Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-18 15:11Z
2025-07-28
2025-07-28 05:16Z
HIGH

CVE-2025-8267 — Felipperegazio Ssrf_check: Versions of the package ssrfcheck before 1.2.0 are vulnerable to Server-Side Request Forgery (SSRF)

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-8267

Versions of the package ssrfcheck before 1.2.0 are vulnerable to Server-Side Request Forgery (SSRF) due to an incomplete denylist of IP address ranges. Specifically, the package fails to classify the reserved IP address space 224.0.0.0/4 (Multicast) as invalid. This oversight allows attackers to craft requests targeting these multicast addresses. CVSSv3.1 8.2 (HIGH) · EPSS 30th percentile

CWECWE 918VNDFelipperegazioTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2025-07-25
2025-07-25 16:15Z
CRIT

CVE-2025-38439 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Set DMA unmap

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-38439

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT When transmitting an XDP_REDIRECT packet, call dma_unmap_len_set() with the proper length instead of 0. This bug triggers this warning on a system with IOMMU enabled: WARNING: CPU: 36 PID: 0 at drivers/iommu/dma-iommu.c:842 __iommu_dma_unmap+0x159/0x170 RIP: 0010:__iommu_dma_unmap+0x159/0x170 Code: a8 00 00 00 00 48 c7 45 b0 00 00 00 00 48 c7 45 c8 00 CVSSv3.1 9.8 (CRITICAL) · EPSS 7th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-07-25
2025-07-25 16:15Z
HIGH

CVE-2025-38437 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix potential use-after-free

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-38437

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix potential use-after-free in oplock/lease break ack If ksmbd_iov_pin_rsp return error, use-after-free can happen by accessing opinfo->state and opinfo_put and ksmbd_fd_put could called twice. CVSSv3.1 8.8 (HIGH) · EPSS 5th percentile

CWECWE 416TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-07-25
2025-07-25 15:15Z
CRIT

CVE-2025-38430 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: nfsd: nfsd4_spo_must_allow() must check

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-38430

In the Linux kernel, the following vulnerability has been resolved: nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request If the request being processed is not a v4 compound request, then examining the cstate can have undefined results. This patch adds a check that the rpc procedure being executed (rq_procinfo) is the NFSPROC4_COMPOUND procedure. CVSSv3.1 9.8 (CRITICAL) · EPSS 7th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-07-25
2025-07-25 15:15Z
CRIT

CVE-2025-38429 — Linux Linux_kernel: Updating rd_offset prematurely can lead to the host accessing an uninitialized or incomplete element

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-38429

In the Linux kernel, the following vulnerability has been resolved: bus: mhi: ep: Update read pointer only after buffer is written Inside mhi_ep_ring_add_element, the read pointer (rd_offset) is updated before the buffer is written, potentially causing race conditions where the host sees an updated read pointer before the buffer is actually written. Updating rd_offset prematurely can lead to the host accessing an uninitialized or incomplete element, resulting in data corrup CVSSv3.1 10.0 (CRITICAL) · EPSS 5th percentile

CWECWE 908TYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2025-07-25
2025-07-25 14:15Z
CRIT

CVE-2025-38411 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: netfs: Fix double put

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-38411

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix double put of request If a netfs request finishes during the pause loop, it will have the ref that belongs to the IN_PROGRESS flag removed at that point - however, if it then goes to the final wait loop, that will *also* put the ref because it sees that the IN_PROGRESS flag is clear and incorrectly assumes that this happened when it called the collector. In fact, since IN_PROGRESS is clear, we s CVSSv3.1 9.8 (CRITICAL) · EPSS 5th percentile

CWECWE 415TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-07-25
2025-07-25 13:15Z
HIGH

CVE-2025-38395 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: regulator: gpio: Fix the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-38395

In the Linux kernel, the following vulnerability has been resolved: regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods drvdata::gpiods is supposed to hold an array of 'gpio_desc' pointers. But the memory is allocated for only one pointer. This will lead to out-of-bounds access later in the code if 'config::ngpios' is > 1. So fix the code to allocate enough memory to hold 'config::ngpios' of GPIO descriptors. While at it, also move the check for memory allocat CVSSv3.1 8.4 (HIGH) · EPSS 6th percentile

CWECWE 125TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
728 × 90 / responsive · programmatic ad slot
2025-07-25
2025-07-25 13:15Z
HIGH

CVE-2025-38377 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: rose: fix dangling neighbour

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-38377

In the Linux kernel, the following vulnerability has been resolved: rose: fix dangling neighbour pointers in rose_rt_device_down() There are two bugs in rose_rt_device_down() that can cause use-after-free: 1. The loop bound `t->count` is modified within the loop, which can cause the loop to terminate early and miss some entries. 2. When removing an entry from the neighbour array, the subsequent entries are moved up to fill the gap, but the loop index `i` is still CVSSv3.1 8.8 (HIGH) · EPSS 6th percentile

CWECWE 416TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-07-25
2025-07-25 13:15Z
HIGH

CVE-2025-38375 — Linux Linux_kernel: This can lead to an out-of-bound read.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-38375

In the Linux kernel, the following vulnerability has been resolved: virtio-net: ensure the received length does not exceed allocated size In xdp_linearize_page, when reading the following buffers from the ring, we forget to check the received length with the true allocate size. This can lead to an out-of-bound read. This commit adds that missing check. CVSSv3.1 8.4 (HIGH) · EPSS 7th percentile

CWECWE 125TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2025-07-25
2025-07-25 13:15Z
HIGH

CVE-2025-38367 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Avoid overflow

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-38367

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Avoid overflow with array index The variable index is modified and reused as array index when modify register EIOINTC_ENABLE. There will be array index overflow problem. CVSSv3.1 8.8 (HIGH) · EPSS 4th percentile

CWECWE 129TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-07-25
2025-07-25 13:15Z
CRIT

CVE-2025-38365 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix a race

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-38365

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix a race between renames and directory logging We have a race between a rename and directory inode logging that if it happens and we crash/power fail before the rename completes, the next time the filesystem is mounted, the log replay code will end up deleting the file that was being renamed. This is best explained following a step by step analysis of an interleaving of steps that lead into this s CVSSv3.1 9.1 (CRITICAL) · EPSS 2th percentile

CWECWE 362TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2025-07-25
2025-07-25 07:15Z
HIGH

CVE-2025-5835 — Themeum Droip: The Droip plugin for WordPress is vulnerable to unauthorized modification and access of data

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-5835

The Droip plugin for WordPress is vulnerable to unauthorized modification and access of data due to a missing capability check on the droip_post_apis() function in all versions up to, and including, 2.2.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform many actions as the AJAX hooks to several functions. Some potential impacts include arbitrary post deletion, arbitrary post creation, post duplication, settings update, us CVSSv3.1 8.8 (HIGH)

CWECWE 862VNDThemeumVNDDroipTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-07-25
2025-07-25 07:15Z
HIGH

CVE-2025-5831 — Themeum Droip: The Droip plugin for WordPress is vulnerable to arbitrary file uploads due to missing

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-5831

The Droip plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the make_google_font_offline() function in all versions up to, and excluding, 2.5.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. CVSSv3.1 8.8 (HIGH)

CWECWE 434VNDThemeumVNDDroipTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-07-24
2025-07-24 15:15Z
HIGH

CVE-2025-51087 — Tenda Ac8_firmware: The manipulation of the argument time leads to stack-based buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-51087

Tenda AC8V4 V16.03.34.06` was discovered to contain stack overflow at /goform/saveParentControlInfo. The manipulation of the argument time leads to stack-based buffer overflow. CVSSv3.1 8.6 (HIGH) · EPSS 94th percentile

CWECWE 121VNDTendaTYPVulnerability
8.6
CVSS v3.1
96
Edit Score
2025-07-24
2025-07-24 14:15Z
CRIT

CVE-2025-4784 — Moderec Tourtella: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-4784

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Moderec Tourtella allows SQL Injection. This issue affects Tourtella: before 26.05.2025. CVSSv3.1 9.8 (CRITICAL) · EPSS 56th percentile

CWECWE 89VNDModerecTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-07-24
2025-07-24 13:15Z
CRIT

CVE-2025-5243 — Upload: Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Special Elements used in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-5243

Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SMG Software Information Portal allows Code Injection, Upload a Web Shell to a Web Server, Code Inclusion. This issue affects Information Portal: before 13.06.2025. CVSSv3.1 10.0 (CRITICAL) · EPSS 85th percentile

CWECWE 434CWECWE 78TYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2025-07-24
2025-07-24 13:15Z
CRIT

CVE-2025-4822 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-4822

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bayraktar Solar Energies ScadaWatt Otopilot allows SQL Injection. This issue affects ScadaWatt Otopilot: before 27.05.2025. CVSSv3.1 9.8 (CRITICAL) · EPSS 28th percentile

CWECWE 89TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-07-24
2025-07-24 10:15Z
CRIT

CVE-2025-6441 — Webinar: The Webinar Solution: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition plugin for

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-6441

The Webinar Solution: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition plugin for WordPress is vulnerable to unauthenticated login token generation due to a missing capability check on the `webinarignition_sign_in_support_staff` and `webinarignition_register_support` functions in all versions up to, and including, 4.03.32. This makes it possible for unauthenticated attackers to generate login tokens for arbitrary WordPress users under CVSSv3.1 9.8 (CRITICAL)

CWECWE 862VNDWebinarTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-07-23
2025-07-23 05:15Z
HIGH

CVE-2025-8020 — All versions of the package private-ip are vulnerable to Server-Side Request Forgery (SSRF) where

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-8020

All versions of the package private-ip are vulnerable to Server-Side Request Forgery (SSRF) where an attacker can provide an IP or hostname that resolves to a multicast IP address (224.0.0.0/4) which is not included as part of the private IP ranges in the package's source code. CVSSv3.1 8.2 (HIGH) · EPSS 7th percentile

CWECWE 918TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2025-07-22
2025-07-22 21:15Z
CRIT

CVE-2025-8044 — Mozilla Firefox: Some of these bugs showed evidence of memory corruption and we presume that with

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-8044

Memory safety bugs present in Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 141 and Thunderbird 141. CVSSv3.1 9.8 (CRITICAL)

CWECWE 119VNDMozillaTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-07-22
2025-07-22 21:15Z
CRIT

CVE-2025-8043 — Mozilla Firefox: Focus incorrectly truncated URLs towards the beginning instead of around the origin.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-8043

Focus incorrectly truncated URLs towards the beginning instead of around the origin. This vulnerability was fixed in Firefox 141. CVSSv3.1 9.8 (CRITICAL)

CWECWE 451VNDMozillaVNDFocusTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-07-22
2025-07-22 21:15Z
HIGH

CVE-2025-8040 — Mozilla Firefox: Some of these bugs showed evidence of memory corruption and we presume that with

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-8040

Memory safety bugs present in Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1. CVSSv3.1 8.8 (HIGH)

CWECWE 119VNDMozillaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-07-22
2025-07-22 21:15Z
HIGH

CVE-2025-8039 — Mozilla Firefox: In some cases search terms persisted in the URL bar even after navigating away

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-8039

In some cases search terms persisted in the URL bar even after navigating away from the search page. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1. CVSSv3.1 8.1 (HIGH)

CWECWE 200VNDMozillaTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-07-22
2025-07-22 21:15Z
CRIT

CVE-2025-8038 — Mozilla Firefox: Thunderbird ignored paths when checking the validity of navigations in a frame.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-8038

Thunderbird ignored paths when checking the validity of navigations in a frame. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1. CVSSv3.1 9.8 (CRITICAL)

CWECWE 345VNDMozillaVNDThunderbirdTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-07-22
2025-07-22 21:15Z
CRIT

CVE-2025-8037 — Mozilla Firefox: Setting a nameless cookie with an equals sign in the value shadowed other cookies.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-8037

Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the shadowed cookie included the `Secure` attribute. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1. CVSSv3.1 9.1 (CRITICAL)

CWECWE 614VNDMozillaVNDSettingTYPVulnerability
9.1
CVSS v3.1
96
Edit Score