Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-18 17:29Z
2025-07-22
2025-07-22 08:15Z
HIGH

CVE-2025-38352 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-38352in the wild

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent or debugger right after unlock_task_sighand(). If a concurrent posix_cpu_timer_del() runs at that moment, it won't be able to detect timer->it.cpu.firing != 0: cpu_timer_task_rc CVSSv3.1 7.8 (HIGH) · EPSS 68th percentile

CWECWE 367TYPVulnerabilitySTAitw exploited
7.8
CVSS v3.1
89
Edit Score
2025-07-21
2025-07-21 18:15Z
CRIT

CVE-2025-44654 — Linksys E2500_firmware: This could lead to unauthorized access to system files, privilege escalation, or use of

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-44654

In Linksys E2500 3.0.04.002, the chroot_local_user option is enabled in the vsftpd configuration file. This could lead to unauthorized access to system files, privilege escalation, or use of the compromised server as a pivot point for internal network attacks. CVSSv3.1 9.8 (CRITICAL) · EPSS 61th percentile

CWECWE 284VNDLinksysTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-07-21
2025-07-21 16:15Z
CRIT

CVE-2025-44655 — Totolink A7100ru_firmware: This could lead to unauthorized access to system files, privilege escalation, or use of

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-44655

In TOTOLink A7100RU V7.4, A950RG V5.9, and T10 V5.9, the chroot_local_user option is enabled in the vsftpd.conf. This could lead to unauthorized access to system files, privilege escalation, or use of the compromised server as a pivot point for internal network attacks. CVSSv3.1 9.8 (CRITICAL) · EPSS 26th percentile

CWECWE 266VNDTotolinkTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-07-20
2025-07-20 01:15Z
CRIT

CVE-2025-53770 — Microsoft Sharepoint_server: Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-53770in the wild

Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation. CVSSv3.1 9.8 (CRITICAL) · EPSS 100th percentile

CWECWE 502VNDMicrosoftTYPVulnerabilitySTAitw exploited
9.8
CVSS v3.1
100
Edit Score
2025-07-19
2025-07-19 12:15Z
CRIT

CVE-2015-10138 — Lyntonreed Work_the_flow_file_upload: The Work The Flow File Upload plugin for WordPress is vulnerable to arbitrary file

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2015-10138

The Work The Flow File Upload plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jQuery-File-Upload-9.5.0 server and test files in versions up to, and including, 2.5.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible. CVSSv3.1 9.8 (CRITICAL) · EPSS 82th percentile

CWECWE 434VNDLyntonreedVNDWorkTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2025-07-18
2025-07-18 19:15Z
HIGH

CVE-2025-50585 — Daycloud Studentmanage: v1.0 was discovered to contain a SQL injection vulnerability via the component /admin/adminStudentUrl.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-50585

StudentManage v1.0 was discovered to contain a SQL injection vulnerability via the component /admin/adminStudentUrl. CVSSv3.1 8.8 (HIGH) · EPSS 28th percentile

CWECWE 89VNDDaycloudVNDStudentmanageTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-07-18
2025-07-18 18:15Z
HIGH

CVE-2025-52164 — Software: GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to store credentials in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-52164

Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to store credentials in plaintext. CVSSv3.1 8.2 (HIGH) · EPSS 16th percentile

CWECWE 256VNDSoftwareTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
728 × 90 / responsive · programmatic ad slot
2025-07-18
2025-07-18 06:15Z
HIGH

CVE-2025-6718 — WordPress: The B1.lt plugin for WordPress is vulnerable to SQL Injection due to a missing

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-6718

The B1.lt plugin for WordPress is vulnerable to SQL Injection due to a missing capability check on the b1_run_query AJAX action in all versions up to, and including, 2.2.57. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute and run arbitrary SQL commands. CVSSv3.1 8.8 (HIGH)

CWECWE 862VNDWordpressTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-07-17
2025-07-17 22:15Z
CRIT

CVE-2025-7398 — Broadcom Brocade_active_support_connectivity_gateway: Brocade ASCG before 3.3.0 allows for the use of medium strength cryptography algorithms on

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-7398

Brocade ASCG before 3.3.0 allows for the use of medium strength cryptography algorithms on internal ports ports 9000 and 8036. CVSSv3.1 9.1 (CRITICAL)

CWECWE 326VNDBroadcomVNDBrocadeTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2025-07-17
2025-07-17 22:15Z
CRIT

CVE-2025-6391 — Broadcom Brocade_active_support_connectivity_gateway: An attacker with access to the log files can withdraw the unencrypted tokens with

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-6391

Brocade ASCG before 3.3.0 logs JSON Web Tokens (JWT) in log files. An attacker with access to the log files can withdraw the unencrypted tokens with security implications, such as unauthorized access, session hijacking, and information disclosure. CVSSv3.1 9.1 (CRITICAL)

CWECWE 532VNDBroadcomVNDBrocadeTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2025-07-17
2025-07-17 16:15Z
CRIT

CVE-2025-53867 — Island: Lake WebBatch before 2025C allows Remote Code Execution via a crafted URL.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-53867

Island Lake WebBatch before 2025C allows Remote Code Execution via a crafted URL. CVSSv3.1 9.8 (CRITICAL) · EPSS 50th percentile

CWECWE 94VNDIslandTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-07-16
2025-07-16 12:15Z
CRIT

CVE-2025-52836 — Incorrect: Privilege Assignment vulnerability in Unity Business Technology Pty Ltd The E-Commerce ERP profitori

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-52836

Incorrect Privilege Assignment vulnerability in Unity Business Technology Pty Ltd The E-Commerce ERP profitori allows Privilege Escalation.This issue affects The E-Commerce ERP: from n/a through <= 2.1.1.3. CVSSv3.1 9.8 (CRITICAL)

CWECWE 266TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-07-16
2025-07-16 12:15Z
HIGH

CVE-2025-52819 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-52819

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in pakkemx Pakke Envíos pakke allows SQL Injection.This issue affects Pakke Envíos: from n/a through <= 1.0.2. CVSSv3.1 8.5 (HIGH)

CWECWE 89TYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2025-07-16
2025-07-16 12:15Z
CRIT

CVE-2025-52714 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-52714

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler allows SQL Injection.This issue affects Traveler: from n/a through < 3.2.2. CVSSv3.1 9.3 (CRITICAL)

CWECWE 89TYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2025-07-16
2025-07-16 12:15Z
HIGH

CVE-2025-49876 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-49876

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows SQL Injection.This issue affects ProfileGrid : from n/a through <= 5.9.5.2. CVSSv3.1 8.5 (HIGH)

CWECWE 89TYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2025-07-16
2025-07-16 12:15Z
CRIT

CVE-2025-48300 — Upload: Unrestricted Upload of File with Dangerous Type vulnerability in Adrian Tobey Groundhogg groundhogg allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-48300

Unrestricted Upload of File with Dangerous Type vulnerability in Adrian Tobey Groundhogg groundhogg allows Upload a Web Shell to a Web Server.This issue affects Groundhogg: from n/a through <= 4.2.1. CVSSv3.1 9.1 (CRITICAL)

CWECWE 434TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2025-07-16
2025-07-16 12:15Z
HIGH

CVE-2025-47645 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-47645

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic allows SQL Injection.This issue affects ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes: from n/a through <= 1.4.9. CVSSv3.1 8.5 (HIGH)

CWECWE 89TYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2025-07-16
2025-07-16 12:15Z
HIGH

CVE-2025-32574 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-32574

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPGYM gym-management allows SQL Injection.This issue affects WPGYM: from n/a through <= 65.0. CVSSv3.1 8.5 (HIGH)

CWECWE 89TYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2025-07-16
2025-07-16 12:15Z
HIGH

CVE-2025-31422 — Deserialization: of Untrusted Data vulnerability in designthemes Visual Art | Gallery WordPress Theme visual-arts

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-31422

Deserialization of Untrusted Data vulnerability in designthemes Visual Art | Gallery WordPress Theme visual-arts allows Object Injection.This issue affects Visual Art | Gallery WordPress Theme: from n/a through <= 2.4. CVSSv3.1 8.8 (HIGH)

CWECWE 502TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-07-16
2025-07-16 12:15Z
CRIT

CVE-2025-30973 — Deserialization: of Untrusted Data vulnerability in Codexpert, Inc CoSchool LMS coschool allows Object Injection.This

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-30973

Deserialization of Untrusted Data vulnerability in Codexpert, Inc CoSchool LMS coschool allows Object Injection.This issue affects CoSchool LMS: from n/a through <= 1.4.3. CVSSv3.1 9.8 (CRITICAL)

CWECWE 502TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-07-16
2025-07-16 12:15Z
CRIT

CVE-2025-30949 — Deserialization: of Untrusted Data vulnerability in Guru Team Site Chat on Telegram site-chat-on-telegram allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-30949

Deserialization of Untrusted Data vulnerability in Guru Team Site Chat on Telegram site-chat-on-telegram allows Object Injection.This issue affects Site Chat on Telegram: from n/a through <= 1.0.4. CVSSv3.1 9.8 (CRITICAL)

CWECWE 502TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-07-16
2025-07-16 12:15Z
CRIT

CVE-2025-30936 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-30936

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Torod Company for Information Technology Torod torod allows SQL Injection.This issue affects Torod: from n/a through <= 2.1. CVSSv3.1 9.3 (CRITICAL)

CWECWE 89TYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2025-07-16
2025-07-16 12:15Z
CRIT

CVE-2025-29009 — Upload: Unrestricted Upload of File with Dangerous Type vulnerability in Webkul Medical Prescription Attachment Plugin

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-29009

Unrestricted Upload of File with Dangerous Type vulnerability in Webkul Medical Prescription Attachment Plugin for WooCommerce medical-prescription-attachment-plugin-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects Medical Prescription Attachment Plugin for WooCommerce: from n/a through <= 1.2.3. CVSSv3.1 10.0 (CRITICAL)

CWECWE 434TYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2025-07-16
2025-07-16 12:15Z
CRIT

CVE-2025-28982 — Thimpress Wp_pipes: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-28982

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThimPress WP Pipes wp-pipes allows SQL Injection.This issue affects WP Pipes: from n/a through <= 1.4.3. CVSSv3.1 9.3 (CRITICAL)

CWECWE 89VNDThimpressTYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2025-07-16
2025-07-16 12:15Z
HIGH

CVE-2025-28965 — Authorization: Missing Authorization vulnerability in Md Yeasin Ul Haider URL Shortener exact-links allows Accessing Functionality

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-28965

Missing Authorization vulnerability in Md Yeasin Ul Haider URL Shortener exact-links allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects URL Shortener: from n/a through <= 3.0.7. CVSSv3.1 8.6 (HIGH)

CWECWE 862TYPVulnerability
8.6
CVSS v3.1
93
Edit Score