Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-23 01:32Z
2025-03-14
2025-03-14 12:15Z
CRIT

CVE-2024-13771 — Uxper Civi: The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-13771

The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.1.4. This is due to a lack of user validation before changing a password. This makes it possible for unauthenticated attackers to change the password of arbitrary users, including administrators, if the attacker knows the username of the victim. CVSSv3.1 9.8 (CRITICAL)

CWECWE 288CWECWE 306VNDUxperVNDCiviTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-03-13
2025-03-13 00:00Z
HIGH

AWS SNS Abuse: Data Exfiltration and Phishing

Elastic Security Labs·elastic.co

Elastic Security Labs published a detailed whitebox research demonstrating how adversaries can abuse AWS SNS for data exfiltration and phishing campaigns. The research includes practical attack workflows showing how compromised EC2 instances with SNS permissions can create topics, subscribe external email addresses, and exfiltrate sensitive data; it also references in-the-wild abuse by threat actors using SNS for bulk SMS phishing via the SNS Sender tool.

TACTA0001TACTA0002TACTA0006SRFCloudTACTA0010SWAws SnsVNDAwsTYPResearch
76
Edit Score
2025-03-12
2025-03-12 14:15Z
MED

CVE-2025-21590 — Juniper Junos: An Improper Isolation or Compartmentalization vulnerability in the kernel of Juniper Networks Junos OS

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-21590in the wild

An Improper Isolation or Compartmentalization vulnerability in the kernel of Juniper Networks Junos OS allows a local attacker with high privileges to compromise the integrity of the device. A local attacker with access to the shell is able to inject arbitrary code which can compromise an affected device. This issue is not exploitable from the Junos CLI. This issue affects Junos OS:  * All versions before 21.2R3-S9, * 21.4 versions before 21.4R3-S10,  * 22.2 vers CVSSv3.1 4.4 (MEDIUM) · EPSS 76th percentile

CWECWE 653VNDJuniperVNDIsolationTYPVulnerabilitySTAitw exploited
4.4
CVSS v3.1
73
Edit Score
2025-03-12
2025-03-12 10:15Z
HIGH

CVE-2025-21855 — Linux Linux_kernel: A race between reading skb->len and freeing the skb is possible (especially during LPM)

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-21855

In the Linux kernel, the following vulnerability has been resolved: ibmvnic: Don't reference skb after sending to VIOS Previously, after successfully flushing the xmit buffer to VIOS, the tx_bytes stat was incremented by the length of the skb. It is invalid to access the skb memory after sending the buffer to the VIOS because, at any point after sending, the VIOS can trigger an interrupt to free this memory. A race between reading skb->len and freeing the skb is possible ( CVSSv3.1 8.6 (HIGH) · EPSS 12th percentile

CWECWE 416TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2025-03-12
2025-03-12 10:15Z
CRIT

CVE-2025-21850 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: nvmet: Fix crash when

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-21850

In the Linux kernel, the following vulnerability has been resolved: nvmet: Fix crash when a namespace is disabled The namespace percpu counter protects pending I/O, and we can only safely diable the namespace once the counter drop to zero. Otherwise we end up with a crash when running blktests/nvme/058 (eg for loop transport): [ 2352.930426] [ T53909] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN PTI [ 2 CVSSv3.1 9.8 (CRITICAL) · EPSS 7th percentile

CWECWE 835TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-03-12
2025-03-12 08:15Z
HIGH

CVE-2024-58087 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix racy issue

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-58087

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix racy issue from session lookup and expire Increment the session reference count within the lock for lookup to avoid racy issue with session expire. CVSSv3.1 8.1 (HIGH)

CWECWE 667TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-03-11
2025-03-11 21:15Z
CRIT

CVE-2025-28915 — Upload: Unrestricted Upload of File with Dangerous Type vulnerability in Theme Egg ThemeEgg ToolKit themeegg-toolkit

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-28915

Unrestricted Upload of File with Dangerous Type vulnerability in Theme Egg ThemeEgg ToolKit themeegg-toolkit allows Upload a Web Shell to a Web Server.This issue affects ThemeEgg ToolKit: from n/a through <= 1.2.9. CVSSv3.1 9.1 (CRITICAL)

CWECWE 434TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
728 × 90 / responsive · programmatic ad slot
2025-03-11
2025-03-11 17:16Z
HIGH

CVE-2025-26633 — Microsoft Windows_10_1507: Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-26633in the wild

Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally. CVSSv3.1 7.0 (HIGH) · EPSS 98th percentile

CWECWE 707VNDMicrosoftTYPVulnerabilitySTAitw exploited
7.0
CVSS v3.1
94
Edit Score
2025-03-11
2025-03-11 17:16Z
HIGH

CVE-2025-24993 — Microsoft Windows_10_1507: Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-24993in the wild

Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally. CVSSv3.1 7.8 (HIGH) · EPSS 81th percentile

CWECWE 122VNDMicrosoftVNDHeapTYPVulnerabilitySTAitw exploited
7.8
CVSS v3.1
90
Edit Score
2025-03-11
2025-03-11 10:15Z
HIGH

CVE-2024-56182 — The affected devices have insufficient protection mechanism for the EFI(Extensible Firmware Interface) variables stored

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-56182

A vulnerability has been identified in SIMATIC Field PG M5 (All versions), SIMATIC Field PG M6 (All versions < V26.01.12), SIMATIC IPC BX-21A (All versions < V31.01.07), SIMATIC IPC BX-32A (All versions < V29.01.07), SIMATIC IPC BX-39A (All versions < V29.01.07), SIMATIC IPC BX-59A (All versions < V32.01.04), SIMATIC IPC PX-32A (All versions < V29.01.07), SIMATIC IPC PX-39A (All versions < V29.01.07), SIMATIC IPC PX-39A PRO (All versions < V29.01.07), SIMATIC IPC RC-543A (All CVSSv3.1 8.2 (HIGH)

CWECWE 693TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2025-03-11
2025-03-11 10:15Z
HIGH

CVE-2024-56181 — The affected devices have insufficient protection mechanism for the EFI(Extensible Firmware Interface) variables stored

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-56181

A vulnerability has been identified in SIMATIC Field PG M5 (All versions), SIMATIC IPC BX-21A (All versions < V31.01.07), SIMATIC IPC BX-32A (All versions < V29.01.07), SIMATIC IPC BX-39A (All versions < V29.01.07), SIMATIC IPC BX-59A (All versions < V32.01.04), SIMATIC IPC PX-32A (All versions < V29.01.07), SIMATIC IPC PX-39A (All versions < V29.01.07), SIMATIC IPC PX-39A PRO (All versions < V29.01.07), SIMATIC IPC RC-543A (All versions), SIMATIC IPC RC-543B (All versions < CVSSv3.1 8.2 (HIGH)

CWECWE 693TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2025-03-10
2025-03-10 15:15Z
CRIT

CVE-2025-26936 — Control: Improper Control of Generation of Code ('Code Injection') vulnerability in FRESHFACE Fresh Framework fresh-framework

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-26936

Improper Control of Generation of Code ('Code Injection') vulnerability in FRESHFACE Fresh Framework fresh-framework allows Code Injection.This issue affects Fresh Framework: from n/a through <= 1.70.0. CVSSv3.1 10.0 (CRITICAL)

CWECWE 94TYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2025-03-10
2025-03-10 15:15Z
CRIT

CVE-2025-26916 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-26916

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Pixflow Massive Dynamic massive-dynamic.This issue affects Massive Dynamic: from n/a through <= 8.2. CVSSv3.1 9.0 (CRITICAL)

CWECWE 98TYPVulnerability
9.0
CVSS v3.1
95
Edit Score
2025-03-06
2025-03-06 17:15Z
CRIT

CVE-2025-21829 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix the warning

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-21829

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix the warning "__rxe_cleanup+0x12c/0x170 [rdma_rxe]" The Call Trace is as below: " <TASK> ? show_regs.cold+0x1a/0x1f ? __rxe_cleanup+0x12c/0x170 [rdma_rxe] ? __warn+0x84/0xd0 ? __rxe_cleanup+0x12c/0x170 [rdma_rxe] ? report_bug+0x105/0x180 ? handle_bug+0x46/0x80 ? exc_invalid_op+0x19/0x70 ? asm_exc_invalid_op+0x1b/0x20 ? __rxe_cleanup+0x12c/0x170 [rdma_rxe] ? __rxe_cleanup+0 CVSSv3.1 9.8 (CRITICAL) · EPSS 7th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-03-06
2025-03-06 16:15Z
HIGH

CVE-2025-21828 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't flush

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-21828

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't flush non-uploaded STAs If STA state is pre-moved to AUTHORIZED (such as in IBSS scenarios) and insertion fails, the station is freed. In this case, the driver never knew about the station, so trying to flush it is unexpected and may crash. Check if the sta was uploaded to the driver before and fix this. CVSSv3.1 8.8 (HIGH) · EPSS 7th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-03-06
2025-03-06 14:15Z
CRIT

CVE-2024-12144 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-12144

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Finder Fire Safety Finder ERP/CRM (Old System) allows SQL Injection. This issue affects Finder ERP/CRM (Old System): before 18.12.2024. CVSSv3.1 9.8 (CRITICAL) · EPSS 21th percentile

CWECWE 89TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-03-05
2025-03-05 14:15Z
CRIT

CVE-2024-13147 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-13147

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Merkur Software B2B Login Panel allows SQL Injection. This issue affects B2B Login Panel: before 15.01.2025. CVSSv3.1 9.8 (CRITICAL) · EPSS 30th percentile

CWECWE 89TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-03-05
2025-03-05 14:15Z
CRIT

CVE-2024-12097 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-12097

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Boceksoft Informatics E-Travel allows SQL Injection. This issue affects E-Travel: before 15.12.2024. CVSSv3.1 9.8 (CRITICAL) · EPSS 30th percentile

CWECWE 89TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-03-05
2025-03-05 12:15Z
CRIT

CVE-2024-12281 — Homey: The Homey theme for WordPress is vulnerable to privilege escalation in all versions up

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-12281

The Homey theme for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.4.2. This is due to the plugin allowing users who are registering new accounts to set their own role. This makes it possible for unauthenticated attackers to gain elevated privileges by creating an account with the Administrator, Editor, or Shop Manager role. CVSSv3.1 9.8 (CRITICAL)

CWECWE 269VNDHomeyTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-03-05
2025-03-05 10:15Z
HIGH

CVE-2025-0956 — WooCommerce: The WooCommerce Recover Abandoned Cart plugin for WordPress is vulnerable to PHP Object Injection

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-0956

The WooCommerce Recover Abandoned Cart plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 24.4.0 via deserialization of untrusted input from the 'raccookie_guest_email' cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the sit CVSSv3.1 8.1 (HIGH)

CWECWE 502VNDWoocommerceTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-03-04
2025-03-04 22:15Z
CRIT

CVE-2025-26319 — Flowiseai Flowise: v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-26319

FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments. CVSSv3.1 9.8 (CRITICAL) · EPSS 99th percentile

CWECWE 434VNDFlowiseaiTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2025-03-04
2025-03-04 16:15Z
HIGH

CVE-2025-23368 — Redhat Wildfly_core: The component does not implement sufficient measures to prevent multiple failed authentication attempts within

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-23368

A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI. CVSSv3.1 8.1 (HIGH) · EPSS 40th percentile

CWECWE 307VNDWildflyTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-03-04
2025-03-04 15:15Z
HIGH

CVE-2024-9149 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-9149

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wind Media E-Commerce Website Template allows SQL Injection. This issue affects E-Commerce Website Template: before v1.5. CVSSv3.1 8.6 (HIGH) · EPSS 22th percentile

CWECWE 89TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2025-03-04
2025-03-04 14:15Z
HIGH

CVE-2025-1943 — Mozilla Firefox: Some of these bugs showed evidence of memory corruption and we presume that with

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-1943

Memory safety bugs present in Firefox 135 and Thunderbird 135. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 136 and Thunderbird 136. CVSSv3.1 8.2 (HIGH)

CWECWE 122VNDMozillaTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2025-03-04
2025-03-04 14:15Z
CRIT

CVE-2025-1942 — Mozilla Firefox: When String.toUpperCase() caused a string to get longer it was possible for uninitialized memory

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-1942

When String.toUpperCase() caused a string to get longer it was possible for uninitialized memory to be incorporated into the result string. This vulnerability was fixed in Firefox 136 and Thunderbird 136. CVSSv3.1 9.8 (CRITICAL)

CWECWE 908VNDMozillaTYPVulnerability
9.8
CVSS v3.1
99
Edit Score