Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-21 09:29Z
2025-08-30
2025-08-30 14:15Z
HIGH

CVE-2005-10004 — Cacti Cacti: An authenticated user can inject arbitrary shell commands via the graph_start GET parameter, which

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2005-10004

Cacti versions prior to 0.8.6-d contain a remote command execution vulnerability in the graph_view.php script. An authenticated user can inject arbitrary shell commands via the graph_start GET parameter, which is improperly handled during graph rendering. This flaw allows attackers to execute commands on the underlying operating system with the privileges of the web server process, potentially compromising system integrity. CVSSv3.1 8.8 (HIGH) · EPSS 79th percentile

CWECWE 78VNDCactiTYPVulnerability
8.8
CVSS v3.1
95
Edit Score
2025-08-30
2025-08-30 04:15Z
CRIT

CVE-2025-54946 — Sun.net Ehrd_ctms: A SQL injection vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-54946

A SQL injection vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to execute arbitrary SQL commands. CVSSv3.1 9.8 (CRITICAL) · EPSS 40th percentile

CWECWE 89VNDSun NetTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-08-30
2025-08-30 04:15Z
CRIT

CVE-2025-54945 — Sun.net Ehrd_ctms: An external control of file name or path vulnerability in SUNNET Corporate Training Management

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-54945

An external control of file name or path vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to execute arbitrary system commands via a malicious file by controlling the destination file path. CVSSv3.1 9.8 (CRITICAL) · EPSS 44th percentile

CWECWE 73VNDSun NetTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-08-30
2025-08-30 04:15Z
CRIT

CVE-2025-54944 — Sun.net Ehrd_ctms: An unrestricted upload of file with dangerous type vulnerability in SUNNET Corporate Training Management

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-54944

An unrestricted upload of file with dangerous type vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to write malicious code in a specific file, which may lead to arbitrary code execution. CVSSv3.1 9.8 (CRITICAL) · EPSS 52th percentile

CWECWE 434VNDSun NetTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-08-30
2025-08-30 04:15Z
CRIT

CVE-2025-54943 — Sun.net Ehrd_ctms: A missing authorization vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-54943

A missing authorization vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to perform unauthorized application deployment due to the absence of proper access control checks. CVSSv3.1 9.8 (CRITICAL) · EPSS 41th percentile

CWECWE 862VNDSun NetVNDSunnetTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-08-30
2025-08-30 04:15Z
CRIT

CVE-2025-54942 — Sun.net Ehrd_ctms: A missing authentication for critical function vulnerability in SUNNET Corporate Training Management System before

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-54942

A missing authentication for critical function vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to access deployment functionality without prior authentication. CVSSv3.1 9.8 (CRITICAL) · EPSS 40th percentile

CWECWE 306VNDSun NetTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-08-29
2025-08-29 23:15Z
CRIT

CVE-2025-58159 — Wegia Wegia: Prior to version 3.4.11, a remote code execution vulnerability was identified, caused by improper

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-58159

WeGIA is a Web manager for charitable institutions. Prior to version 3.4.11, a remote code execution vulnerability was identified, caused by improper validation of uploaded files. The application allows an attacker to upload files with arbitrary filenames, including those with a .php extension. Because the uploaded file is written directly to disk without adequate sanitization or extension restrictions, a spreadsheet file followed by PHP code can be uploaded and executed on t CVSSv3.1 9.9 (CRITICAL) · EPSS 54th percentile

CWECWE 434CWECWE 94VNDWegiaTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
728 × 90 / responsive · programmatic ad slot
2025-08-29
2025-08-29 22:15Z
CRIT

CVE-2025-58068 — Eventlet Eventlet: Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP Request Smuggling

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-58068

Eventlet is a concurrent networking library for Python. Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability could enable attackers to, bypass front-end security controls, launch targeted attacks against active site users, and poison web caches. This problem has been patched in Eventlet 0.40.3 by dropping trailers which is a breaking change if a backend behind eventlet.w CVSSv3.1 9.1 (CRITICAL) · EPSS 31th percentile

CWECWE 444VNDEventletTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2025-08-29
2025-08-29 20:15Z
CRIT

CVE-2024-46484 — Trendnet Tv-ip410_firmware: TV-IP410 vA1.0R was discovered to contain an OS command injection vulnerability via the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-46484

TRENDnet TV-IP410 vA1.0R was discovered to contain an OS command injection vulnerability via the /server/cgi-bin/testserv.cgi component. CVSSv3.1 9.8 (CRITICAL) · EPSS 63th percentile

CWECWE 78VNDTrendnetTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-08-29
2025-08-29 19:15Z
CRIT

CVE-2025-43773 — Liferay Digital_experience_platform: Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-43773

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 has a security vulnerability that allowing for improper access through the expandoTableLocalService. CVSSv3.1 9.1 (CRITICAL) · EPSS 20th percentile

CWECWE 862VNDLiferayTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2025-08-29
2025-08-29 18:15Z
HIGH

CVE-2025-9377 — Tp-link Tl-wr841n_firmware: The authenticated remote command execution (RCE) vulnerability exists in the Parental Control page on

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-9377in the wild

The authenticated remote command execution (RCE) vulnerability exists in the Parental Control page on TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9. This issue affects Archer C7(EU) V2: before 241108 and TL-WR841N/ND(MS) V9: before 241108. Both products have reached the status of EOL (end-of-life). It's recommending to purchase the new product to ensure better performance and security. If replacement is not an option in the short term, please use the second referenc CVSSv3.1 7.2 (HIGH) · EPSS 99th percentile

CWECWE 78VNDTp LinkVNDRceTYPVulnerabilitySTAitw exploited
7.2
CVSS v3.1
97
Edit Score
2025-08-29
2025-08-29 18:15Z
HIGH

CVE-2025-58158 — Harness: Implementation of upload git LFS file api is vulnerable to arbitrary file write.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-58158

Harness Open Source is an end-to-end developer platform with Source Control Management, CI/CD Pipelines, Hosted Developer Environments, and Artifact Registries. Prior to version 3.3.0, Open Source Harness git LFS server (Gitness) exposes api to retrieve and upload files via git LFS. Implementation of upload git LFS file api is vulnerable to arbitrary file write. Due to improper sanitization for upload path, a malicious authenticated user who has access to Harness Gitness serv CVSSv3.1 8.8 (HIGH) · EPSS 42th percentile

CWECWE 22CWECWE 73VNDHarnessTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-08-29
2025-08-29 18:15Z
CRIT

CVE-2025-52856 — Qnap Qvr: An improper authentication vulnerability has been reported to affect VioStor.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-52856

An improper authentication vulnerability has been reported to affect VioStor. If a remote attacker, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: VioStor 5.1.6 build 20250621 and later CVSSv3.1 9.8 (CRITICAL) · EPSS 50th percentile

CWECWE 287VNDQnapTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-08-29
2025-08-29 18:15Z
HIGH

CVE-2025-44015 — Qnap Hybriddesk_station: A command injection vulnerability has been reported to affect HybridDesk Station.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-44015

A command injection vulnerability has been reported to affect HybridDesk Station. If an attacker gains local network access, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.18 and later CVSSv3.1 8.4 (HIGH) · EPSS 59th percentile

CWECWE 77CWECWE 78VNDQnapTYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2025-08-29
2025-08-29 18:15Z
HIGH

CVE-2025-30278 — Qnap Qsync_central: An improper certificate validation vulnerability has been reported to affect Qsync Central.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-30278

An improper certificate validation vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.7 ( 2025/04/23 ) and later CVSSv3.1 8.8 (HIGH)

CWECWE 295VNDQnapTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-08-29
2025-08-29 18:15Z
HIGH

CVE-2025-30277 — Qnap Qsync_central: An improper certificate validation vulnerability has been reported to affect Qsync Central.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-30277

An improper certificate validation vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.7 ( 2025/04/23 ) and later CVSSv3.1 8.8 (HIGH) · EPSS 13th percentile

CWECWE 295VNDQnapTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-08-29
2025-08-29 18:15Z
HIGH

CVE-2025-30273 — Qnap Qts: An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-30273

An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify or corrupt memory. We have already fixed the vulnerability in the following versions: QTS 5.2.5.3145 build 20250526 and later QuTS hero h5.2.5.3138 build 20250519 and later CVSSv3.1 8.1 (HIGH) · EPSS 32th percentile

CWECWE 787VNDQnapTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-08-29
2025-08-29 18:15Z
HIGH

CVE-2025-30264 — Qnap Qts: A command injection vulnerability has been reported to affect several QNAP operating system versions.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-30264

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.5.3145 build 20250526 and later QuTS hero h5.2.5.3138 build 20250519 and later CVSSv3.1 8.8 (HIGH) · EPSS 58th percentile

CWECWE 77CWECWE 78VNDQnapTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-08-29
2025-08-29 18:15Z
HIGH

CVE-2025-29894 — Qnap Qsync_central: An SQL injection vulnerability has been reported to affect Qsync Central.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-29894

An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.7 ( 2025/04/23 ) and later CVSSv3.1 8.8 (HIGH) · EPSS 39th percentile

CWECWE 89VNDQnapTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-08-29
2025-08-29 18:15Z
HIGH

CVE-2025-29893 — Qnap Qsync_central: An SQL injection vulnerability has been reported to affect Qsync Central.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-29893

An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.7 ( 2025/04/23 ) and later CVSSv3.1 8.8 (HIGH) · EPSS 39th percentile

CWECWE 89VNDQnapTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-08-29
2025-08-29 16:15Z
MED

CVE-2025-55177 — Whatsapp Whatsapp: Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-55177in the wild

Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We assess that this vulnerability, in combination with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific CVSSv3.1 5.4 (MEDIUM) · EPSS 91th percentile

CWECWE 863VNDWhatsappVNDIncompleteTYPVulnerabilitySTAitw exploited
5.4
CVSS v3.1
78
Edit Score
2025-08-29
2025-08-29 11:15Z
HIGH

CVE-2024-13342 — Booster Booster_for_woocommerce: The Booster for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-13342

The Booster for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'add_files_to_order' function in all versions up to, and including, 7.2.4. This makes it possible for unauthenticated attackers to upload arbitrary files with double extensions on the affected site's server which may make remote code execution possible. This is only exploitable on select instances where the configuration will execute the first ex CVSSv3.1 8.1 (HIGH) · EPSS 53th percentile

CWECWE 434VNDBoosterTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-08-29
2025-08-29 04:15Z
CRIT

CVE-2025-8861 — TSA: developed by Changing has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-8861

TSA developed by Changing has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delete database contents. CVSSv3.1 9.8 (CRITICAL) · EPSS 43th percentile

CWECWE 306VNDTsaTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-08-29
2025-08-29 04:15Z
CRIT

CVE-2025-8857 — Clinic: Image System developed by Changing contains hard-coded Credentials, allowing unauthenticated remote attackers to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-8857

Clinic Image System developed by Changing contains hard-coded Credentials, allowing unauthenticated remote attackers to log into the system using administrator credentials embedded in the source code. CVSSv3.1 9.8 (CRITICAL) · EPSS 43th percentile

CWECWE 798VNDClinicTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-08-29
2025-08-29 03:15Z
CRIT

CVE-2025-9605 — Tenda Ac21_firmware: Such manipulation of the argument mac leads to stack-based buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-9605

A security vulnerability has been detected in Tenda AC21 and AC23 16.03.08.16. Affected is the function GetParentControlInfo of the file /goform/GetParentControlInfo. Such manipulation of the argument mac leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. CVSSv3.1 9.8 (CRITICAL) · EPSS 93th percentile

CWECWE 121CWECWE 119VNDTendaTYPVulnerability
9.8
CVSS v3.1
100
Edit Score