Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-24 06:16Z
2024-10-23
2024-10-23 17:15Z
HIGH

CVE-2024-20260 — Update: A vulnerability in the VPN and management web servers of the Cisco Secure Firewall

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-20260

Update for September 16, 2026: The original 1.0 version of this advisory was specific to the Cisco Adaptive Security Virtual Appliance (ASAv) and Cisco Secure Firewall Threat Defense Virtual (FTDv) models. However, it was later found that this vulnerability affects all Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software platforms. A vulnerability in the VPN and management web servers of the Cisco Secure F CVSSv3.1 8.6 (HIGH) · EPSS 48th percentile

CWECWE 789VNDUpdateTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2024-10-23
2024-10-23 16:15Z
CRIT

CVE-2024-49671 — Upload: Unrestricted Upload of File with Dangerous Type vulnerability in Dogu Pekgoz AI Image Generator

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-49671

Unrestricted Upload of File with Dangerous Type vulnerability in Dogu Pekgoz AI Image Generator for Your Content & Featured Images – AI Postpix ai-postpix allows Upload a Web Shell to a Web Server.This issue affects AI Image Generator for Your Content & Featured Images – AI Postpix: from n/a through <= 1.1.8. CVSSv3.1 9.9 (CRITICAL) · EPSS 33th percentile

CWECWE 434TYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2024-10-23
2024-10-23 16:15Z
CRIT

CVE-2024-49669 — Upload: Unrestricted Upload of File with Dangerous Type vulnerability in Alexander De Ridder INK Official

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-49669

Unrestricted Upload of File with Dangerous Type vulnerability in Alexander De Ridder INK Official ink-official allows Upload a Web Shell to a Web Server.This issue affects INK Official: from n/a through <= 4.1.2. CVSSv3.1 9.9 (CRITICAL)

CWECWE 434TYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2024-10-23
2024-10-23 16:15Z
CRIT

CVE-2024-49668 — Upload: Unrestricted Upload of File with Dangerous Type vulnerability in christopherdewese1099 Verbalize WP verbalize-wp allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-49668

Unrestricted Upload of File with Dangerous Type vulnerability in christopherdewese1099 Verbalize WP verbalize-wp allows Upload a Web Shell to a Web Server.This issue affects Verbalize WP: from n/a through <= 1.0. CVSSv3.1 10.0 (CRITICAL)

CWECWE 434TYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2024-10-23
2024-10-23 16:15Z
CRIT

CVE-2024-49658 — Upload: Unrestricted Upload of File with Dangerous Type vulnerability in ecomerciar Woocommerce Custom Profile Picture

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-49658

Unrestricted Upload of File with Dangerous Type vulnerability in ecomerciar Woocommerce Custom Profile Picture woo-custom-profile-picture allows Upload a Web Shell to a Web Server.This issue affects Woocommerce Custom Profile Picture: from n/a through <= 1.0. CVSSv3.1 9.9 (CRITICAL)

CWECWE 434TYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2024-10-23
2024-10-23 16:15Z
CRIT

CVE-2024-49653 — Upload: Unrestricted Upload of File with Dangerous Type vulnerability in james-eggers Portfolleo portfolleo allows Upload

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-49653

Unrestricted Upload of File with Dangerous Type vulnerability in james-eggers Portfolleo portfolleo allows Upload a Web Shell to a Web Server.This issue affects Portfolleo: from n/a through <= 1.2. CVSSv3.1 9.9 (CRITICAL)

CWECWE 434TYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2024-10-23
2024-10-23 16:15Z
CRIT

CVE-2024-49652 — Upload: Unrestricted Upload of File with Dangerous Type vulnerability in Renata Bracichowicz 3D Work In

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-49652

Unrestricted Upload of File with Dangerous Type vulnerability in Renata Bracichowicz 3D Work In Progress renee-work-in-progress allows Upload a Web Shell to a Web Server.This issue affects 3D Work In Progress: from n/a through <= 1.0.3. CVSSv3.1 9.9 (CRITICAL)

CWECWE 434TYPVulnerability
9.9
CVSS v3.1
100
Edit Score
728 × 90 / responsive · programmatic ad slot
2024-10-23
2024-10-23 15:15Z
HIGH

CVE-2024-49675 — Vitaliibryl Switch_user: Authentication Bypass Using an Alternate Path or Channel vulnerability in Vitalii iBryl Switch User

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-49675

Authentication Bypass Using an Alternate Path or Channel vulnerability in Vitalii iBryl Switch User ibryl-switch-user allows Authentication Bypass.This issue affects iBryl Switch User: from n/a through <= 1.0.1. CVSSv3.1 8.8 (HIGH)

CWECWE 288VNDVitaliibrylTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-10-21
2024-10-21 21:15Z
CRIT

CVE-2024-41713 — Mitel Micollab: A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-41713in the wild

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the attacker to view, corrupt, or delete users' data and system configurations. CVSSv3.1 9.1 (CRITICAL) · EPSS 100th percentile

CWECWE 22VNDMitelVNDNupointTYPVulnerabilitySTAitw exploited
9.1
CVSS v3.1
100
Edit Score
2024-10-21
2024-10-21 21:15Z
CRIT

CVE-2024-40089 — Viloliving Vilo_5_firmware: A Command Injection vulnerability in Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-40089

A Command Injection vulnerability in Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, authenticated attackers to execute arbitrary code by injecting shell commands into the name of the Vilo device. CVSSv3.1 9.1 (CRITICAL) · EPSS 68th percentile

CWECWE 77VNDCommandVNDVilolivingTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2024-10-21
2024-10-21 21:15Z
CRIT

CVE-2024-40087 — Viloliving Vilo_5_firmware: Vilo 5 Mesh WiFi System <= 5.16.1.33 is vulnerable to Insecure Permissions.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-40087

Vilo 5 Mesh WiFi System <= 5.16.1.33 is vulnerable to Insecure Permissions. Lack of authentication in the custom TCP service on port 5432 allows remote, unauthenticated attackers to gain administrative access over the router. CVSSv3.1 9.6 (CRITICAL) · EPSS 32th percentile

CWECWE 306VNDVilolivingVNDViloTYPVulnerability
9.6
CVSS v3.1
98
Edit Score
2024-10-21
2024-10-21 21:15Z
CRIT

CVE-2024-40086 — Buffer: A Buffer Overflow vulnerability in the local_app_set_router_wifi_SSID_PWD function of Vilo 5 Mesh WiFi System

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-40086

A Buffer Overflow vulnerability in the local_app_set_router_wifi_SSID_PWD function of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attackers to execute arbitrary code via a password field larger than 64 bytes in length. CVSSv3.1 9.6 (CRITICAL) · EPSS 50th percentile

CWECWE 120VNDBufferTYPVulnerability
9.6
CVSS v3.1
98
Edit Score
2024-10-21
2024-10-21 21:15Z
CRIT

CVE-2024-40085 — Buffer: A Buffer Overflow vulnerability in the local_app_set_router_wan function of Vilo 5 Mesh WiFi System

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-40085

A Buffer Overflow vulnerability in the local_app_set_router_wan function of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attackers to execute arbitrary code via pppoe_username and pppoe_password fields being larger than 128 bytes in length. CVSSv3.1 9.6 (CRITICAL) · EPSS 50th percentile

CWECWE 120VNDBufferTYPVulnerability
9.6
CVSS v3.1
98
Edit Score
2024-10-21
2024-10-21 21:15Z
CRIT

CVE-2024-40084 — Viloliving Vilo_5_firmware: A Buffer Overflow in the Boa webserver of Vilo 5 Mesh WiFi System <=

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-40084

A Buffer Overflow in the Boa webserver of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attackers to execute arbitrary code via exceptionally long HTTP methods or paths. CVSSv3.1 9.6 (CRITICAL) · EPSS 50th percentile

CWECWE 120VNDBufferVNDVilolivingTYPVulnerability
9.6
CVSS v3.1
98
Edit Score
2024-10-21
2024-10-21 21:15Z
CRIT

CVE-2024-40083 — Buffer: A Buffer Overflow vulnerabilty in the local_app_set_router_token function of Vilo 5 Mesh WiFi System

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-40083

A Buffer Overflow vulnerabilty in the local_app_set_router_token function of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attackers to execute arbitrary code via sscanf reading the token and timezone JSON fields into a fixed-length buffer. CVSSv3.1 9.6 (CRITICAL) · EPSS 38th percentile

CWECWE 120VNDBufferTYPVulnerability
9.6
CVSS v3.1
98
Edit Score
2024-10-21
2024-10-21 20:15Z
CRIT

CVE-2024-50047 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-50047

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF in async decryption Doing an async decryption (large read) crashes with a slab-use-after-free way down in the crypto API. Reproducer: # mount.cifs -o ...,seal,esize=1 //srv/share /mnt # dd if=/mnt/largefile of=/dev/null ... [ 194.196391] ================================================================== [ 194.196844] BUG: KASAN: slab-use-after-free in gf128mul_4k_ CVSSv3.1 9.8 (CRITICAL)

CWECWE 416TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-10-21
2024-10-21 20:15Z
CRIT

CVE-2024-50046 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: NFSv4: Prevent NULL-pointer dereference

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-50046

In the Linux kernel, the following vulnerability has been resolved: NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies() On the node of an NFS client, some files saved in the mountpoint of the NFS server were copied to another location of the same NFS server. Accidentally, the nfs42_complete_copies() got a NULL-pointer dereference crash with the following syslog: [232064.838881] NFSv4: state recovery failed for open file nfs/pvc-12b5200d-cd0f-46a3-b9f0-af8f4f CVSSv3.1 9.8 (CRITICAL) · EPSS 2th percentile

CWECWE 476TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-10-21
2024-10-21 20:15Z
CRIT

CVE-2024-50043 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: nfsd: fix possible badness

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-50043

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix possible badness in FREE_STATEID When multiple FREE_STATEIDs are sent for the same delegation stateid, it can lead to a possible either use-after-free or counter refcount underflow errors. In nfsd4_free_stateid() under the client lock we find a delegation stateid, however the code drops the lock before calling nfs4_put_stid(), that allows another FREE_STATE to find the stateid again. The first on CVSSv3.1 9.8 (CRITICAL)

CWECWE 416TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-10-21
2024-10-21 20:15Z
HIGH

CVE-2024-50041 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: i40e: Fix macvlan leak

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-50041

In the Linux kernel, the following vulnerability has been resolved: i40e: Fix macvlan leak by synchronizing access to mac_filter_hash This patch addresses a macvlan leak issue in the i40e driver caused by concurrent access to vsi->mac_filter_hash. The leak occurs when multiple threads attempt to modify the mac_filter_hash simultaneously, leading to inconsistent state and potential memory leaks. To fix this, we now wrap the calls to i40e_del_mac_filter() and zeroing vf->def CVSSv3.1 8.8 (HIGH)

CWECWE 401TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-10-21
2024-10-21 20:15Z
CRIT

CVE-2024-50033 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: slip: make slhc_remember() more

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-50033

In the Linux kernel, the following vulnerability has been resolved: slip: make slhc_remember() more robust against malicious packets syzbot found that slhc_remember() was missing checks against malicious packets [1]. slhc_remember() only checked the size of the packet was at least 20, which is not good enough. We need to make sure the packet includes the IPv4 and TCP header that are supposed to be carried. Add iph and th pointers to make the code more readable. [1] BUG CVSSv3.1 9.8 (CRITICAL) · EPSS 1th percentile

CWECWE 908TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-10-21
2024-10-21 20:15Z
HIGH

CVE-2024-50029 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: Fix UAF

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-50029

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync This checks if the ACL connection remains valid as it could be destroyed while hci_enhanced_setup_sync is pending on cmd_sync leading to the following trace: BUG: KASAN: slab-use-after-free in hci_enhanced_setup_sync+0x91b/0xa60 Read of size 1 at addr ffff888002328ffd by task kworker/u5:2/37 CPU: 0 UID: 0 PID: 37 Comm: kworker/u5:2 Not tainted 6.11.0 CVSSv3.1 8.8 (HIGH)

CWECWE 416TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-10-21
2024-10-21 20:15Z
HIGH

CVE-2022-49022 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: wifi: mac8021: fix possible

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-49022

In the Linux kernel, the following vulnerability has been resolved: wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration Fix possible out-of-bound access in ieee80211_get_rate_duration routine as reported by the following UBSAN report: UBSAN: array-index-out-of-bounds in net/mac80211/airtime.c:455:47 index 15 is out of range for type 'u16 [12]' CPU: 2 PID: 217 Comm: kworker/u32:10 Not tainted 6.1.0-060100rc3-generic Hardware name: Acer Aspire TC-281/Aspire CVSSv3.1 8.1 (HIGH) · EPSS 16th percentile

CWECWE 129TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2024-10-21
2024-10-21 20:15Z
HIGH

CVE-2022-49017 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: tipc: re-fetch skb cb

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-49017

In the Linux kernel, the following vulnerability has been resolved: tipc: re-fetch skb cb after tipc_msg_validate As the call trace shows, the original skb was freed in tipc_msg_validate(), and dereferencing the old skb cb would cause an use-after-free crash. BUG: KASAN: use-after-free in tipc_crypto_rcv_complete+0x1835/0x2240 [tipc] Call Trace: <IRQ> tipc_crypto_rcv_complete+0x1835/0x2240 [tipc] tipc_crypto_rcv+0xd32/0x1ec0 [tipc] tipc_rcv+0x744/0x1150 [ti CVSSv3.1 8.8 (HIGH) · EPSS 16th percentile

CWECWE 416TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-10-21
2024-10-21 20:15Z
HIGH

CVE-2022-49015 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: net: hsr: Fix potential

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-49015

In the Linux kernel, the following vulnerability has been resolved: net: hsr: Fix potential use-after-free The skb is delivered to netif_rx() which may free it, after calling this, dereferencing skb may trigger use-after-free. CVSSv3.1 8.8 (HIGH) · EPSS 17th percentile

CWECWE 416TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-10-21
2024-10-21 20:15Z
CRIT

CVE-2022-49003 — Linux Linux_kernel: Observed the following panic when making NVMe/RDMA connections with native multipath on the Rocky

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-49003

In the Linux kernel, the following vulnerability has been resolved: nvme: fix SRCU protection of nvme_ns_head list Walking the nvme_ns_head siblings list is protected by the head's srcu in nvme_ns_head_submit_bio() but not nvme_mpath_revalidate_paths(). Removing namespaces from the list also fails to synchronize the srcu. Concurrent scan work can therefore cause use-after-frees. Hold the head's srcu lock in nvme_mpath_revalidate_paths() and synchronize with the srcu, not t CVSSv3.1 9.8 (CRITICAL) · EPSS 14th percentile

CWECWE 416TYPVulnerability
9.8
CVSS v3.1
99
Edit Score