Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-22 03:28Z
2025-06-18
2025-06-18 11:15Z
HIGH

CVE-2022-50098 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix crash

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-50098

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts Ensure SRB is returned during I/O timeout error escalation. If that is not possible fail the escalation path. Following crash stack was seen: BUG: unable to handle kernel paging request at 0000002f56aa90f8 IP: qla_chk_edif_rx_sa_delete_pending+0x14/0x30 [qla2xxx] Call Trace: ? qla2x00_status_entry+0x19f/0x1c50 [qla2xxx] ? qla2x00_start CVSSv3.1 8.8 (HIGH) · EPSS 11th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-06-18
2025-06-18 11:15Z
HIGH

CVE-2022-49974 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: fix rumble

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-49974

In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: fix rumble worker null pointer deref We can dereference a null pointer trying to queue work to a destroyed workqueue. If the device is disconnected, nintendo_hid_remove is called, in which the rumble_queue is destroyed. Avoid using that queue to defer rumble work once the controller state is set to JOYCON_CTLR_STATE_REMOVED. This eliminates the null pointer dereference. CVSSv3.1 8.8 (HIGH) · EPSS 8th percentile

CWECWE 476TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-06-18
2025-06-18 11:15Z
HIGH

CVE-2022-49968 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: ieee802154/adf7242: defer destroy_workqueue call

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-49968

In the Linux kernel, the following vulnerability has been resolved: ieee802154/adf7242: defer destroy_workqueue call There is a possible race condition (use-after-free) like below (FREE) | (USE) adf7242_remove | adf7242_channel cancel_delayed_work_sync | destroy_workqueue (1) | adf7242_cmd_rx | mod_delayed_work (2) | The root cause for this race is that the uppe CVSSv3.1 8.0 (HIGH) · EPSS 3th percentile

CWECWE 416CWECWE 362TYPVulnerability
8.0
CVSS v3.1
90
Edit Score
2025-06-18
2025-06-18 11:15Z
HIGH

CVE-2022-49934 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Fix UAF

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-49934

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Fix UAF in ieee80211_scan_rx() ieee80211_scan_rx() tries to access scan_req->flags after a null check, but a UAF is observed when the scan is completed and __ieee80211_scan_completed() executes, which then calls cfg80211_scan_done() leading to the freeing of scan_req. Since scan_req is rcu_dereference()'d, prevent the racing in __ieee80211_scan_completed() by ensuring that from mac80211's P CVSSv3.1 8.8 (HIGH) · EPSS 5th percentile

CWECWE 416TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-06-18
2025-06-18 10:15Z
CRIT

CVE-2025-38075 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-38075

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix timeout on deleted connection NOPIN response timer may expire on a deleted connection and crash with such logs: Did not receive response to NOPIN on CID: 0, failing connection for I_T Nexus (null),i,0x00023d000125,iqn.2017-01.com.iscsi.target,t,0x3d BUG: Kernel NULL pointer dereference on read at 0x00000000 NIP strlcpy+0x8/0xb0 LR iscsit_fill_cxn_timeout_err_stats+0x5c/0xc0 [iscs CVSSv3.1 9.8 (CRITICAL) · EPSS 6th percentile

CWECWE 476TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-06-18
2025-06-18 10:15Z
HIGH

CVE-2025-38074 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: protect vq->log_used with

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-38074

In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: protect vq->log_used with vq->mutex The vhost-scsi completion path may access vq->log_base when vq->log_used is already set to false. vhost-thread QEMU-thread vhost_scsi_complete_cmd_work() -> vhost_add_used() -> vhost_add_used_n() if (unlikely(vq->log_used)) QEMU disables vq->log_used CVSSv3.1 8.8 (HIGH) · EPSS 6th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-06-18
2025-06-18 10:15Z
HIGH

CVE-2025-38052 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: net/tipc: fix slab-use-after-free Read

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-38052

In the Linux kernel, the following vulnerability has been resolved: net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done Syzbot reported a slab-use-after-free with the following call trace: ================================================================== BUG: KASAN: slab-use-after-free in tipc_aead_encrypt_done+0x4bd/0x510 net/tipc/crypto.c:840 Read of size 8 at addr ffff88807a733000 by task kworker/1:0/25 Call Trace: kasan_report+0xd9/0x110 mm/ka CVSSv3.1 8.8 (HIGH) · EPSS 7th percentile

CWECWE 416TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
728 × 90 / responsive · programmatic ad slot
2025-06-18
2025-06-18 10:15Z
HIGH

CVE-2025-38016 — Linux Linux_kernel: This leads to a bug that unplugging certain types of HID devices causes a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-38016

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: abort dispatch if device destroyed The current HID bpf implementation assumes no output report/request will go through it after hid_bpf_destroy_device() has been called. This leads to a bug that unplugging certain types of HID devices causes a cleaned- up SRCU to be accessed. The bug was previously a hidden failure until a recent x86 percpu change [1] made it access not-present pages. The bug wil CVSSv3.1 8.8 (HIGH) · EPSS 6th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-06-18
2025-06-18 00:00Z
HIGH

A Wretch Client: From ClickFix deception to information stealer deployment

Elastic Security Labs·elastic.coin the wild

Elastic Security Labs analyzed a multi-stage ClickFix campaign deploying GHOSTPULSE loader and ARECHCLIENT2 infostealer. The attack chain begins with fake CAPTCHA pages that trick users into executing malicious PowerShell, followed by DLL sideloading to load GHOSTPULSE, which then deploys a .NET loader that reflectively loads ARECHCLIENT2 in memory. The campaign demonstrates active infrastructure with 120+ C2 servers across multiple ASNs, targeting credential theft, financial data, and remote access.

SRFApplicationSRFOsTACTA0005TACTA0001TACTA0002TACTA0006TACTA0007TACTA0009
82
Edit Score
2025-06-17
2025-06-17 15:15Z
HIGH

CVE-2025-49879 — Limitation: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in themezaa

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-49879

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in themezaa Litho litho allows Path Traversal.This issue affects Litho: from n/a through <= 3.0. CVSSv3.1 8.6 (HIGH)

CWECWE 22TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2025-06-17
2025-06-17 15:15Z
HIGH

CVE-2025-49508 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-49508

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LoftOcean CozyStay cozystay allows PHP Local File Inclusion.This issue affects CozyStay: from n/a through < 1.7.1. CVSSv3.1 8.1 (HIGH)

CWECWE 98TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-06-17
2025-06-17 15:15Z
CRIT

CVE-2025-49452 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-49452

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Adrian Ladó PostaPanduri postapanduri allows SQL Injection.This issue affects PostaPanduri: from n/a through <= 2.1.3. CVSSv3.1 9.3 (CRITICAL)

CWECWE 89TYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2025-06-17
2025-06-17 15:15Z
CRIT

CVE-2025-49447 — Upload: Unrestricted Upload of File with Dangerous Type vulnerability in Fastw3b LLC FW Food Menu

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-49447

Unrestricted Upload of File with Dangerous Type vulnerability in Fastw3b LLC FW Food Menu fw-food-menu allows Using Malicious Files.This issue affects FW Food Menu : from n/a through <= 6.0.0. CVSSv3.1 10.0 (CRITICAL)

CWECWE 434TYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2025-06-17
2025-06-17 15:15Z
CRIT

CVE-2025-49444 — Upload: Unrestricted Upload of File with Dangerous Type vulnerability in merkulove Reformer for Elementor reformer-elementor

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-49444

Unrestricted Upload of File with Dangerous Type vulnerability in merkulove Reformer for Elementor reformer-elementor allows Upload a Web Shell to a Web Server.This issue affects Reformer for Elementor: from n/a through <= 1.0.5. CVSSv3.1 10.0 (CRITICAL)

CWECWE 434TYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2025-06-17
2025-06-17 15:15Z
HIGH

CVE-2025-49415 — Limitation: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Fastw3b

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-49415

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Fastw3b LLC FW Gallery fw-gallery allows Path Traversal.This issue affects FW Gallery: from n/a through <= 8.0.0. CVSSv3.1 8.6 (HIGH)

CWECWE 22TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2025-06-17
2025-06-17 15:15Z
CRIT

CVE-2025-49330 — Deserialization: of Untrusted Data vulnerability in CRM Perks Integration for Contact Form 7 and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-49330

Deserialization of Untrusted Data vulnerability in CRM Perks Integration for Contact Form 7 and Zoho CRM, Bigin cf7-zoho allows Object Injection.This issue affects Integration for Contact Form 7 and Zoho CRM, Bigin: from n/a through <= 1.3.0. CVSSv3.1 9.8 (CRITICAL)

CWECWE 502TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-06-17
2025-06-17 15:15Z
HIGH

CVE-2025-49261 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-49261

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Diza diza allows PHP Local File Inclusion.This issue affects Diza: from n/a through <= 1.3.8. CVSSv3.1 8.1 (HIGH)

CWECWE 98TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-06-17
2025-06-17 15:15Z
HIGH

CVE-2025-49260 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-49260

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Aora aora allows PHP Local File Inclusion.This issue affects Aora: from n/a through <= 1.3.9. CVSSv3.1 8.1 (HIGH)

CWECWE 98TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-06-17
2025-06-17 15:15Z
HIGH

CVE-2025-49259 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-49259

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Hara hara allows PHP Local File Inclusion.This issue affects Hara: from n/a through <= 1.2.10. CVSSv3.1 8.1 (HIGH)

CWECWE 98TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-06-17
2025-06-17 15:15Z
HIGH

CVE-2025-49258 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-49258

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Maia maia allows PHP Local File Inclusion.This issue affects Maia: from n/a through <= 1.1.15. CVSSv3.1 8.1 (HIGH)

CWECWE 98TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-06-17
2025-06-17 15:15Z
HIGH

CVE-2025-49257 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-49257

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Zota zota allows PHP Local File Inclusion.This issue affects Zota: from n/a through <= 1.3.8. CVSSv3.1 8.1 (HIGH)

CWECWE 98TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-06-17
2025-06-17 15:15Z
HIGH

CVE-2025-49256 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-49256

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Sapa sapa allows PHP Local File Inclusion.This issue affects Sapa: from n/a through <= 1.1.14. CVSSv3.1 8.1 (HIGH)

CWECWE 98TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-06-17
2025-06-17 15:15Z
HIGH

CVE-2025-49255 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-49255

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Ruza ruza allows PHP Local File Inclusion.This issue affects Ruza: from n/a through <= 1.0.7. CVSSv3.1 8.1 (HIGH)

CWECWE 98TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-06-17
2025-06-17 15:15Z
HIGH

CVE-2025-49254 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-49254

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Nika nika allows PHP Local File Inclusion.This issue affects Nika: from n/a through <= 1.2.8. CVSSv3.1 8.1 (HIGH)

CWECWE 98TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-06-17
2025-06-17 15:15Z
HIGH

CVE-2025-49253 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-49253

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Lasa lasa allows PHP Local File Inclusion.This issue affects Lasa: from n/a through <= 1.1. CVSSv3.1 8.1 (HIGH)

CWECWE 98TYPVulnerability
8.1
CVSS v3.1
91
Edit Score