VNDAdobeTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-10-14
2025-10-14 20:15Z
INFO

CVE-2025-61678 — FreePBX: In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17.0.6 for

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-61678

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17.0.6 for FreePBX 17, the Endpoint Manager module contains an authenticated arbitrary file upload vulnerability affecting the fwbrand parameter. The fwbrand parameter allows an attacker to change the file path. Combined, these issues can result in a webshell being uploaded. Authentication with a known username is required EPSS 99th percentile

CWECWE 434VNDFreepbxTYPVulnerability
63
Edit Score
2025-10-14
2025-10-14 20:15Z
INFO

CVE-2025-61675 — FreePBX: In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17.0.6 for

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-61675

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17.0.6 for FreePBX 17, the Endpoint Manager module contains authenticated SQL injection vulnerabilities affecting multiple parameters in the basestation, model, firmware, and custom extension configuration functionality areas. Authentication with a known username is required to exploit these vulnerabilities. Successful exp EPSS 99th percentile

CWECWE 89VNDFreepbxTYPVulnerability
62
Edit Score
2025-10-14
2025-10-14 20:15Z
CRIT

CVE-2025-34267 — Flowiseai Flowise: v3.0.1 < 3.0.8 and all versions after with 'ALLOW_BUILTIN_DEP' enabled contain an authenticated

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-34267

Flowise v3.0.1 < 3.0.8 and all versions after with 'ALLOW_BUILTIN_DEP' enabled contain an authenticated remote code execution vulnerability and node VM sandbox escape due to insecure use of integrated modules (Puppeteer and Playwright) within the nodevm execution environment. An authenticated attacker able to create or run a tool that leverages Puppeteer/Playwright can specify attacker-controlled browser binary paths and parameters. When the tool executes, the attacker-contro CVSSv3.1 9.9 (CRITICAL) · EPSS 93th percentile

CWECWE 77VNDFlowiseaiVNDFlowiseTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2025-10-14
2025-10-14 18:15Z
HIGH

CVE-2025-23356 — NVIDIA: A successful exploit of this vulnerability might lead to code execution, denial of service

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-23356

NVIDIA Isaac Lab contains a vulnerability in SB3 configuration parsing. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, or data tampering. CVSSv3.1 8.4 (HIGH) · EPSS 5th percentile

CWECWE 306VNDNvidiaTYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2025-10-14
2025-10-14 17:16Z
HIGH

CVE-2025-59292 — Microsoft Azure_compute_gallery: External control of file name or path in Confidential Azure Container Instances allows an

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-59292

External control of file name or path in Confidential Azure Container Instances allows an authorized attacker to elevate privileges locally. CVSSv3.1 8.2 (HIGH) · EPSS 37th percentile

CWECWE 73VNDMicrosoftTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2025-10-14
2025-10-14 17:16Z
HIGH

CVE-2025-59291 — Microsoft Azure_compute_gallery: External control of file name or path in Confidential Azure Container Instances allows an

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-59291

External control of file name or path in Confidential Azure Container Instances allows an authorized attacker to elevate privileges locally. CVSSv3.1 8.2 (HIGH) · EPSS 37th percentile

CWECWE 73VNDMicrosoftTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
728 × 90 / responsive · programmatic ad slot
2025-10-14
2025-10-14 17:16Z
HIGH

CVE-2025-59249 — Microsoft Exchange_server: Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-59249

Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. CVSSv3.1 8.8 (HIGH) · EPSS 32th percentile

CWECWE 1390VNDMicrosoftVNDWeakTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-10-14
2025-10-14 17:15Z
CRIT

CVE-2025-54603 — OIDC: An incorrect OIDC authentication flow in Claroty Secure Access 3.3.0 through 4.0.2 can result

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-54603

An incorrect OIDC authentication flow in Claroty Secure Access 3.3.0 through 4.0.2 can result in unauthorized user creation or impersonation of existing OIDC users. CVSSv3.1 9.0 (CRITICAL) · EPSS 47th percentile

CWECWE 284VNDOidcTYPVulnerability
9.0
CVSS v3.1
95
Edit Score
2025-10-14
2025-10-14 17:15Z
HIGH

CVE-2025-53782 — Microsoft Exchange_server: Incorrect implementation of authentication algorithm in Microsoft Exchange Server allows an unauthorized attacker to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-53782

Incorrect implementation of authentication algorithm in Microsoft Exchange Server allows an unauthorized attacker to elevate privileges locally. CVSSv3.1 8.4 (HIGH) · EPSS 22th percentile

CWECWE 303VNDMicrosoftTYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2025-10-14
2025-10-14 16:15Z
HIGH

CVE-2025-58325 — Fortinet Fortios: An Incorrect Provision of Specified Functionality vulnerability [CWE-684] in FortiOS 7.6.0, 7.4.0 through 7.4.5

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-58325

An Incorrect Provision of Specified Functionality vulnerability [CWE-684] in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2.5 through 7.2.10, 7.0.0 through 7.0.15, 6.4 all versions may allow a local authenticated attacker to execute system commands via crafted CLI commands. CVSSv3.1 8.2 (HIGH) · EPSS 19th percentile

CWECWE 684VNDFortinetTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2025-10-14
2025-10-14 15:16Z
HIGH

CVE-2025-62156 — Argoproj Argo_workflows: Versions prior to 3.6.12 and versions 3.7.0 through 3.7.2 contain a Zip Slip path

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-62156

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Versions prior to 3.6.12 and versions 3.7.0 through 3.7.2 contain a Zip Slip path traversal vulnerability in artifact extraction. During artifact extraction the unpack/untar logic (workflow/executor/executor.go) uses filepath.Join(dest, filepath.Clean(header.Name)) without validating that header.Name stays within the intended extraction directory. A malicious archi CVSSv3.1 8.1 (HIGH) · EPSS 47th percentile

CWECWE 22VNDArgoVNDArgoprojTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-10-14
2025-10-14 15:16Z
HIGH

CVE-2025-5946 — Centreon Centreon_web: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-5946

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Centreon Infra Monitoring (Poller reload setup in the configuration modules) allows OS Command Injection. On the poller parameters page, a user with high privilege is able to concatenate custom instructions into the poller reload command. This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28. CVSSv3.1 7.2 (HIGH) · EPSS 96th percentile

CWECWE 78VNDCentreonTYPVulnerability
7.2
CVSS v3.1
90
Edit Score
2025-10-14
2025-10-14 15:16Z
HIGH

CVE-2025-10985 — Ivanti Endpoint_manager_mobile: OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-10985

OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution. CVSSv3.1 7.2 (HIGH) · EPSS 97th percentile

CWECWE 78VNDIvantiTYPVulnerability
7.2
CVSS v3.1
92
Edit Score
2025-10-14
2025-10-14 15:16Z
HIGH

CVE-2025-10243 — Ivanti Endpoint_manager_mobile: OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-10243

OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution. CVSSv3.1 7.2 (HIGH) · EPSS 97th percentile

CWECWE 78VNDIvantiTYPVulnerability
7.2
CVSS v3.1
92
Edit Score
2025-10-14
2025-10-14 15:16Z
HIGH

CVE-2025-10242 — Ivanti Endpoint_manager_mobile: OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-10242

OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution. CVSSv3.1 7.2 (HIGH) · EPSS 97th percentile

CWECWE 78VNDIvantiTYPVulnerability
7.2
CVSS v3.1
92
Edit Score
2025-10-14
2025-10-14 13:15Z
CRIT

CVE-2025-9064 — Rockwellautomation Factorytalk_view: A path traversal security issue exists within FactoryTalk View Machine Edition, allowing unauthenticated attackers

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-9064

A path traversal security issue exists within FactoryTalk View Machine Edition, allowing unauthenticated attackers on the same network as the device to delete any file within the panels operating system. Exploitation of this vulnerability is dependent on the knowledge of filenames to be deleted. CVSSv3.1 9.1 (CRITICAL) · EPSS 47th percentile

CWECWE 287CWECWE 22VNDRockwellautomationTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2025-10-14
2025-10-14 13:15Z
CRIT

CVE-2025-9063 — Rockwellautomation Factorytalk_view: An authentication bypass security issue exists within FactoryTalk View Machine Edition Web Browser ActiveX

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-9063

An authentication bypass security issue exists within FactoryTalk View Machine Edition Web Browser ActiveX control. Exploitation of this vulnerability allows unauthorized access to the PanelView Plus 7 Series B, including access to the file system, retrieval of diagnostic information, event logs, and more. CVSSv3.1 9.8 (CRITICAL) · EPSS 30th percentile

CWECWE 287VNDRockwellautomationTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-10-14
2025-10-14 13:15Z
CRIT

CVE-2025-7328 — Rockwellautomation 1783-natr_firmware: The security issues are due to missing authentication checks on critical functions.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-7328

Multiple Broken Authentication security issues exist in the affected product. The security issues are due to missing authentication checks on critical functions. These could result in potential denial-of-service, admin account takeover, or NAT rule modifications. Devices would no longer be able to communicate through NATR as a result of denial-of-service or NAT rule modifications. NAT rule modification could also result in device communication to incorrect endpoints. Admin ac CVSSv3.1 9.8 (CRITICAL)

CWECWE 306VNDBrokenVNDRockwellautomationTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-10-14
2025-10-14 13:15Z
CRIT

CVE-2025-11721 — Mozilla Firefox: This bug showed evidence of memory corruption and we presume that with enough effort

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-11721

Memory safety bug present in Firefox 143 and Thunderbird 143. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 144 and Thunderbird 144. CVSSv3.1 9.8 (CRITICAL)

CWECWE 119VNDMozillaTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-10-14
2025-10-14 13:15Z
HIGH

CVE-2025-11720 — Mozilla Firefox: The Firefox and Firefox Focus UI for the Android custom tab feature only showed

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-11720

The Firefox and Firefox Focus UI for the Android custom tab feature only showed the "site" that was loaded, not the full hostname. User supplied content hosted on a subdomain of a site could have been used to fool a user into thinking it was content from a different subdomain of that site. This vulnerability was fixed in Firefox 144. CVSSv3.1 8.1 (HIGH)

CWECWE 451VNDMozillaVNDFirefoxTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-10-14
2025-10-14 13:15Z
CRIT

CVE-2025-11719 — Mozilla Firefox: Starting in Thunderbird 143, the use of the native messaging API by web extensions

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-11719

Starting in Thunderbird 143, the use of the native messaging API by web extensions on Windows could lead to crashes caused by use-after-free memory corruption. This vulnerability was fixed in Firefox 144 and Thunderbird 144. CVSSv3.1 9.8 (CRITICAL)

CWECWE 416VNDMozillaVNDStartingTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-10-14
2025-10-14 13:15Z
CRIT

CVE-2025-11717 — Mozilla Firefox: When switching between Android apps using the card carousel Firefox shows a black screen

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-11717

When switching between Android apps using the card carousel Firefox shows a black screen as its card image when a password-related screen was the last one being used. Prior to Firefox 144 the password edit screen was visible. This vulnerability was fixed in Firefox 144. CVSSv3.1 9.1 (CRITICAL)

CWECWE 200VNDMozillaTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2025-10-14
2025-10-14 13:15Z
HIGH

CVE-2025-11715 — Mozilla Firefox: Some of these bugs showed evidence of memory corruption and we presume that with

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-11715

Memory safety bugs present in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4. CVSSv3.1 8.8 (HIGH)

CWECWE 119VNDMozillaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-10-14
2025-10-14 13:15Z
HIGH

CVE-2025-11714 — Mozilla Firefox: Some of these bugs showed evidence of memory corruption and we presume that with

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-11714

Memory safety bugs present in Firefox ESR 115.28, Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 144, Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4. CVSSv3.1 8.8 (HIGH)

CWECWE 125CWECWE 787CWECWE 119VNDMozillaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score