Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-23 04:30Z
2025-02-26
2025-02-26 07:00Z
CRIT

CVE-2022-49149 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix call timer

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-49149

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix call timer start racing with call destruction The rxrpc_call struct has a timer used to handle various timed events relating to a call. This timer can get started from the packet input routines that are run in softirq mode with just the RCU read lock held. Unfortunately, because only the RCU read lock is held - and neither ref or other lock is taken - the call can start getting destroyed at the CVSSv3.1 9.8 (CRITICAL) · EPSS 7th percentile

CWECWE 362TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-02-26
2025-02-26 07:00Z
HIGH

CVE-2022-49138 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: Ignore multiple

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-49138

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: Ignore multiple conn complete events When one of the three connection complete events is received multiple times for the same handle, the device is registered multiple times which leads to memory corruptions. Therefore, consequent events for a single connection are ignored. The conn->state can hold different values, therefore HCI_CONN_HANDLE_UNSET is introduced to identify new connect CVSSv3.1 8.8 (HIGH) · EPSS 28th percentile

CWECWE 476TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-02-26
2025-02-26 07:00Z
HIGH

CVE-2022-49114 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: scsi: libfc: Fix use

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-49114

In the Linux kernel, the following vulnerability has been resolved: scsi: libfc: Fix use after free in fc_exch_abts_resp() fc_exch_release(ep) will decrease the ep's reference count. When the reference count reaches zero, it is freed. But ep is still used in the following code, which will lead to a use after free. Return after the fc_exch_release() call to avoid use after free. CVSSv3.1 8.8 (HIGH) · EPSS 22th percentile

CWECWE 416TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-02-26
2025-02-26 07:00Z
HIGH

CVE-2022-49111 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use after

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-49111

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use after free in hci_send_acl This fixes the following trace caused by receiving HCI_EV_DISCONN_PHY_LINK_COMPLETE which does call hci_conn_del without first checking if conn->type is in fact AMP_LINK and in case it is do properly cleanup upper layers with hci_disconn_cfm: ================================================================== BUG: KASAN: use-after-free in hci_send_acl+0xaba CVSSv3.1 8.8 (HIGH) · EPSS 17th percentile

CWECWE 416TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-02-26
2025-02-26 07:00Z
CRIT

CVE-2022-49094 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: net/tls: fix slab-out-of-bounds bug

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-49094

In the Linux kernel, the following vulnerability has been resolved: net/tls: fix slab-out-of-bounds bug in decrypt_internal The memory size of tls_ctx->rx.iv for AES128-CCM is 12 setting in tls_set_sw_offload(). The return value of crypto_aead_ivsize() for "ccm(aes)" is 16. So memcpy() require 16 bytes from 12 bytes memory space will trigger slab-out-of-bounds bug as following: ================================================================== BUG: KASAN: slab-out-of-bound CVSSv3.1 9.8 (CRITICAL) · EPSS 16th percentile

CWECWE 125TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-02-26
2025-02-26 07:00Z
CRIT

CVE-2022-49093 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: skbuff: fix coalescing for

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-49093

In the Linux kernel, the following vulnerability has been resolved: skbuff: fix coalescing for page_pool fragment recycling Fix a use-after-free when using page_pool with page fragments. We encountered this problem during normal RX in the hns3 driver: (1) Initially we have three descriptors in the RX queue. The first one allocates PAGE1 through page_pool, and the other two allocate one half of PAGE2 each. Page references look like this: RX_BD1 ____ CVSSv3.1 9.8 (CRITICAL) · EPSS 17th percentile

CWECWE 416TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-02-26
2025-02-26 07:00Z
HIGH

CVE-2022-49075 — Linux Linux_kernel: btrfs quota enable $MNT btrfs qgroup limit 2G $MNT # Try to fallocate a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-49075

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix qgroup reserve overflow the qgroup limit We use extent_changeset->bytes_changed in qgroup_reserve_data() to record how many bytes we set for EXTENT_QGROUP_RESERVED state. Currently the bytes_changed is set as "unsigned int", and it will overflow if we try to fallocate a range larger than 4GiB. The result is we reserve less bytes and eventually break the qgroup limit. Unlike regular buffered/dire CVSSv3.1 8.1 (HIGH) · EPSS 16th percentile

CWECWE 190TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
728 × 90 / responsive · programmatic ad slot
2025-02-26
2025-02-26 07:00Z
CRIT

CVE-2022-49058 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: cifs: potential buffer overflow

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-49058

In the Linux kernel, the following vulnerability has been resolved: cifs: potential buffer overflow in handling symlinks Smatch printed a warning: arch/x86/crypto/poly1305_glue.c:198 poly1305_update_arch() error: __memcpy() 'dctx->buf' too small (16 vs u32max) It's caused because Smatch marks 'link_len' as untrusted since it comes from sscanf(). Add a check to ensure that 'link_len' is not larger than the size of the 'link_str' buffer. CVSSv3.1 9.1 (CRITICAL) · EPSS 25th percentile

CWECWE 120TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2025-02-25
2025-02-25 15:15Z
HIGH

CVE-2025-26985 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-26985

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Majestic Support Majestic Support majestic-support allows PHP Local File Inclusion.This issue affects Majestic Support: from n/a through <= 1.0.6. CVSSv3.1 8.1 (HIGH)

CWECWE 98TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-02-25
2025-02-25 15:15Z
CRIT

CVE-2025-26974 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-26974

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPExperts.io WP Multistore Locator wp-multi-store-locator allows Blind SQL Injection.This issue affects WP Multistore Locator: from n/a through <= 2.5.1. CVSSv3.1 9.3 (CRITICAL)

CWECWE 89TYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2025-02-25
2025-02-25 15:15Z
CRIT

CVE-2025-26966 — Authentication: Bypass Using an Alternate Path or Channel vulnerability in Aldo Latino PrivateContent private-content.This

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-26966

Authentication Bypass Using an Alternate Path or Channel vulnerability in Aldo Latino PrivateContent private-content.This issue affects PrivateContent: from n/a through <= 8.11.5. CVSSv3.1 9.8 (CRITICAL) · EPSS 2th percentile

CWECWE 288TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-02-25
2025-02-25 15:15Z
CRIT

CVE-2025-26943 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-26943

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jürgen Müller Easy Quotes easy-quotes allows Blind SQL Injection.This issue affects Easy Quotes: from n/a through <= 1.2.2. CVSSv3.1 9.3 (CRITICAL)

CWECWE 89TYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2025-02-25
2025-02-25 15:15Z
HIGH

CVE-2025-26915 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-26915

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PickPlugins Wishlist wishlist allows SQL Injection.This issue affects Wishlist: from n/a through <= 1.0.41. CVSSv3.1 8.5 (HIGH)

CWECWE 89TYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2025-02-25
2025-02-25 15:15Z
CRIT

CVE-2025-26900 — Deserialization: of Untrusted Data vulnerability in flexmls Flexmls® IDX flexmls-idx allows Object Injection.This issue

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-26900

Deserialization of Untrusted Data vulnerability in flexmls Flexmls® IDX flexmls-idx allows Object Injection.This issue affects Flexmls® IDX: from n/a through <= 3.14.27. CVSSv3.1 9.8 (CRITICAL)

CWECWE 502TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-02-25
2025-02-25 15:15Z
HIGH

CVE-2025-26752 — Limitation: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in videowhisper

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-26752

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in videowhisper Broadcast Live Video videowhisper-live-streaming-integration allows Path Traversal.This issue affects Broadcast Live Video: from n/a through <= 6.2. CVSSv3.1 8.6 (HIGH)

CWECWE 22TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2025-02-25
2025-02-25 08:15Z
HIGH

CVE-2025-1675 — Zephyrproject Zephyr: The function dns_copy_qname in dns_pack.c performs performs a memcpy operation with an untrusted field

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-1675

The function dns_copy_qname in dns_pack.c performs performs a memcpy operation with an untrusted field and does not check if the source buffer is large enough to contain the copied data. CVSSv3.1 8.2 (HIGH) · EPSS 31th percentile

CWECWE 125VNDZephyrprojectTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2025-02-25
2025-02-25 08:15Z
HIGH

CVE-2025-1674 — Zephyrproject Zephyr: A lack of input validation allows for out of bounds reads caused by malicious

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-1674

A lack of input validation allows for out of bounds reads caused by malicious or malformed packets. CVSSv3.1 8.2 (HIGH) · EPSS 29th percentile

CWECWE 125VNDZephyrprojectTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2025-02-25
2025-02-25 07:15Z
HIGH

CVE-2025-1673 — Zephyrproject Zephyr: A malicious or malformed DNS packet without a payload can cause an out-of-bounds read

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-1673

A malicious or malformed DNS packet without a payload can cause an out-of-bounds read, resulting in a crash (denial of service) or an incorrect computation. CVSSv3.1 8.2 (HIGH) · EPSS 27th percentile

CWECWE 125VNDDnsVNDZephyrprojectTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2025-02-24
2025-02-24 17:15Z
CRIT

CVE-2025-26201 — Credential: disclosure vulnerability via the /staff route in GreaterWMS <= 2.1.49 allows a remote

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-26201

Credential disclosure vulnerability via the /staff route in GreaterWMS <= 2.1.49 allows a remote unauthenticated attackers to bypass authentication and escalate privileges. CVSSv3.1 9.1 (CRITICAL) · EPSS 45th percentile

CWECWE 294TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2025-02-24
2025-02-24 15:15Z
HIGH

CVE-2025-27312 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-27312

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jenst WP Sitemap wp-sitemap allows SQL Injection.This issue affects WP Sitemap: from n/a through <= 1.0. CVSSv3.1 8.5 (HIGH)

CWECWE 89TYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2025-02-24
2025-02-24 15:15Z
HIGH

CVE-2025-27298 — Site: Cross-Site Request Forgery (CSRF) vulnerability in cmstactics WP Video Posts wp-video-posts allows OS Command

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-27298

Cross-Site Request Forgery (CSRF) vulnerability in cmstactics WP Video Posts wp-video-posts allows OS Command Injection.This issue affects WP Video Posts: from n/a through <= 3.5.1. CVSSv3.1 8.3 (HIGH)

CWECWE 352TYPVulnerability
8.3
CVSS v3.1
92
Edit Score
2025-02-24
2025-02-24 15:15Z
HIGH

CVE-2025-27276 — Site: Cross-Site Request Forgery (CSRF) vulnerability in lizeipe Photo Gallery ( Responsive ) photo-gallery-pearlbells allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-27276

Cross-Site Request Forgery (CSRF) vulnerability in lizeipe Photo Gallery ( Responsive ) photo-gallery-pearlbells allows Privilege Escalation.This issue affects Photo Gallery ( Responsive ): from n/a through <= 4.0. CVSSv3.1 8.8 (HIGH)

CWECWE 352TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-02-24
2025-02-24 15:15Z
HIGH

CVE-2024-12918 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-12918

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Agito Computer Health4All allows SQL Injection. This issue affects Health4All: before 10.01.2025. CVSSv3.1 8.8 (HIGH) · EPSS 35th percentile

CWECWE 89TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-02-24
2025-02-24 15:15Z
HIGH

CVE-2024-12917 — Files: or Directories Accessible to External Parties vulnerability in Agito Computer Health4All allows Exploiting

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-12917

Files or Directories Accessible to External Parties vulnerability in Agito Computer Health4All allows Exploiting Incorrectly Configured Access Control Security Levels, Authentication Abuse. This issue affects Health4All: before 10.01.2025. CVSSv3.1 8.3 (HIGH) · EPSS 36th percentile

CWECWE 552TYPVulnerability
8.3
CVSS v3.1
92
Edit Score
2025-02-24
2025-02-24 15:15Z
HIGH

CVE-2024-12916 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-12916

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Agito Computer Life4All allows SQL Injection. This issue affects Life4All: before 10.01.2025. CVSSv3.1 8.8 (HIGH) · EPSS 35th percentile

CWECWE 89TYPVulnerability
8.8
CVSS v3.1
94
Edit Score