Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-22 14:19Z
2025-04-29
2025-04-29 14:15Z
HIGH

CVE-2025-4091 — Mozilla Firefox: Some of these bugs showed evidence of memory corruption and we presume that with

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-4091

Memory safety bugs present in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 138, Firefox ESR 128.10, Thunderbird 138, and Thunderbird 128.10. CVSSv3.1 8.1 (HIGH)

CWECWE 119VNDMozillaTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-04-29
2025-04-29 14:15Z
CRIT

CVE-2025-4083 — Mozilla Firefox: A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-4083

A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level document's process instead of the intended frame, potentially enabling a sandbox escape. This vulnerability was fixed in Firefox 138, Firefox ESR 128.10, Firefox ESR 115.23, Thunderbird 138, and Thunderbird 128.10. CVSSv3.1 9.1 (CRITICAL)

CWECWE 653VNDMozillaVNDThunderbirdTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2025-04-29
2025-04-29 14:15Z
HIGH

CVE-2025-2817 — Mozilla Firefox: By injecting code into the user-privileged process, an attacker could bypass intended access controls

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-2817

Thunderbird's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By injecting code into the user-privileged process, an attacker could bypass intended access controls, allowing SYSTEM-level file operations on paths controlled by a non-privileged user and enabling privilege escalation. This vulnerability was fixed in Firefox 138, Firefox ESR 128.10, Firefox ESR 115.23, Thunderbird 138, CVSSv3.1 8.8 (HIGH)

CWECWE 22VNDMozillaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-04-29
2025-04-29 12:15Z
HIGH

CVE-2024-58099 — Linux Linux_kernel: via vmxnet3_run_xdp() through vmxnet3_xdp_xmit_back() calculates an incorrect DMA address: page = virt_to_page(xdpf->data); tbi->dma_addr =

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-58099

In the Linux kernel, the following vulnerability has been resolved: vmxnet3: Fix packet corruption in vmxnet3_xdp_xmit_frame Andrew and Nikolay reported connectivity issues with Cilium's service load-balancing in case of vmxnet3. If a BPF program for native XDP adds an encapsulation header such as IPIP and transmits the packet out the same interface, then in case of vmxnet3 a corrupted packet is being sent and subsequently dropped on the path. vmxnet3_xdp_xmit_frame() whi CVSSv3.1 8.6 (HIGH)

CWECWE 787TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2025-04-28
2025-04-28 20:15Z
CRIT

CVE-2025-45953 — Phpgurukul Hostel_management_system: Improper handling of session data allows a Session Hijacking attack, exploitable remotely

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-45953

A vulnerability was found in PHPGurukul Hostel Management System 2.1 in the /hostel/change-password.php file of the user panel - Change Password component. Improper handling of session data allows a Session Hijacking attack, exploitable remotely CVSSv3.1 9.1 (CRITICAL) · EPSS 30th percentile

CWECWE 384VNDPhpgurukulTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2025-04-28
2025-04-28 20:15Z
CRIT

CVE-2025-45949 — Phpgurukul User_registration_\&_login_and_user_management_system: Improper handling of session data allows a Session Hijacking attack, exploitable remotely and leading

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-45949

A critical vulnerability was found in PHPGurukul User Registration & Login and User Management System V3.3 in the /loginsystem/change-password.php file of the user panel - Change Password component. Improper handling of session data allows a Session Hijacking attack, exploitable remotely and leading to account takeover. CVSSv3.1 9.8 (CRITICAL) · EPSS 36th percentile

CWECWE 384VNDPhpgurukulTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-04-28
2025-04-28 20:15Z
CRIT

CVE-2025-45947 — Phpgurukul Online_banquet_booking_system: An issue in phpgurukul Online Banquet Booking System V1.2 allows an attacker to execute

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-45947

An issue in phpgurukul Online Banquet Booking System V1.2 allows an attacker to execute arbitrary code via the /obbs/change-password.php file of the My Account - Change Password component CVSSv3.1 9.8 (CRITICAL) · EPSS 47th percentile

CWECWE 94VNDPhpgurukulVNDOnlineTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
728 × 90 / responsive · programmatic ad slot
2025-04-25
2025-04-25 16:15Z
HIGH

CVE-2025-3928 — Commvault Commvault: Web Server has an unspecified vulnerability that can be exploited by a remote

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-3928in the wild

Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on 2025-04-28. CVSSv3.1 8.8 (HIGH) · EPSS 83th percentile

CWECWE 94VNDCommvaultTYPVulnerabilitySTAitw exploited
8.8
CVSS v3.1
95
Edit Score
2025-04-25
2025-04-25 15:15Z
CRIT

CVE-2025-32432 — Craftcms Craft_cms: Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-32432in the wild

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892. CVSSv3.1 10.0 (CRITICAL) · EPSS 100th percentile

CWECWE 94VNDCraftVNDCraftcmsTYPVulnerabilitySTAitw exploited
10.0
CVSS v3.1
100
Edit Score
2025-04-24
2025-04-24 17:15Z
CRIT

CVE-2025-31324 — Sap Netweaver: Visual Composer Metadata Uploader is not protected with a proper authorization, allowing

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-31324in the wild

SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system. CVSSv3.1 10.0 (CRITICAL) · EPSS 100th percentile

CWECWE 434VNDSapTYPVulnerabilitySTAitw exploited
10.0
CVSS v3.1
100
Edit Score
2025-04-24
2025-04-24 16:15Z
CRIT

CVE-2025-46264 — Upload: Unrestricted Upload of File with Dangerous Type vulnerability in blubrry PowerPress Podcasting powerpress allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-46264

Unrestricted Upload of File with Dangerous Type vulnerability in blubrry PowerPress Podcasting powerpress allows Upload a Web Shell to a Web Server.This issue affects PowerPress Podcasting: from n/a through <= 11.12.5. CVSSv3.1 9.9 (CRITICAL)

CWECWE 434TYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2025-04-24
2025-04-24 16:15Z
CRIT

CVE-2025-46248 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-46248

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard allows SQL Injection.This issue affects Frontend Dashboard: from n/a through <= 2.2.5. CVSSv3.1 9.3 (CRITICAL)

CWECWE 89TYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2025-04-24
2025-04-24 16:15Z
HIGH

CVE-2025-39377 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-39377

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs Appsero Helper appsero-helper allows SQL Injection.This issue affects Appsero Helper: from n/a through <= 1.3.4. CVSSv3.1 8.5 (HIGH)

CWECWE 89TYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2025-04-24
2025-04-24 13:00Z
HIGH

SonicWall Sonicos Versions 7.1.x and 8.0.x

Bishop Fox Labs·bishopfox.comCVE-2025-32818

Bishop Fox disclosed CVE-2025-32818, a remote unauthenticated denial-of-service vulnerability in SonicWall SonicOS 7.1.x and 8.0.x affecting the SSL VPN interface. A null pointer dereference in the SSL VPN web server can be triggered via crafted HTTP POST requests to specific endpoints, causing a segmentation fault and forcing the appliance to reboot. SonicWall released patches (versions 7.2.0 and 8.0.1) on April 23, 2025.

SRFNetwork ApplianceTACTA0040VNDSonicwallTYPVulnerabilityTYPAdvisorySTGInitial AccessSTGImpactTECT1499
72
Edit Score
2025-04-24
2025-04-24 09:15Z
HIGH

CVE-2025-3607 — Frontend: The Frontend Login and Registration Blocks plugin for WordPress is vulnerable to privilege escalation

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-3607

The Frontend Login and Registration Blocks plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.8. This is due to the plugin not properly validating a user's identity prior to updating a password. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account. CVSSv3.1 8.8 (HIGH)

CWECWE 620VNDFrontendTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-04-24
2025-04-24 09:15Z
CRIT

CVE-2025-3604 — Flynax Flynax_bridge: The Flynax Bridge plugin for WordPress is vulnerable to privilege escalation via account takeover

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-3604

The Flynax Bridge plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.2.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account. CVSSv3.1 9.8 (CRITICAL)

CWECWE 862VNDFlynaxTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-04-24
2025-04-24 09:15Z
CRIT

CVE-2025-3603 — Flynax Flynax_bridge: The Flynax Bridge plugin for WordPress is vulnerable to privilege escalation via account takeover

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-3603

The Flynax Bridge plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.2.0. This is due to the plugin not properly validating a user's identity prior to updating their details like password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account. CVSSv3.1 9.8 (CRITICAL)

CWECWE 620VNDFlynaxTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-04-24
2025-04-24 09:15Z
HIGH

CVE-2025-3058 — Xelion: The Xelion Webchat plugin for WordPress is vulnerable to unauthorized modification of data that

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-3058

The Xelion Webchat plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the xwc_save_settings() function in all versions up to, and including, 9.1.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable CVSSv3.1 8.8 (HIGH)

CWECWE 862VNDXelionTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-04-22
2025-04-22 12:22Z
HIGH

New Pacu Module: Secret Enumeration in Elastic Beanstalk

Rhino Security Labs·rhinosecuritylabs.com

Rhino Security Labs released a new Pacu module (elasticbeanstalk__enum) that automates enumeration of AWS Elastic Beanstalk applications, environments, configuration settings, and source code to discover hardcoded secrets and credentials. The module addresses a gap in AWS penetration testing tooling by streamlining the discovery of sensitive data stored in environment properties, configuration files, and application source code—a common misconfiguration that enables lateral movement and privilege escalation.

TACTA0007SRFCloudVNDAwsVNDPacuTYPResearchTYPToolSTGCred AccessSTGRecon
76
Edit Score
2025-04-22
2025-04-22 12:00Z
HIGH

Phishing for Codes: Russian Threat Actors Target Microsoft 365 OAuth Workflows

Volexity·volexity.comin the wild

Volexity reports on two Russian threat actor groups (UTA0352, UTA0355) conducting targeted OAuth phishing campaigns against Microsoft 365 users since March 2025, pivoting from Device Code Authentication attacks to abuse of legitimate M365 OAuth workflows. Attackers use social engineering via Signal/WhatsApp impersonating European diplomats and Ukrainian officials, tricking victims into sharing OAuth authorization codes that grant account access and, in UTA0355's case, device registration for persistent access.

TACTA0001TACTA0006SRFIdentitySRFCloudVNDMicrosoftTYPResearchTYPThreat IntelSTGInitial Access
82
Edit Score
2025-04-22
2025-04-22 10:15Z
HIGH

CVE-2025-46241 — Codepeople Appointment_booking_calendar: Cross-Site Request Forgery (CSRF) vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows SQL Injection.T

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-46241

Cross-Site Request Forgery (CSRF) vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows SQL Injection.This issue affects Appointment Booking Calendar: from n/a through <= 1.3.92. CVSSv3.1 8.2 (HIGH)

CWECWE 352VNDCodepeopleTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2025-04-21
2025-04-21 15:15Z
CRIT

CVE-2025-29287 — Mingsoft Mcms: An arbitrary file upload vulnerability in the ueditor component of MCMS v5.4.3 allows attackers

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-29287

An arbitrary file upload vulnerability in the ueditor component of MCMS v5.4.3 allows attackers to execute arbitrary code via uploading a crafted file. CVSSv3.1 9.8 (CRITICAL) · EPSS 50th percentile

CWECWE 434VNDMingsoftTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-04-18
2025-04-18 18:15Z
MED

CVE-2025-29513 — Nodebb Nodebb: Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to store

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-29513

Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to store arbitrary code in the admin API Access token generator. CVSSv3.1 6.1 (MEDIUM) · EPSS 95th percentile

CWECWE 79VNDNodebbTYPVulnerability
6.1
CVSS v3.1
84
Edit Score
2025-04-18
2025-04-18 07:15Z
HIGH

CVE-2025-39930 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: ASoC: simple-card-utils: Don't use

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-39930

In the Linux kernel, the following vulnerability has been resolved: ASoC: simple-card-utils: Don't use __free(device_node) at graph_util_parse_dai() commit 419d1918105e ("ASoC: simple-card-utils: use __free(device_node) for device node") uses __free(device_node) for dlc->of_node, but we need to keep it while driver is in use. Don't use __free(device_node) in graph_util_parse_dai(). CVSSv3.1 8.4 (HIGH) · EPSS 13th percentile

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2025-04-18
2025-04-18 05:15Z
CRIT

CVE-2025-39471 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-39471

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in pantherius Modal Survey modal-survey.This issue affects Modal Survey: from n/a through <= 2.0.2.0.1. CVSSv3.1 9.3 (CRITICAL)

CWECWE 89TYPVulnerability
9.3
CVSS v3.1
97
Edit Score