Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-20 21:29Z
2025-08-04
2025-08-04 15:58Z
CRIT

Oops Safari, I think You Spilled Something!

Exodus Intel·blog.exodusintel.comCVE-2024-44308

Exodus Intelligence disclosed CVE-2024-44308, a use-of-uninitialized-variable vulnerability in WebKit's DFG compiler affecting Safari on macOS and iOS. The bug exists in TypedArray index storage code and was patched by Apple in November 2024; when alive, it enabled renderer RCE when chained with PAC and APRR bypasses on Apple Silicon. This writeup provides detailed technical analysis of the DFG IR, root-cause debugging, and exploitation methodology for achieving arbitrary read/write through stack layout control.

SRFOsTACTA0005TACTA0002SRFBrowserVNDAppleVNDWebkitTYPWriteupTYPExploit
78
Edit Score
2025-08-04
2025-08-04 15:15Z
HIGH

CVE-2025-44643 — Certain: An attacker with network access could exploit this to gain unauthorized control over the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-44643

Certain Draytek products are affected by Insecure Configuration. This affects AP903 v1.4.18 and AP912C v1.4.9 and AP918R v1.4.9. The setting of the password property in the ripd.conf configuration file sets a hardcoded weak password, posing a security risk. An attacker with network access could exploit this to gain unauthorized control over the routing daemon, potentially altering network routes or intercepting traffic. CVSSv3.1 8.6 (HIGH) · EPSS 16th percentile

CWECWE 798CWECWE 276VNDCertainTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2025-08-04
2025-08-04 07:15Z
HIGH

CVE-2025-20701 — Airoha: This could lead to remote escalation of privilege with no additional execution privileges needed.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-20701

In the Airoha Bluetooth audio SDK, there is a possible way to pair Bluetooth audio device without user consent. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. CVSSv3.1 8.8 (HIGH) · EPSS 87th percentile

CWECWE 863VNDAirohaTYPVulnerability
8.8
CVSS v3.1
95
Edit Score
2025-08-02
2025-08-02 08:15Z
HIGH

CVE-2025-6754 — SEO: The SEO Metrics plugin for WordPress is vulnerable to Privilege Escalation due to missing

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-6754

The SEO Metrics plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks in both the seo_metrics_handle_connect_button_click() AJAX handler and the seo_metrics_handle_custom_endpoint() function in all versions up to, and including, 1.0.15. Because the AJAX action only verifies a nonce, without checking the caller’s capabilities, a subscriber-level user can retrieve the token and then access the custom endpoint to obtain full administrator CVSSv3.1 8.8 (HIGH)

CWECWE 862VNDSeoTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-08-01
2025-08-01 21:15Z
HIGH

CVE-2013-10050 — Dlink Dir-300_firmware: An OS command injection vulnerability exists in multiple D-Link routers (confirmed on DIR-300 rev

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2013-10050

An OS command injection vulnerability exists in multiple D-Link routers (confirmed on DIR-300 rev A v1.05 and DIR-615 rev D v4.13) via the authenticated tools_vct.xgi CGI endpoint. The web interface fails to properly sanitize user-supplied input in the pingIp parameter, allowing attackers with valid credentials to inject arbitrary shell commands. Exploitation enables full device compromise, including spawning a telnet daemon and establishing a root shell. The vulnerability is CVSSv3.1 8.8 (HIGH) · EPSS 99th percentile

CWECWE 78VNDDlinkTYPVulnerability
8.8
CVSS v3.1
100
Edit Score
2025-08-01
2025-08-01 17:15Z
CRIT

CVE-2025-45150 — X-d_lab Langchain-chatglm-webui: Insecure permissions in LangChain-ChatGLM-Webui commit ef829 allows attackers to arbitrarily view and download sensitive

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-45150

Insecure permissions in LangChain-ChatGLM-Webui commit ef829 allows attackers to arbitrarily view and download sensitive files via supplying a crafted request. CVSSv3.1 9.8 (CRITICAL) · EPSS 43th percentile

CWECWE 732VNDLangchainVNDX D LabTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-07-31
2025-07-31 20:15Z
HIGH

CVE-2025-50572 — Archer: 6.11.00204.10014 allows attackers to execute arbitrary code via crafted system inputs that would

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-50572

Archer 6.11.00204.10014 allows attackers to execute arbitrary code via crafted system inputs that would be exported into the CSV and be executed after the user opened the file with compatible applications. NOTE: the Supplier does not accept this as a valid vulnerability report against their product. CVSSv3.1 8.8 (HIGH) · EPSS 35th percentile

CWECWE 1236VNDArcherTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
728 × 90 / responsive · programmatic ad slot
2025-07-31
2025-07-31 16:15Z
HIGH

CVE-2025-50850 — Cs-cart Cs-cart: An issue was discovered in CS Cart 4.18.3 allows the vendor login functionality lacks

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-50850

An issue was discovered in CS Cart 4.18.3 allows the vendor login functionality lacks essential security controls such as CAPTCHA verification and rate limiting. This allows an attacker to systematically attempt various combinations of usernames and passwords (brute-force attack) to gain unauthorized access to vendor accounts. The absence of any blocking mechanism makes the login endpoint susceptible to automated attacks. CVSSv3.1 8.6 (HIGH) · EPSS 14th percentile

CWECWE 284CWECWE 804VNDCs CartTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2025-07-31
2025-07-31 15:15Z
HIGH

CVE-2025-50849 — Cart: CS Cart 4.18.3 is vulnerable to Insecure Direct Object Reference (IDOR).

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-50849

CS Cart 4.18.3 is vulnerable to Insecure Direct Object Reference (IDOR). The user profile functionality allows enabling or disabling stickers through a parameter (company_id) sent in the request. However, this operation is not properly validated on the server side. An authenticated user can manipulate the request to target other users' accounts and toggle the sticker setting by modifying the company_id or other object identifiers. CVSSv3.1 8.0 (HIGH) · EPSS 16th percentile

CWECWE 639VNDCartTYPVulnerability
8.0
CVSS v3.1
90
Edit Score
2025-07-30
2025-07-30 18:24Z
HIGH

NullGate — Library that eases the use of indirect syscalls. Quite interesting AV/EDR bypass as PoC.

GitHub · EDR bypass / evasion·github.comGITHUB POC

NullGate is a C++ library that abstracts indirect syscall invocation using FreshyCalls with dynamic syscall number retrieval, coupled with a novel Windows Defender memory-scan evasion technique. The evasion method allocates memory with PAGE_NOACCESS, creates suspended threads, writes shellcode post-suspension, then resumes execution—avoiding detection during the critical memory-scan window. The library includes compile-time string obfuscation via FNV1 hashing and XOR encryption with per-build randomized keys.

SRFOsTACTA0005TACTA0002VNDMicrosoftTYPTechniqueTYPToolSTGDefense EvasionSTGExecution
76
Edit Score
2025-07-30
2025-07-30 17:15Z
HIGH

CVE-2025-45620 — Averusa Ptc310uv2_firmware: An issue in Aver PTC310UV2 v.0.1.0000.59 allows a remote attacker to obtain sensitive information

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-45620

An issue in Aver PTC310UV2 v.0.1.0000.59 allows a remote attacker to obtain sensitive information via a crafted request CVSSv3.1 8.1 (HIGH) · EPSS 55th percentile

CWECWE 200VNDAverVNDAverusaTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-07-30
2025-07-30 00:15Z
HIGH

CVE-2025-31277 — Apple Safari: Processing maliciously crafted web content may lead to memory corruption.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-31277

The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption. CVSSv3.1 8.8 (HIGH)

CWECWE 120CWECWE 119VNDAppleTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-07-29
2025-07-29 05:15Z
CRIT

CVE-2025-8264 — Versions of the package z-push/z-push-dev before 2.7.6 are vulnerable to SQL Injection due to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-8264

Versions of the package z-push/z-push-dev before 2.7.6 are vulnerable to SQL Injection due to unparameterized queries in the IMAP backend. An attacker can inject malicious commands by manipulating the username field in basic authentication. This allows the attacker to access and potentially modify or delete sensitive data from a linked third-party database. **Note:** This vulnerability affects Z-Push installations that utilize the IMAP backend and have the IMAP_FROM_SQL_QUE CVSSv3.1 9.0 (CRITICAL) · EPSS 30th percentile

CWECWE 89TYPVulnerability
9.0
CVSS v3.1
95
Edit Score
2025-07-29
2025-07-29 00:00Z
HIGH

Gunra Ransomware Group Unveils Efficient Linux Variant

Trend Micro Research·trendmicro.comin the wild

Trend Micro disclosed technical analysis of Gunra ransomware's new Linux variant, first observed in April 2025. The variant features configurable multi-threaded encryption (up to 100 threads), partial file encryption, and hybrid RSA/ChaCha20 encryption with optional separate keystore storage. The group has claimed 14 victims across multiple sectors and geographies since emergence.

SRFOsTACTA0005TACTA0002VNDTrend MicroTYPResearchTYPThreat IntelSTGExecutionSTGImpact
72
Edit Score
2025-07-29
2025-07-29 00:00Z
HIGH

MaaS Appeal: An Infostealer Rises From The Ashes

Elastic Security Labs·elastic.coin the wild

NOVABLIGHT is a NodeJS-based Malware-as-a-Service infostealer developed by the Sordeal Group, distributed via fake game installers and sold with API keys on underground platforms. The malware features modular credential theft, cryptocurrency wallet clipper functionality, Electron app injection (Discord, Exodus, Mullvad, Atomic), anti-analysis evasion, system sabotage capabilities (Defender/Task Manager/network disabling), and multi-channel exfiltration via web panels, Discord webhooks, and Telegram.

SRFApplicationSRFOsTACTA0005TACTA0001TACTA0002TACTA0006TACTA0007TACTA0003
78
Edit Score
2025-07-28
2025-07-28 20:17Z
HIGH

CVE-2025-29534 — An authenticated remote code execution vulnerability in PowerStick Wave Dual-Band Wifi Extender V1.0 allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-29534

An authenticated remote code execution vulnerability in PowerStick Wave Dual-Band Wifi Extender V1.0 allows an attacker with valid credentials to execute arbitrary commands with root privileges. The issue stems from insufficient sanitization of user-supplied input in the /cgi-bin/cgi_vista.cgi executable, which is passed to a system-level function call. CVSSv3.1 8.8 (HIGH) · EPSS 46th percentile

CWECWE 78TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-07-28
2025-07-28 12:15Z
HIGH

CVE-2025-5997 — Incorrect: Use of Privileged APIs vulnerability in Beamsec PhishPro allows Privilege Abuse.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-5997

Incorrect Use of Privileged APIs vulnerability in Beamsec PhishPro allows Privilege Abuse. This issue affects PhishPro: before 7.5.4.2. CVSSv3.1 8.8 (HIGH) · EPSS 49th percentile

CWECWE 648TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-07-28
2025-07-28 12:15Z
HIGH

CVE-2025-38495 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: HID: core: ensure the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-38495

In the Linux kernel, the following vulnerability has been resolved: HID: core: ensure the allocated report buffer can contain the reserved report ID When the report ID is not used, the low level transport drivers expect the first byte to be 0. However, currently the allocated buffer not account for that extra byte, meaning that instead of having 8 guaranteed bytes for implement to be working, we only have 7. CVSSv3.1 8.8 (HIGH) · EPSS 10th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-07-28
2025-07-28 12:15Z
HIGH

CVE-2025-38491 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: mptcp: make fallback action

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-38491

In the Linux kernel, the following vulnerability has been resolved: mptcp: make fallback action and fallback decision atomic Syzkaller reported the following splat: WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 __mptcp_do_fallback net/mptcp/protocol.h:1223 [inline] WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 mptcp_do_fallback net/mptcp/protocol.h:1244 [inline] WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 check_fully_established net/mptcp CVSSv3.1 8.2 (HIGH) · EPSS 1th percentile

CWECWE 667TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2025-07-28
2025-07-28 12:15Z
CRIT

CVE-2025-38490 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: net: libwx: remove duplicate

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-38490

In the Linux kernel, the following vulnerability has been resolved: net: libwx: remove duplicate page_pool_put_full_page() page_pool_put_full_page() should only be invoked when freeing Rx buffers or building a skb if the size is too short. At other times, the pages need to be reused. So remove the redundant page put. In the original code, double free pages cause kernel panic: [ 876.949834] __irq_exit_rcu+0xc7/0x130 [ 876.949836] common_interrupt+0xb8/0xd0 [ 876.949838 CVSSv3.1 9.8 (CRITICAL) · EPSS 5th percentile

CWECWE 415TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-07-28
2025-07-28 12:15Z
CRIT

CVE-2025-38488 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-38488

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in crypt_message when using async crypto The CVE-2024-50047 fix removed asynchronous crypto handling from crypt_message(), assuming all crypto operations are synchronous. However, when hardware crypto accelerators are used, this can cause use-after-free crashes: crypt_message() // Allocate the creq buffer containing the req creq = smb2_get_aead_req(..., &req); CVSSv3.1 9.8 (CRITICAL) · EPSS 20th percentile

CWECWE 416TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-07-28
2025-07-28 12:15Z
CRIT

CVE-2025-38476 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: rpl: Fix use-after-free in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-38476

In the Linux kernel, the following vulnerability has been resolved: rpl: Fix use-after-free in rpl_do_srh_inline(). Running lwt_dst_cache_ref_loop.sh in selftest with KASAN triggers the splat below [0]. rpl_do_srh_inline() fetches ipv6_hdr(skb) and accesses it after skb_cow_head(), which is illegal as the header could be freed then. Let's fix it by making oldhdr to a local struct instead of a pointer. [0]: [root@fedora net]# ./lwt_dst_cache_ref_loop.sh ... TEST: rpl (inp CVSSv3.1 9.8 (CRITICAL) · EPSS 5th percentile

CWECWE 416TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-07-28
2025-07-28 12:15Z
CRIT

CVE-2025-38472 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack: fix crash

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-38472

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry A crash in conntrack was reported while trying to unlink the conntrack entry from the hash bucket list: [exception RIP: __nf_ct_delete_from_lists+172] [..] #7 [ff539b5a2b043aa0] nf_ct_delete at ffffffffc124d421 [nf_conntrack] #8 [ff539b5a2b043ad0] nf_ct_gc_expired at ffffffffc124d999 [nf_conntrack] #9 [ff539b5a2b043ae0] __nf CVSSv3.1 9.8 (CRITICAL) · EPSS 5th percentile

CWECWE 908TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-07-28
2025-07-28 12:15Z
CRIT

CVE-2025-38471 — Linux Linux_kernel: BUG: KASAN: slab-use-after-free in tls_strp_check_rcv+0x898/0x9a0 [tls] (net/tls/tls_strp.c:436 net/tls/tls_strp.c:530 net/tls/tls_strp.c:544) Read of size 4 at

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-38471

In the Linux kernel, the following vulnerability has been resolved: tls: always refresh the queue when reading sock After recent changes in net-next TCP compacts skbs much more aggressively. This unearthed a bug in TLS where we may try to operate on an old skb when checking if all skbs in the queue have matching decrypt state and geometry. BUG: KASAN: slab-use-after-free in tls_strp_check_rcv+0x898/0x9a0 [tls] (net/tls/tls_strp.c:436 net/tls/tls_strp.c:530 net/tls/ CVSSv3.1 9.8 (CRITICAL) · EPSS 5th percentile

CWECWE 416TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-07-28
2025-07-28 11:15Z
CRIT

CVE-2025-6918 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-6918

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ncvav Virtual PBX Software allows SQL Injection. This issue affects Virtual PBX Software: before 09.07.2025. CVSSv3.1 9.8 (CRITICAL) · EPSS 48th percentile

CWECWE 89TYPVulnerability
9.8
CVSS v3.1
99
Edit Score