Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-20 06:00Z
2025-09-09
2025-09-09 19:15Z
CRIT

CVE-2025-55728 — Xwiki Pro_macros: Starting in version 1.0 and prior to version 1.26.5, missing escaping of the classes

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-55728

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5, missing escaping of the classes parameter in the panel macro allows remote code execution for any user who can edit any page The classes parameter is used without escaping in XWiki syntax, thus allowing XWiki syntax injection which enables remote code execution. Version 1.26.5 contains a patch for the issue. CVSSv3.1 10.0 (CRITICAL) · EPSS 56th percentile

CWECWE 94CWECWE 95VNDXwikiTYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2025-09-09
2025-09-09 19:15Z
CRIT

CVE-2025-55727 — Xwiki Pro_macros: Starting in version 1.0 and prior to version 1.26.5, missing escaping of the width

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-55727

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5, missing escaping of the width parameter in the column macro allows remote code execution for any user who can edit any page or who can access the CKEditor converter. The width parameter is used without escaping in XWiki syntax, thus allowing XWiki syntax injection which enables remote code execution when the macro has CVSSv3.1 10.0 (CRITICAL) · EPSS 64th percentile

CWECWE 94CWECWE 95VNDXwikiTYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2025-09-09
2025-09-09 19:15Z
CRIT

CVE-2025-55051 — CWE: CWE-1392: Use of Default Credentials

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-55051

CWE-1392: Use of Default Credentials CVSSv3.1 10.0 (CRITICAL) · EPSS 26th percentile

CWECWE 1392VNDCweTYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2025-09-09
2025-09-09 17:16Z
CRIT

CVE-2025-58997 — Site: Cross-Site Request Forgery (CSRF) vulnerability in Frenify Mow mow allows Code Injection.This issue affects

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-58997

Cross-Site Request Forgery (CSRF) vulnerability in Frenify Mow mow allows Code Injection.This issue affects Mow: from n/a through <= 4.10. CVSSv3.1 9.6 (CRITICAL)

CWECWE 352TYPVulnerability
9.6
CVSS v3.1
98
Edit Score
2025-09-09
2025-09-09 17:16Z
HIGH

CVE-2025-58215 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-58215

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Ziston ziston allows PHP Local File Inclusion.This issue affects Ziston: from n/a through < 1.4.5. CVSSv3.1 8.1 (HIGH)

CWECWE 98TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-09-09
2025-09-09 17:16Z
HIGH

CVE-2025-54910 — Microsoft 365_apps: Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-54910

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. CVSSv3.1 8.4 (HIGH) · EPSS 45th percentile

CWECWE 122VNDMicrosoftVNDHeapTYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2025-09-09
2025-09-09 17:16Z
HIGH

CVE-2025-54897 — Microsoft Sharepoint_server: Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-54897

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. CVSSv3.1 8.8 (HIGH) · EPSS 97th percentile

CWECWE 502VNDMicrosoftTYPVulnerability
8.8
CVSS v3.1
100
Edit Score
728 × 90 / responsive · programmatic ad slot
2025-09-09
2025-09-09 17:15Z
HIGH

CVE-2025-54709 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-54709

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Sala sala.This issue affects Sala: from n/a through <= 1.1.6. CVSSv3.1 8.1 (HIGH)

CWECWE 98TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-09-09
2025-09-09 17:15Z
CRIT

CVE-2025-54261 — Adobe Coldfusion: versions 2025.3, 2023.15, 2021.21 and earlier are affected by an Improper Limitation of

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-54261

ColdFusion versions 2025.3, 2023.15, 2021.21 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution by an attacker. The victim must have optional configurations enabled. Scope is changed. CVSSv3.1 10.0 (CRITICAL) · EPSS 98th percentile

CWECWE 22VNDAdobeVNDColdfusionTYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2025-09-09
2025-09-09 17:15Z
HIGH

CVE-2025-53303 — Deserialization: of Untrusted Data vulnerability in ThemeMove ThemeMove Core thememove-core allows Object Injection.This issue

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-53303

Deserialization of Untrusted Data vulnerability in ThemeMove ThemeMove Core thememove-core allows Object Injection.This issue affects ThemeMove Core: from n/a through <= 1.4.2. CVSSv3.1 8.8 (HIGH)

CWECWE 502TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-09-09
2025-09-09 17:15Z
HIGH

CVE-2025-48101 — Deserialization: of Untrusted Data vulnerability in webdevstudios Constant Contact for WordPress constant-contact-api allows Object

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-48101

Deserialization of Untrusted Data vulnerability in webdevstudios Constant Contact for WordPress constant-contact-api allows Object Injection.This issue affects Constant Contact for WordPress: from n/a through <= 4.1.1. CVSSv3.1 8.8 (HIGH)

CWECWE 502TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-09-09
2025-09-09 17:15Z
CRIT

CVE-2025-47579 — Themegoods Photography: Deserialization of Untrusted Data vulnerability in ThemeGoods Photography photography allows Object Injection.This issue affects

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-47579

Deserialization of Untrusted Data vulnerability in ThemeGoods Photography photography allows Object Injection.This issue affects Photography: from n/a through <= 7.7.2. CVSSv3.1 9.0 (CRITICAL)

CWECWE 502VNDThemegoodsTYPVulnerability
9.0
CVSS v3.1
95
Edit Score
2025-09-09
2025-09-09 17:15Z
CRIT

CVE-2025-47569 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-47569

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPSwings WooCommerce Ultimate Gift Card woocommerce-ultimate-gift-card allows Blind SQL Injection.This issue affects WooCommerce Ultimate Gift Card: from n/a through <= 2.9.6. CVSSv3.1 9.3 (CRITICAL)

CWECWE 89TYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2025-09-09
2025-09-09 17:15Z
CRIT

CVE-2025-32486 — Weak: Password Recovery Mechanism for Forgotten Password vulnerability in Hossein Material Dashboard material-dashboard.This issue

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-32486

Weak Password Recovery Mechanism for Forgotten Password vulnerability in Hossein Material Dashboard material-dashboard.This issue affects Material Dashboard: from n/a through <= 1.4.6. CVSSv3.1 9.8 (CRITICAL)

CWECWE 640VNDWeakTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-09-09
2025-09-09 16:15Z
HIGH

CVE-2025-9872 — Ivanti Endpoint_manager: Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-9872

Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required. CVSSv3.1 8.8 (HIGH) · EPSS 96th percentile

CWECWE 434VNDIvantiTYPVulnerability
8.8
CVSS v3.1
98
Edit Score
2025-09-09
2025-09-09 16:15Z
HIGH

CVE-2025-55147 — Ivanti Connect_secure: CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-55147

CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote unauthenticated attacker to execute sensitive actions on behalf of the victim user. User interaction is required CVSSv3.1 8.8 (HIGH) · EPSS 48th percentile

CWECWE 352VNDIvantiVNDCsrfTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-09-09
2025-09-09 16:15Z
HIGH

CVE-2025-55145 — Ivanti Neurons_for_secure_access: Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-55145

Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker to hijack existing HTML5 connections. CVSSv3.1 8.9 (HIGH) · EPSS 50th percentile

CWECWE 862VNDIvantiTYPVulnerability
8.9
CVSS v3.1
95
Edit Score
2025-09-09
2025-09-09 16:15Z
HIGH

CVE-2025-55142 — Ivanti Connect_secure: Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-55142

Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure authentication related settings. CVSSv3.1 8.8 (HIGH) · EPSS 60th percentile

CWECWE 862VNDIvantiTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-09-09
2025-09-09 16:15Z
HIGH

CVE-2025-55141 — Ivanti Connect_secure: Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-55141

Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure authentication related settings. CVSSv3.1 8.8 (HIGH) · EPSS 60th percentile

CWECWE 862VNDIvantiTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-09-09
2025-09-09 14:15Z
CRIT

CVE-2025-9994 — The Amp’ed RF BT-AP 111 Bluetooth access point's HTTP admin interface does not have

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-9994

The Amp’ed RF BT-AP 111 Bluetooth access point's HTTP admin interface does not have an authentication feature, allowing unauthorized access to anyone with network access. CVSSv3.1 9.8 (CRITICAL) · EPSS 43th percentile

CWECWE 306CWECWE 287TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-09-09
2025-09-09 14:15Z
CRIT

CVE-2025-54236 — Adobe Commerce: versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-54236in the wild

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction. CVSSv3.1 9.1 (CRITICAL) · EPSS 98th percentile

CWECWE 20VNDAdobeTYPVulnerabilitySTAitw exploited
9.1
CVSS v3.1
100
Edit Score
2025-09-09
2025-09-09 13:15Z
HIGH

CVE-2025-9364 — Rockwellautomation Factorytalk_analytics_logixai: This could result in an attacker on the intranet accessing sensitive data and potential

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-9364

An open database issue exists in the affected product and version. The security issue stems from an over permissive Redis instance. This could result in an attacker on the intranet accessing sensitive data and potential alteration of data. CVSSv3.1 8.8 (HIGH) · EPSS 19th percentile

CWECWE 497VNDRockwellautomationTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-09-09
2025-09-09 09:15Z
CRIT

CVE-2025-40795 — Siemens Simatic_pcs_neo: Affected products contain a stack-based buffer overflow vulnerability in the integrated UMC component.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-40795

A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All versions < V6.0 SP1 Update 1), User Management Component (UMC) (All versions < V2.15.1.3). Affected products contain a stack-based buffer overflow vulnerability in the integrated UMC component. This could allow an unauthenticated remote attacker to execute arbitrary code or to cause a denial of service condition. CVSSv3.1 9.8 (CRITICAL) · EPSS 59th percentile

CWECWE 121VNDSiemensTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-09-09
2025-09-09 09:15Z
CRIT

CVE-2025-10134 — Goza: The Goza - Nonprofit Charity WordPress Theme theme for WordPress is vulnerable to arbitrary

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-10134

The Goza - Nonprofit Charity WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the alone_import_pack_restore_data() function in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). CVSSv3.1 9.1 (CRITICAL)

CWECWE 73VNDGozaTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2025-09-09
2025-09-09 02:15Z
CRIT

CVE-2025-42944 — Due to a deserialization vulnerability in SAP NetWeaver, an unauthenticated attacker could exploit the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-42944

Due to a deserialization vulnerability in SAP NetWeaver, an unauthenticated attacker could exploit the system through the RMI-P4 module by submitting malicious payload to an open port. The deserialization of such untrusted Java objects could lead to arbitrary OS command execution, posing a high impact to the application's confidentiality, integrity, and availability. CVSSv3.1 10.0 (CRITICAL) · EPSS 87th percentile

CWECWE 502TYPVulnerability
10.0
CVSS v3.1
100
Edit Score