Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-17 18:40Z
2025-10-04
2025-10-04 08:15Z
CRIT

CVE-2025-39946 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: tls: make sure to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-39946

In the Linux kernel, the following vulnerability has been resolved: tls: make sure to abort the stream if headers are bogus Normally we wait for the socket to buffer up the whole record before we service it. If the socket has a tiny buffer, however, we read out the data sooner, to prevent connection stalls. Make sure that we abort the connection when we find out late that the record is actually invalid. Retrying the parsing is fine in itself but since we copy some more data CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-10-04
2025-10-04 08:15Z
CRIT

CVE-2025-39943 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: ksmbd: smbdirect: validate data_offset

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-39943

In the Linux kernel, the following vulnerability has been resolved: ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer If data_offset and data_length of smb_direct_data_transfer struct are invalid, out of bounds issue could happen. This patch validate data_offset and data_length field in recv_done. CVSSv3.1 9.4 (CRITICAL) · EPSS 4th percentile

CWECWE 125TYPVulnerability
9.4
CVSS v3.1
97
Edit Score
2025-10-04
2025-10-04 08:15Z
CRIT

CVE-2025-39933 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: smb: client: let recv_done

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-39933

In the Linux kernel, the following vulnerability has been resolved: smb: client: let recv_done verify data_offset, data_length and remaining_data_length This is inspired by the related server fixes. CVSSv3.1 9.4 (CRITICAL) · EPSS 2th percentile

TYPVulnerability
9.4
CVSS v3.1
97
Edit Score
2025-10-04
2025-10-04 08:15Z
CRIT

CVE-2025-39932 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: smb: client: let smbd_destroy()

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-39932

In the Linux kernel, the following vulnerability has been resolved: smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) In smbd_destroy() we may destroy the memory so we better wait until post_send_credits_work is no longer pending and will never be started again. I actually just hit the case using rxe: WARNING: CPU: 0 PID: 138 at drivers/infiniband/sw/rxe/rxe_verbs.c:1032 rxe_post_recv+0x1ee/0x480 [rdma_rxe] ... [ 5305.686979] [ T138] CVSSv3.1 9.8 (CRITICAL) · EPSS 3th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-10-04
2025-10-04 03:15Z
CRIT

CVE-2025-9485 — OAuth: The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-9485

The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in versions up to, and including, 6.26.12. This is due to the plugin performing unsafe JWT token processing without verification or validation in the `get_resource_owner_from_id_token` function. This makes it possible for unauthenticated attackers to bypass authentication and gain access to any existing user account - including administrators in CVSSv3.1 9.8 (CRITICAL) · EPSS 47th percentile

CWECWE 347VNDOauthTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-10-04
2025-10-04 03:15Z
HIGH

CVE-2025-9243 — Cost: The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorizedmodification of data due

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-9243

The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorizedmodification of data due to a missing capability check on the get_cc_orders and update_order_status functions in all versions up to, and including, 3.5.32. This makes it possible for authenticated attackers, with Subscriber-level access and above, to access order management functions and modify order status. CVSSv3.1 8.1 (HIGH)

CWECWE 862VNDCostTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-10-03
2025-10-03 22:15Z
HIGH

CVE-2025-61673 — Karapace: Versions 5.0.0 and 5.0.1 contain an authentication bypass vulnerability when configured to use OAuth

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-61673

Karapace is an open-source implementation of Kafka REST and Schema Registry. Versions 5.0.0 and 5.0.1 contain an authentication bypass vulnerability when configured to use OAuth 2.0 Bearer Token authentication. If a request is sent without an Authorization header, the token validation logic is skipped entirely, allowing an unauthenticated user to read and write to Schema Registry endpoints that should otherwise be protected. This effectively renders the OAuth authentication m CVSSv3.1 8.6 (HIGH) · EPSS 31th percentile

CWECWE 288CWECWE 306VNDKarapaceTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
728 × 90 / responsive · programmatic ad slot
2025-10-03
2025-10-03 21:15Z
HIGH

CVE-2025-59943 — Phpmyfaq Phpmyfaq: This allows multiple distinct accounts to be created with the same email.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-59943

phpMyFAQ is an open source FAQ web application. Versions 4.0-nightly-2025-10-03 and below do not enforce uniqueness of email addresses during user registration. This allows multiple distinct accounts to be created with the same email. Because email is often used as an identifier for password resets, notifications, and administrative actions, this flaw can cause account ambiguity and, in certain configurations, may lead to privilege escalation or account takeover. This issue i CVSSv3.1 8.1 (HIGH) · EPSS 34th percentile

CWECWE 284CWECWE 286VNDPhpmyfaqVNDFaqTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-10-03
2025-10-03 20:15Z
HIGH

CVE-2025-54374 — Mayneyao Eidos: Versions 0.21.0 and below contain a one-click remote code execution vulnerability.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-54374

Eidos is an extensible framework for Personal Data Management. Versions 0.21.0 and below contain a one-click remote code execution vulnerability. An attacker can exploit this vulnerability by embedding a specially crafted eidos: URL on any website, including a malicious one they control. When a victim visits such a site or clicks on the link, the browser triggers the app’s custom URL handler (eidos:), causing the Eidos application to launch and process the URL, leading to rem CVSSv3.1 8.8 (HIGH) · EPSS 47th percentile

CWECWE 94VNDMayneyaoVNDEidosTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-10-03
2025-10-03 16:16Z
HIGH

CVE-2025-60787 — Motioneye_project Motioneye: v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-60787

MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name. Unsanitized user input is written to Motion configuration files, allowing remote authenticated attackers with admin access to achieve code execution when Motion is restarted. CVSSv3.1 7.2 (HIGH) · EPSS 98th percentile

CWECWE 20CWECWE 78CWECWE 116VNDMotioneye ProjectVNDMotioneyeTYPVulnerability
7.2
CVSS v3.1
93
Edit Score
2025-10-03
2025-10-03 12:15Z
HIGH

CVE-2025-9561 — Background: The AP Background plugin for WordPress is vulnerable to arbitrary file uploads due to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-9561

The AP Background plugin for WordPress is vulnerable to arbitrary file uploads due to missing authorization and insufficient file validation within the advParallaxBackAdminSaveSlider() handler in versions 3.8.1 to 3.8.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. CVSSv3.1 8.8 (HIGH) · EPSS 49th percentile

CWECWE 434VNDBackgroundTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-10-03
2025-10-03 12:15Z
CRIT

CVE-2025-9286 — Appy: The Appy Pie Connect for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-9286

The Appy Pie Connect for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within the reset_user_password() REST handler in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to to reset the password of arbitrary users, including administrators, thereby gaining administrative access. CVSSv3.1 9.8 (CRITICAL)

CWECWE 620VNDAppyTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-10-03
2025-10-03 12:15Z
CRIT

CVE-2025-9209 — RestroPress: The RestroPress – Online Food Ordering System plugin for WordPress is vulnerable to Authentication

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-9209

The RestroPress – Online Food Ordering System plugin for WordPress is vulnerable to Authentication Bypass in versions 3.0.0 to 3.1.9.2. This is due to the plugin exposing user private tokens and API data via the /wp-json/wp/v2/users REST API endpoint. This makes it possible for unauthenticated attackers to forge JWT tokens for other users, including administrators, and authenticate as them. CVSSv3.1 9.8 (CRITICAL) · EPSS 83th percentile

CWECWE 200VNDRestropressTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2025-10-03
2025-10-03 12:15Z
CRIT

CVE-2025-7721 — JoomSport: The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-7721

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.7.3 via the task parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file t CVSSv3.1 9.8 (CRITICAL) · EPSS 50th percentile

CWECWE 98VNDJoomsportTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-10-03
2025-10-03 12:15Z
CRIT

CVE-2025-10726 — WPRecovery: The WPRecovery plugin for WordPress is vulnerable to SQL Injection via the 'data[id]' parameter

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-10726

The WPRecovery plugin for WordPress is vulnerable to SQL Injection via the 'data[id]' parameter in all versions up to, and including, 2.0. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additionally, the result o CVSSv3.1 9.1 (CRITICAL) · EPSS 35th percentile

CWECWE 89VNDWprecoveryTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2025-10-03
2025-10-03 12:15Z
HIGH

CVE-2025-10582 — Dispatcher: The WP Dispatcher plugin for WordPress is vulnerable to SQL Injection via the ‘id’

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-10582

The WP Dispatcher plugin for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the datab CVSSv3.1 8.8 (HIGH) · EPSS 25th percentile

CWECWE 89VNDDispatcherTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-10-03
2025-10-03 09:15Z
CRIT

CVE-2025-6388 — Spirit: The Spirit Framework plugin for WordPress is vulnerable to authentication bypass in all versions

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-6388

The Spirit Framework plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.2.14. This is due to the custom_actions() function not properly validating a user's identity prior to authenticating them to the site. This makes it possible for unauthenticated attackers to log in as any user, including administrators, granted they have access to the administrator's username. CVSSv3.1 9.8 (CRITICAL) · EPSS 45th percentile

CWECWE 288VNDSpiritTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-10-03
2025-10-03 08:15Z
HIGH

CVE-2025-0616 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-0616

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Teknolojik Center Telecommunication Industry Trade Co. Ltd. B2B - Netsis Panel allows SQL Injection. This issue affects B2B - Netsis Panel: through 20251003. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. CVSSv3.1 8.2 (HIGH) · EPSS 13th percentile

CWECWE 89TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2025-10-03
2025-10-03 07:15Z
HIGH

CVE-2025-59536 — Anthropic Claude_code: Versions before 1.0.111 were vulnerable to Code Injection due to a bug in the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-59536

Claude Code is an agentic coding tool. Versions before 1.0.111 were vulnerable to Code Injection due to a bug in the startup trust dialog implementation. Claude Code could be tricked to execute code contained in a project before the user accepted the startup trust dialog. Exploiting this requires a user to start Claude Code in an untrusted directory. Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advise CVSSv3.1 8.8 (HIGH) · EPSS 98th percentile

CWECWE 94VNDAnthropicVNDClaudeTYPVulnerability
8.8
CVSS v3.1
100
Edit Score
2025-10-03
2025-10-03 00:00Z
HIGH

Self-Propagating Malware Spreading Via WhatsApp, Targets Brazilian Users

Trend Micro Research·trendmicro.comin the wild

Trend Micro identified SORVEPOTEL, a self-propagating infostealer actively spreading via WhatsApp and email in Brazil, targeting financial institutions and crypto exchanges. The malware uses ZIP-archived LNK files to trigger multi-stage PowerShell/BAT payloads that establish persistence, hijack WhatsApp Web sessions for automated propagation, and deploy a .NET trojan (Maverick.Agent) capable of credential theft, keylogging, screenshot capture, and sophisticated overlay-based phishing attacks against Brazilian banking portals. The campaign has impacted 477+ systems with heavy focus on government and public sector organizations.

SRFApplicationSRFOsTACTA0005TACTA0001TACTA0002TACTA0006TACTA0003TACTA0011
78
Edit Score
2025-10-02
2025-10-02 21:16Z
CRIT

CVE-2025-61605 — Wegia Wegia: Versions 3.4.12 and below contain an SQL Injection vulnerability which was identified in the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-61605

WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain an SQL Injection vulnerability which was identified in the /pet/profile_pet.php endpoint, specifically in the id_pet parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This issue is fixed in version 3.5.0. CVSSv3.1 9.8 (CRITICAL) · EPSS 35th percentile

CWECWE 89VNDWegiaTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-10-02
2025-10-02 20:15Z
CRIT

CVE-2025-61603 — Wegia Wegia: Versions 3.4.12 and below include an SQL Injection vulnerability which was identified in the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-61603

WeGIA is a Web manager for charitable institutions. Versions 3.4.12 and below include an SQL Injection vulnerability which was identified in the /controle/control.php endpoint, specifically in the descricao parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This issue is fixed in version 3.5.0. CVSSv3.1 9.8 (CRITICAL) · EPSS 35th percentile

CWECWE 89VNDWegiaTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-10-02
2025-10-02 20:15Z
HIGH

CVE-2025-10653 — An unauthenticated debug port may allow access to the device file system.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-10653

An unauthenticated debug port may allow access to the device file system. CVSSv3.1 8.6 (HIGH) · EPSS 34th percentile

CWECWE 288TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2025-10-02
2025-10-02 15:15Z
CRIT

CVE-2025-59743 — Andsoft E-tms: SQL injection vulnerability in AndSoft's e-TMS v25.03.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-59743

SQL injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability could allow an attacker to retrieve, create, update, and delete databases by sending a POST request. The relationship between parameter and assigned identifier is a 'SessionID' cookie in '/inc/connect/CONNECTION.ASP'. CVSSv3.1 9.8 (CRITICAL) · EPSS 27th percentile

CWECWE 89VNDAndsoftTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-10-02
2025-10-02 15:15Z
CRIT

CVE-2025-59742 — Andsoft E-tms: SQL injection vulnerability in AndSoft's e-TMS v25.03.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-59742

SQL injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability could allow an attacker to retrieve, create, update, and delete databases by sending a POST request. The relationship between parameter and assigned identifier is a 'USRMAIL' parameter in'/inc/login/TRACK_REQUESTFRMSQL.ASP'. CVSSv3.1 9.8 (CRITICAL) · EPSS 27th percentile

CWECWE 89VNDAndsoftTYPVulnerability
9.8
CVSS v3.1
99
Edit Score