Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-21 03:06Z
2025-09-16
2025-09-16 08:15Z
HIGH

CVE-2024-12367 — Exposure: of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Vegagrup Software

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-12367

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Vegagrup Software Vega Master allows Directory Indexing. This issue affects Vega Master: from v.1.12.35 through 20250916.  NOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will be updated when new information becomes available. CVSSv3.1 8.6 (HIGH) · EPSS 17th percentile

CWECWE 497TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2025-09-16
2025-09-16 08:15Z
HIGH

CVE-2023-53297 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix "bad

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-53297

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp conn->chan_lock isn't acquired before l2cap_get_chan_by_scid, if l2cap_get_chan_by_scid returns NULL, then 'bad unlock balance' is triggered. CVSSv3.1 8.8 (HIGH) · EPSS 4th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-09-15
2025-09-15 23:15Z
CRIT

CVE-2025-43359 — Apple Ipados: A logic issue was addressed with improved state management.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-43359

A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. A UDP server socket bound to a local interface may become bound to all interfaces. CVSSv3.1 9.8 (CRITICAL) · EPSS 60th percentile

CWECWE 670VNDAppleTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-09-15
2025-09-15 23:15Z
HIGH

CVE-2025-43358 — Apple Ipados: A shortcut may be able to bypass sandbox restrictions.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-43358

A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. A shortcut may be able to bypass sandbox restrictions. CVSSv3.1 8.8 (HIGH) · EPSS 22th percentile

CWECWE 862VNDAppleTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-09-15
2025-09-15 23:15Z
CRIT

CVE-2025-43347 — Apple Ipados: This issue was addressed by removing the vulnerable code.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-43347

This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. An input validation issue was addressed. CVSSv3.1 9.8 (CRITICAL) · EPSS 59th percentile

CWECWE 20VNDAppleTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-09-15
2025-09-15 23:15Z
CRIT

CVE-2025-43343 — Apple Safari: Processing maliciously crafted web content may lead to an unexpected process crash.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-43343

The issue was addressed with improved memory handling. This issue is fixed in Safari 26, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. Processing maliciously crafted web content may lead to an unexpected process crash. CVSSv3.1 9.8 (CRITICAL) · EPSS 55th percentile

CWECWE 119VNDAppleTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-09-15
2025-09-15 23:15Z
CRIT

CVE-2025-43342 — Apple Safari: Processing maliciously crafted web content may lead to an unexpected process crash.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-43342

A correctness issue was addressed with improved checks. This issue is fixed in Safari 26, iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. Processing maliciously crafted web content may lead to an unexpected process crash. CVSSv3.1 9.8 (CRITICAL) · EPSS 54th percentile

CWECWE 20VNDAppleTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
728 × 90 / responsive · programmatic ad slot
2025-09-15
2025-09-15 23:15Z
HIGH

CVE-2025-43329 — Apple Ipados: A permissions issue was addressed with additional restrictions.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-43329

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, watchOS 26. An app may be able to break out of its sandbox. CVSSv3.1 8.8 (HIGH) · EPSS 23th percentile

CWECWE 862VNDAppleTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-09-15
2025-09-15 23:15Z
CRIT

CVE-2025-31255 — Apple Ipados: An authorization issue was addressed with improved state management.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-31255

An authorization issue was addressed with improved state management. This issue is fixed in iOS 26 and iPadOS 26, macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26, tvOS 26, watchOS 26. An app may be able to access sensitive user data. CVSSv3.1 9.8 (CRITICAL) · EPSS 75th percentile

CWECWE 285VNDAppleTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-09-15
2025-09-15 22:15Z
HIGH

CVE-2025-56274 — Senior-walter Web-based_pharmacy_product_management_system: SourceCodester Web-based Pharmacy Product Management System 1.0 is vulnerable to Incorrect Access Control, which

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-56274

SourceCodester Web-based Pharmacy Product Management System 1.0 is vulnerable to Incorrect Access Control, which allows low-privileged users to forge high privileged (such as admin) sessions and perform sensitive operations such as adding new users. CVSSv3.1 8.1 (HIGH)

CWECWE 284VNDSenior WalterVNDSourcecodesterTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-09-15
2025-09-15 17:15Z
CRIT

CVE-2025-58748 — Dataease Dataease: This lack of validation allows a crafted JDBC configuration that substitutes the Amazon Redshift

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-58748

Dataease is an open source data analytics and visualization platform. In Dataease versions up to 2.10.12 the H2 data source implementation (H2.java) does not verify that a provided JDBC URL starts with jdbc:h2. This lack of validation allows a crafted JDBC configuration that substitutes the Amazon Redshift driver and leverages the socketFactory and socketFactoryArg parameters to invoke org.springframework.context.support.FileSystemXmlApplicationContext or ClassPathXmlApplicat CVSSv3.1 9.8 (CRITICAL) · EPSS 57th percentile

CWECWE 502VNDDataeaseTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-09-15
2025-09-15 17:15Z
CRIT

CVE-2025-57174 — Siklu: An issue was discovered in Siklu Communications Etherhaul 8010TX and 1200FX devices, Firmware 7.4.0

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-57174

An issue was discovered in Siklu Communications Etherhaul 8010TX and 1200FX devices, Firmware 7.4.0 through 10.7.3 and possibly other previous versions. The rfpiped service listening on TCP port 555 which uses static AES encryption keys hardcoded in the binary. These keys are identical across all devices, allowing attackers to craft encrypted packets that execute arbitrary commands without authentication. This is a failed patch for CVE-2017-7318. This issue may affect other E CVSSv3.1 9.8 (CRITICAL) · EPSS 65th percentile

CWECWE 321VNDSikluTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-09-15
2025-09-15 16:15Z
CRIT

CVE-2025-58046 — Dataease Dataease: In versions up to and including 2.10.12, the Impala data source is vulnerable to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-58046

Dataease is an open-source data visualization and analysis platform. In versions up to and including 2.10.12, the Impala data source is vulnerable to remote code execution due to insufficient filtering in the getJdbc method of the io.dataease.datasource.type.Impala class. Attackers can construct malicious JDBC connection strings that exploit JNDI injection and trigger RMI deserialization, ultimately enabling remote command execution. The vulnerability can be exploited by edit CVSSv3.1 9.8 (CRITICAL) · EPSS 73th percentile

CWECWE 502CWECWE 74VNDDataeaseTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-09-15
2025-09-15 16:15Z
CRIT

CVE-2025-58045 — Dataease Dataease: In Dataease versions up to 2.10.12, the patch introduced to mitigate DB2 JDBC deserialization

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-58045

Dataease is an open source data analytics and visualization platform. In Dataease versions up to 2.10.12, the patch introduced to mitigate DB2 JDBC deserialization remote code execution attacks only blacklisted the rmi parameter. The ldap parameter in the DB2 JDBC connection string was not filtered, allowing attackers to exploit the DB2 JDBC connection string to trigger server-side request forgery (SSRF). In higher versions of Java, ldap deserialization (autoDeserialize) is d CVSSv3.1 9.8 (CRITICAL) · EPSS 52th percentile

CWECWE 918VNDDataeaseTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-09-15
2025-09-15 15:15Z
HIGH

CVE-2023-53253 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: HID: nvidia-shield: Reference hid_device

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-53253

In the Linux kernel, the following vulnerability has been resolved: HID: nvidia-shield: Reference hid_device devm allocation of input_dev name Use hid_device for devm allocation of the input_dev name to avoid a use-after-free. input_unregister_device would trigger devres cleanup of all resources associated with the input_dev, free-ing the name. The name would subsequently be used in a uevent fired at the end of unregistering the input_dev. CVSSv3.1 8.8 (HIGH) · EPSS 3th percentile

CWECWE 416TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-09-15
2025-09-15 15:15Z
HIGH

CVE-2023-53226 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Fix OOB

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-53226

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Fix OOB and integer underflow when rx packets Make sure mwifiex_process_mgmt_packet, mwifiex_process_sta_rx_packet and mwifiex_process_uap_rx_packet, mwifiex_uap_queue_bridged_pkt and mwifiex_process_rx_packet not out-of-bounds access the skb->data buffer. CVSSv3.1 8.8 (HIGH) · EPSS 5th percentile

CWECWE 191TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-09-15
2025-09-15 15:15Z
HIGH

CVE-2023-53213 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: slab-out-of-bounds read

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-53213

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() Fix a slab-out-of-bounds read that occurs in kmemdup() called from brcmf_get_assoc_ies(). The bug could occur when assoc_info->req_len, data from a URB provided by a USB device, is bigger than the size of buffer which is defined as WL_EXTRA_BUF_MAX. Add the size check for req_len/resp_len of assoc_info. Found by a modified version of syzkall CVSSv3.1 8.1 (HIGH) · EPSS 5th percentile

CWECWE 125TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-09-15
2025-09-15 15:15Z
CRIT

CVE-2022-50335 — Linux Linux_kernel: It will use a uninitialized req, which will result in a bad request data

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-50335

In the Linux kernel, the following vulnerability has been resolved: 9p: set req refcount to zero to avoid uninitialized usage When a new request is allocated, the refcount will be zero if it is reused, but if the request is newly allocated from slab, it is not fully initialized before being added to idr. If the p9_read_work got a response before the refcount initiated. It will use a uninitialized req, which will result in a bad request data struct. Here is the logs from s CVSSv3.1 9.8 (CRITICAL) · EPSS 4th percentile

CWECWE 908TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-09-15
2025-09-15 14:15Z
HIGH

CVE-2023-53194 — Linux Linux_kernel: [ 162.459513] BUG: KASAN: use-after-free in hdr_find_e.isra.0+0x10c/0x320 [ 162.460176] Read of size 2 at

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-53194

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add length check in indx_get_root This adds a length check to guarantee the retrieved index root is legit. [ 162.459513] BUG: KASAN: use-after-free in hdr_find_e.isra.0+0x10c/0x320 [ 162.460176] Read of size 2 at addr ffff8880037bca99 by task mount/243 [ 162.460851] [ 162.461252] CPU: 0 PID: 243 Comm: mount Not tainted 6.0.0-rc7 #42 [ 162.461744] Hardware name: QEMU Standard PC (i440FX + PII CVSSv3.1 8.4 (HIGH) · EPSS 5th percentile

CWECWE 416TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2025-09-15
2025-09-15 14:15Z
CRIT

CVE-2023-53192 — Linux Linux_kernel: Passing the 32 bit hash returned by skb_get_hash() can lead to problems related to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-53192

In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix nexthop hash size The nexthop code expects a 31 bit hash, such as what is returned by fib_multipath_hash() and rt6_multipath_hash(). Passing the 32 bit hash returned by skb_get_hash() can lead to problems related to the fact that 'int hash' is a negative number when the MSB is set. In the case of hash threshold nexthop groups, nexthop_select_path_hthr() will disproportionately select the first n CVSSv3.1 9.8 (CRITICAL) · EPSS 5th percentile

CWECWE 129TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-09-15
2025-09-15 14:15Z
HIGH

CVE-2023-53186 — Linux Linux_kernel: Later when SKB(@to) is released, it frees the page directly even though the page

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-53186

In the Linux kernel, the following vulnerability has been resolved: skbuff: Fix a race between coalescing and releasing SKBs Commit 1effe8ca4e34 ("skbuff: fix coalescing for page_pool fragment recycling") allowed coalescing to proceed with non page pool page and page pool page when @from is cloned, i.e. to->pp_recycle --> false from->pp_recycle --> true skb_cloned(from) --> true However, it actually requires skb_cloned(@from) to hold true until coalescing finishes in CVSSv3.1 8.1 (HIGH) · EPSS 1th percentile

CWECWE 362TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-09-15
2025-09-15 14:15Z
HIGH

CVE-2022-50241 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: NFSD: fix use-after-free on

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-50241

In the Linux kernel, the following vulnerability has been resolved: NFSD: fix use-after-free on source server when doing inter-server copy Use-after-free occurred when the laundromat tried to free expired cpntf_state entry on the s2s_cp_stateids list after inter-server copy completed. The sc_cp_list that the expired copy state was inserted on was already freed. When COPY completes, the Linux client normally sends LOCKU(lock_state x), FREE_STATEID(lock_state x) and CLOSE(op CVSSv3.1 8.8 (HIGH) · EPSS 5th percentile

CWECWE 416TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-09-15
2025-09-15 14:15Z
CRIT

CVE-2022-50235 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: NFSD: Protect against send

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-50235

In the Linux kernel, the following vulnerability has been resolved: NFSD: Protect against send buffer overflow in NFSv2 READDIR Restore the previous limit on the @count argument to prevent a buffer overflow attack. CVSSv3.1 9.8 (CRITICAL) · EPSS 7th percentile

CWECWE 787TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-09-15
2025-09-15 12:15Z
HIGH

CVE-2025-10443 — Tenda Ac9_firmware: Such manipulation of the argument cmdinput leads to buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-10443

A vulnerability was identified in Tenda AC9 and AC15 15.03.05.14/15.03.05.18. This vulnerability affects the function formexeCommand of the file /goform/exeCommand. Such manipulation of the argument cmdinput leads to buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. CVSSv3.1 8.8 (HIGH) · EPSS 91th percentile

CWECWE 120CWECWE 119VNDTendaTYPVulnerability
8.8
CVSS v3.1
95
Edit Score
2025-09-15
2025-09-15 11:15Z
MED

CVE-2025-10442 — Tenda Ac9_firmware: This manipulation of the argument cmdinput causes os command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-10442

A vulnerability was determined in Tenda AC9 and AC15 15.03.05.14. This affects the function formexeCommand of the file /goform/exeCommand. This manipulation of the argument cmdinput causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. CVSSv3.1 6.3 (MEDIUM) · EPSS 95th percentile

CWECWE 77CWECWE 78VNDTendaTYPVulnerability
6.3
CVSS v3.1
84
Edit Score