Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-17 13:31Z
2025-10-10
2025-10-10 15:16Z
HIGH

CVE-2025-60378 — Fairsketch Rise_ultimate_project_manager: Stored HTML injection in RISE Ultimate Project Manager & CRM allows authenticated users to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-60378

Stored HTML injection in RISE Ultimate Project Manager & CRM allows authenticated users to inject arbitrary HTML into invoices and messages. Injected content renders in emails, PDFs, and messaging/chat modules sent to clients or team members, enabling phishing, credential theft, and business email compromise. Automated recurring invoices and messaging amplify the risk by distributing malicious content to multiple recipients. CVSSv3.1 8.1 (HIGH) · EPSS 61th percentile

CWECWE 79VNDStoredVNDFairsketchTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-10-10
2025-10-10 10:15Z
HIGH

CVE-2025-52650 — Hcltech Aion: Inline script execution allowed in CSP vulnerability has been identified in HCL AION v2.0

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-52650

Inline script execution allowed in CSP vulnerability has been identified in HCL AION v2.0 CVSSv3.1 8.2 (HIGH) · EPSS 11th percentile

CWECWE 1032VNDHcltechVNDInlineTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2025-10-10
2025-10-10 10:15Z
HIGH

CVE-2025-25018 — Elastic Kibana: Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-25018

Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS) CVSSv3.1 8.7 (HIGH) · EPSS 13th percentile

CWECWE 79VNDElasticTYPVulnerability
8.7
CVSS v3.1
94
Edit Score
2025-10-10
2025-10-10 10:15Z
HIGH

CVE-2025-25017 — Elastic Kibana: Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-25017

Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS) CVSSv3.1 8.2 (HIGH) · EPSS 18th percentile

CWECWE 79VNDElasticTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2025-10-10
2025-10-10 07:15Z
HIGH

CVE-2025-21064 — Samsung Smart_switch: Improper authentication in Smart Switch prior to version 3.7.66.6 allows adjacent attackers to access

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-21064

Improper authentication in Smart Switch prior to version 3.7.66.6 allows adjacent attackers to access transferring data. CVSSv3.1 8.8 (HIGH) · EPSS 17th percentile

VNDSamsungVNDSmartTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-10-09
2025-10-09 21:15Z
CRIT

CVE-2025-59286 — Microsoft 365_copilot_chat: Improper neutralization of special elements used in a command ('command injection') in Copilot allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-59286

Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to disclose information over a network. CVSSv3.1 9.3 (CRITICAL) · EPSS 45th percentile

CWECWE 77VNDMicrosoftTYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2025-10-09
2025-10-09 21:15Z
CRIT

CVE-2025-59272 — Microsoft 365_copilot_chat: Improper neutralization of special elements used in a command ('command injection') in Copilot allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-59272

Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to perform information disclosure locally. CVSSv3.1 9.3 (CRITICAL) · EPSS 45th percentile

CWECWE 77VNDMicrosoftTYPVulnerability
9.3
CVSS v3.1
97
Edit Score
728 × 90 / responsive · programmatic ad slot
2025-10-09
2025-10-09 21:15Z
CRIT

CVE-2025-59252 — Microsoft 365_word_copilot: Improper neutralization of special elements used in a command ('command injection') in Copilot allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-59252

Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to disclose information over a network. CVSSv3.1 9.3 (CRITICAL) · EPSS 45th percentile

CWECWE 77VNDMicrosoftTYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2025-10-09
2025-10-09 21:15Z
HIGH

CVE-2025-59247 — Microsoft Azure_playfab: Azure PlayFab Elevation of Privilege Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-59247

Azure PlayFab Elevation of Privilege Vulnerability CVSSv3.1 8.8 (HIGH) · EPSS 74th percentile

CWECWE 269CWECWE 565VNDMicrosoftVNDAzureTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-10-09
2025-10-09 21:15Z
CRIT

CVE-2025-59246 — Microsoft Entra_id: Azure Entra ID Elevation of Privilege Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-59246

Azure Entra ID Elevation of Privilege Vulnerability CVSSv3.1 9.8 (CRITICAL) · EPSS 94th percentile

CWECWE 306VNDMicrosoftVNDAzureTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2025-10-09
2025-10-09 21:15Z
CRIT

CVE-2025-59218 — Microsoft Entra_id: Azure Entra ID Elevation of Privilege Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-59218

Azure Entra ID Elevation of Privilege Vulnerability CVSSv3.1 9.6 (CRITICAL) · EPSS 50th percentile

CWECWE 284VNDMicrosoftVNDAzureTYPVulnerability
9.6
CVSS v3.1
98
Edit Score
2025-10-09
2025-10-09 21:15Z
CRIT

CVE-2025-55321 — Microsoft Azure_monitor: Improper neutralization of input during web page generation ('cross-site scripting') in Azure Monitor allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-55321

Improper neutralization of input during web page generation ('cross-site scripting') in Azure Monitor allows an unauthorized attacker to perform spoofing over a network. CVSSv3.1 9.3 (CRITICAL) · EPSS 36th percentile

CWECWE 79VNDMicrosoftTYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2025-10-09
2025-10-09 21:15Z
HIGH

CVE-2025-35055 — Newforma Project_center: Info Exchange (NIX) '/UserWeb/Common/UploadBlueimp.ashx' allows an authenticated attacker to upload an arbitrary file

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-35055

Newforma Info Exchange (NIX) '/UserWeb/Common/UploadBlueimp.ashx' allows an authenticated attacker to upload an arbitrary file to any location writable by the NIX application. An attacker can upload and run a web shell or other content executable by the web server. An attacker can also delete directories. In Newforma before 2023.1, anonymous access is enabled by default (CVE-2025-35062), allowing an otherwise unauthenticated attacker to effectively authenticate as 'anonymous CVSSv3.1 8.8 (HIGH) · EPSS 44th percentile

CWECWE 434CWECWE 22VNDNewformaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-10-09
2025-10-09 21:15Z
CRIT

CVE-2025-35051 — Newforma Project_center: Project Center Server (NPCS) accepts serialized .NET data via the '/ProjectCenter.rem' endpoint on

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-35051

Newforma Project Center Server (NPCS) accepts serialized .NET data via the '/ProjectCenter.rem' endpoint on 9003/tcp, allowing a remote, unauthenticated attacker to execute arbitrary code with 'NT AUTHORITY\NetworkService' privileges. According to the recommended architecture, the vulnerable NPCS endpoint is only accessible on an internal network. To mitigate this vulnerability, restrict network access to NPCS. CVSSv3.1 9.8 (CRITICAL) · EPSS 57th percentile

CWECWE 502CWECWE 306VNDNewformaTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-10-09
2025-10-09 21:15Z
CRIT

CVE-2025-35050 — Newforma Project_center: Info Exchange (NIX) accepts serialized .NET data via the '/remoteweb/remote.rem' endpoint, allowing a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-35050

Newforma Info Exchange (NIX) accepts serialized .NET data via the '/remoteweb/remote.rem' endpoint, allowing a remote, unauthenticated attacker to execute arbitrary code with 'NT AUTHORITY\NetworkService' privileges. The vulnerable endpoint is used by Newforma Project Center Server (NPCS), so a compromised NIX system can be used to attack an associated NPCS system. To mitigate this vulnerability, restrict network access to the '/remoteweb/remote.rem' endpoint, for example usi CVSSv3.1 9.8 (CRITICAL) · EPSS 59th percentile

CWECWE 502CWECWE 306VNDNewformaTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-10-09
2025-10-09 19:15Z
HIGH

CVE-2025-59146 — New: An authenticated Server-Side Request Forgery (SSRF) vulnerability exists in versions prior to 0.9.0.5.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-59146

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. An authenticated Server-Side Request Forgery (SSRF) vulnerability exists in versions prior to 0.9.0.5. A feature within the application allows authenticated users to submit a URL for the server to process its content. The application fails to properly validate this user-supplied URL before making a server-side request. This vulnerability is not limited to image URLs and ca CVSSv3.1 8.5 (HIGH) · EPSS 14th percentile

CWECWE 918VNDNewTYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2025-10-09
2025-10-09 17:15Z
CRIT

CVE-2025-59978 — Juniper Junos_space: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-59978

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to store script tags directly in web pages that, when viewed by another user, enable the attacker to execute commands with the target's administrative permissions. This issue affects all versions of Junos Space before 24.1R4. CVSSv3.1 9.0 (CRITICAL) · EPSS 43th percentile

CWECWE 79VNDJuniperTYPVulnerability
9.0
CVSS v3.1
95
Edit Score
2025-10-09
2025-10-09 17:15Z
HIGH

CVE-2025-11549 — Tenda W12_firmware: The manipulation of the argument mac leads to stack-based buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-11549

A vulnerability has been found in Tenda W12 3.0.0.6(3948). The affected element is the function wifiMacFilterSet of the file /goform/modules of the component HTTP Request Handler. The manipulation of the argument mac leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. CVSSv3.1 8.8 (HIGH) · EPSS 95th percentile

CWECWE 121CWECWE 119VNDTendaTYPVulnerability
8.8
CVSS v3.1
97
Edit Score
2025-10-09
2025-10-09 17:15Z
HIGH

CVE-2025-11371 — Gladinet Centrestack: In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-11371in the wild

In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild.  This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560 CVSSv3.1 7.5 (HIGH) · EPSS 100th percentile

CWECWE 552VNDGladinetTYPVulnerabilitySTAitw exploited
7.5
CVSS v3.1
100
Edit Score
2025-10-09
2025-10-09 16:15Z
HIGH

CVE-2025-59974 — Juniper Space_security_director: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Junos

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-59974

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Junos Space Security Director allows an attacker to inject malicious scripts into the application, which are then stored and executed in the context of other users' browsers when they access affected pages.This issue affects Juniper Security Director:  * All versions before 24.1R4. CVSSv3.1 8.4 (HIGH) · EPSS 30th percentile

CWECWE 79VNDJuniperTYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2025-10-09
2025-10-09 16:15Z
CRIT

CVE-2025-10284 — BBOT's unarchive module could be abused by supplying malicious archives files and when extracted

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-10284

BBOT's unarchive module could be abused by supplying malicious archives files and when extracted can then perform an arbitrary file write, resulting in remote code execution. CVSSv3.1 9.6 (CRITICAL) · EPSS 52th percentile

CWECWE 22TYPVulnerability
9.6
CVSS v3.1
98
Edit Score
2025-10-09
2025-10-09 16:15Z
CRIT

CVE-2025-10283 — BBOT's gitdumper module could be abused to execute commands through a malicious git repository.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-10283

BBOT's gitdumper module could be abused to execute commands through a malicious git repository. CVSSv3.1 9.6 (CRITICAL) · EPSS 40th percentile

CWECWE 22TYPVulnerability
9.6
CVSS v3.1
98
Edit Score
2025-10-09
2025-10-09 14:15Z
HIGH

CVE-2025-62228 — Apache Flink_cdc: Flink CDC version 3.4.0 was vulnerable to a SQL injection via maliciously crafted

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-62228

Apache Flink CDC version 3.4.0 was vulnerable to a SQL injection via maliciously crafted identifiers eg. crafted database name or crafted table name. Even through only the logged-in database user can trigger the attack, we recommend users update Flink CDC version to 3.5.0 which address this issue. CVSSv3.1 8.8 (HIGH) · EPSS 37th percentile

CWECWE 89VNDApacheTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-10-09
2025-10-09 14:15Z
HIGH

CVE-2025-11561 — This fallback allows an attacker with permission to modify certain AD attributes (such as

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-11561

A flaw was found in the integration of Active Directory and the System Security Services Daemon (SSSD) on Linux systems. In default configurations, the Kerberos local authentication plugin (sssd_krb5_localauth_plugin) is enabled, but a fallback to the an2ln plugin is possible. This fallback allows an attacker with permission to modify certain AD attributes (such as userPrincipalName or samAccountName) to impersonate privileged users, potentially resulting in unauthorized acce CVSSv3.1 8.8 (HIGH) · EPSS 52th percentile

CWECWE 269TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-10-09
2025-10-09 13:15Z
HIGH

CVE-2025-39961 — Linux Linux_kernel: The kernel maintains a root pointer and current page table level to enable proper

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-39961

In the Linux kernel, the following vulnerability has been resolved: iommu/amd/pgtbl: Fix possible race while increase page table level The AMD IOMMU host page table implementation supports dynamic page table levels (up to 6 levels), starting with a 3-level configuration that expands based on IOVA address. The kernel maintains a root pointer and current page table level to enable proper page table walks in alloc_pte()/fetch_pte() operations. The IOMMU IOVA allocator initial CVSSv3.1 8.8 (HIGH) · EPSS 1th percentile

CWECWE 362TYPVulnerability
8.8
CVSS v3.1
94
Edit Score