Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-24 19:54Z
2024-06-27
2024-06-27 20:15Z
CRIT

CVE-2024-6127 — Security: BC Security Empire before 5.9.3 is vulnerable to a path traversal issue that can

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-6127

BC Security Empire before 5.9.3 is vulnerable to a path traversal issue that can lead to remote code execution. A remote, unauthenticated attacker can exploit this vulnerability over HTTP by acting as a normal agent, completing all cryptographic handshakes, and then triggering an upload of payload data containing a malicious path. CVSSv3.1 9.8 (CRITICAL) · EPSS 95th percentile

CWECWE 434CWECWE 22VNDSecurityTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2024-06-27
2024-06-27 18:15Z
HIGH

CVE-2024-35260 — Microsoft Power_platform: An authenticated attacker can exploit an untrusted search path vulnerability in Microsoft Dataverse to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-35260

An authenticated attacker can exploit an untrusted search path vulnerability in Microsoft Dataverse to execute code over a network. CVSSv3.1 8.0 (HIGH) · EPSS 60th percentile

CWECWE 426VNDMicrosoftTYPVulnerability
8.0
CVSS v3.1
90
Edit Score
2024-06-27
2024-06-27 13:15Z
CRIT

CVE-2024-1107 — Talyabilisim Travel_apps: Authorization Bypass Through User-Controlled Key vulnerability in Talya Informatics Travel APPS allows Exploiting Incorrectly

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-1107

Authorization Bypass Through User-Controlled Key vulnerability in Talya Informatics Travel APPS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Travel APPS: before v17.0.68. CVSSv3.1 9.8 (CRITICAL) · EPSS 7th percentile

CWECWE 639VNDTalyabilisimTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-06-27
2024-06-27 11:15Z
CRIT

CVE-2024-5535 — Issue: In particular this issue could result in up to 255 bytes of arbitrary private

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-5535

Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences such as unexpected application beahviour or a crash. In particular this issue could result in up to 255 bytes of arbitrary private data from memory being sent to the peer leading to a loss of confidentiality. However, only CVSSv3.1 9.1 (CRITICAL) · EPSS 90th percentile

CWECWE 125TYPVulnerability
9.1
CVSS v3.1
97
Edit Score
2024-06-27
2024-06-27 10:15Z
CRIT

CVE-2024-0949 — Authentication: Missing Authentication, Files or Directories Accessible to External Parties, Use of Hard-coded Credentials vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-0949

Missing Authentication, Files or Directories Accessible to External Parties, Use of Hard-coded Credentials vulnerability in Talya Informatics Elektraweb allows Authentication Bypass. This issue affects Elektraweb: before v17.0.68. CVSSv3.1 9.8 (CRITICAL) · EPSS 7th percentile

CWECWE 552CWECWE 306CWECWE 798TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-06-27
2024-06-27 10:15Z
CRIT

CVE-2024-0947 — Reliance: on Cookies without Validation and Integrity Checking vulnerability in Talya Informatics Elektraweb allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-0947

Reliance on Cookies without Validation and Integrity Checking vulnerability in Talya Informatics Elektraweb allows Session Credential Falsification through Manipulation, Accessing/Intercepting/Modifying HTTP Cookies, Manipulating Opaque Client-based Data Tokens. This issue affects Elektraweb: before v17.0.68. CVSSv3.1 9.8 (CRITICAL) · EPSS 32th percentile

CWECWE 565VNDRelianceTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-06-27
2024-06-27 03:15Z
HIGH

CVE-2024-6054 — Auto-featured-image_project Auto-featured-image: The Auto Featured Image plugin for WordPress is vulnerable to arbitrary file uploads due

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-6054

The Auto Featured Image plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'create_post_attachment_from_url' function in all versions up to, and including, 1.2. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible. CVSSv3.1 8.8 (HIGH)

CWECWE 434VNDAuto Featured Image ProjectVNDAutoTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
728 × 90 / responsive · programmatic ad slot
2024-06-26
2024-06-26 15:15Z
CRIT

CVE-2024-4228 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE -

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-4228

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE - 200 - Exposure of Sensitive Information to an Unauthorized Actor, CWE - 522 - Insufficiently Protected Credentials vulnerability in Magarsus Consultancy SSO (Single Sign On) allows SQL Injection. This issue affects SSO (Single Sign On): from 1.0 before 1.1. CVSSv3.1 9.8 (CRITICAL) · EPSS 43th percentile

CWECWE 89TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-06-25
2024-06-25 15:15Z
CRIT

CVE-2024-39293 — Linux Linux_kernel: By removing the queue_index check, it is possible for multiple napi instances to access

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-39293

In the Linux kernel, the following vulnerability has been resolved: Revert "xsk: Support redirect to any socket bound to the same umem" This reverts commit 2863d665ea41282379f108e4da6c8a2366ba66db. This patch introduced a potential kernel crash when multiple napi instances redirect to the same AF_XDP socket. By removing the queue_index check, it is possible for multiple napi instances to access the Rx ring at the same time, which will result in a corrupted ring state which CVSSv3.1 9.8 (CRITICAL)

CWECWE 362TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-06-25
2024-06-25 09:15Z
CRIT

CVE-2024-6028 — Ays-pro Quiz_maker: The Quiz Maker plugin for WordPress is vulnerable to time-based SQL Injection via the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-6028

The Quiz Maker plugin for WordPress is vulnerable to time-based SQL Injection via the 'ays_questions' parameter in all versions up to, and including, 6.5.8.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVSSv3.1 9.8 (CRITICAL)

CWECWE 89VNDAys ProVNDQuizTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-06-25
2024-06-25 06:15Z
HIGH

CVE-2024-5431 — Themewinter Wpcafe: The WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce plugin

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-5431

The WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.25 via the reservation_extra_field shortcode parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include remote files on the server, potentially resulting in code execution CVSSv3.1 8.8 (HIGH)

CWECWE 98VNDThemewinterVNDWpcafeTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-06-24
2024-06-24 13:15Z
CRIT

CVE-2024-37228 — Instawp Instawp_connect: Unrestricted Upload of File with Dangerous Type vulnerability in InstaWP InstaWP Connect instawp-connect.This issue

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-37228

Unrestricted Upload of File with Dangerous Type vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through <= 0.1.0.38. CVSSv3.1 10.0 (CRITICAL)

CWECWE 434VNDInstawpTYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2024-06-24
2024-06-24 09:15Z
CRIT

CVE-2024-5683 — Control: Improper Control of Generation of Code ('Code Injection') vulnerability in Next4Biz CRM & BPM

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-5683

Improper Control of Generation of Code ('Code Injection') vulnerability in Next4Biz CRM & BPM Software Business Process Manangement (BPM) allows Remote Code Inclusion. This issue affects Business Process Manangement (BPM): from 6.6.4.4 before 6.6.4.5. CVSSv3.1 9.8 (CRITICAL) · EPSS 41th percentile

CWECWE 94TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-06-22
2024-06-22 00:00Z
HIGH

GrimResource - Microsoft Management Console for initial access and evasion

Elastic Security Labs·elastic.coCVE-2024-43572in the wild

Elastic Security Labs disclosed GrimResource, a novel code execution technique leveraging specially crafted Microsoft Management Console (MSC) files to achieve arbitrary code execution in mmc.exe context. The attack exploits an old XSS vulnerability in apds.dll, combines it with DotNetToJScript and a custom loader (PASTALOADER) for stealthy injection into dllhost.exe, and was observed in-the-wild delivering Cobalt Strike with zero initial VirusTotal detections. The research includes comprehensive detection rules, YARA signatures, and forensic artifacts to identify the technique.

SRFOsTACTA0001TACTA0002OSWindowsSWCobalt StrikeVNDMicrosoftTYPResearchSTGExecution
82
Edit Score
2024-06-21
2024-06-21 12:15Z
CRIT

CVE-2024-36288 — Linux Linux_kernel: This results in the following KASAN splat: KASAN: maybe wild-memory-access in range [0x04a2013400000008-0x04a201340000000f]

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-36288

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix loop termination condition in gss_free_in_token_pages() The in_token->pages[] array is not NULL terminated. This results in the following KASAN splat: KASAN: maybe wild-memory-access in range [0x04a2013400000008-0x04a201340000000f] CVSSv3.1 9.8 (CRITICAL) · EPSS 1th percentile

CWECWE 835TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-06-21
2024-06-21 11:15Z
HIGH

CVE-2024-38381 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: nfc: nci: Fix uninit-value

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-38381

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: Fix uninit-value in nci_rx_work syzbot reported the following uninit-value access issue [1] nci_rx_work() parses received packet from ndev->rx_q. It should be validated header size, payload size and total packet size before processing the packet. If an invalid packet is detected, it should be silently discarded. CVSSv3.1 8.8 (HIGH) · EPSS 2th percentile

CWECWE 908TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-06-21
2024-06-21 10:15Z
CRIT

CVE-2024-6027 — Themify Product_filter: The Themify – WooCommerce Product Filter plugin for WordPress is vulnerable to time-based SQL

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-6027

The Themify – WooCommerce Product Filter plugin for WordPress is vulnerable to time-based SQL Injection via the ‘conditions’ parameter in all versions up to, and including, 1.4.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the dat CVSSv3.1 9.8 (CRITICAL)

CWECWE 89VNDThemifyTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-06-21
2024-06-21 05:15Z
CRIT

CVE-2024-5756 — Icegram Icegram_express: The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress &

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-5756

The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the db parameter in all versions up to, and including, 5.7.23 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries CVSSv3.1 9.8 (CRITICAL)

CWECWE 89VNDIcegramTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-06-21
2024-06-21 04:15Z
HIGH

CVE-2024-5455 — Posimyth The_plus_addons_for_elementor: The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to Local

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-5455

The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.5.4 via the 'magazine_style' parameter within the Dynamic Smart Showcase widget. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sens CVSSv3.1 8.8 (HIGH)

CWECWE 98VNDPosimythVNDPlusTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-06-21
2024-06-21 02:15Z
HIGH

CVE-2024-5503 — Codevibrant Wp_blog_post_layouts: The WP Blog Post Layouts plugin for WordPress is vulnerable to Local File Inclusion

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-5503

The WP Blog Post Layouts plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.3. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types ca CVSSv3.1 8.8 (HIGH)

CWECWE 98VNDCodevibrantVNDBlogTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-06-20
2024-06-20 17:15Z
HIGH

CVE-2024-37626 — Totolink A6000r_firmware: A command injection issue in TOTOLINK A6000R V1.0.1-B20201211.2000 firmware allows a remote attacker to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-37626

A command injection issue in TOTOLINK A6000R V1.0.1-B20201211.2000 firmware allows a remote attacker to execute arbitrary code via the iface parameter in the vif_enable function. CVSSv3.1 8.8 (HIGH) · EPSS 76th percentile

CWECWE 78VNDTotolinkTYPVulnerability
8.8
CVSS v3.1
95
Edit Score
2024-06-20
2024-06-20 16:15Z
HIGH

CVE-2024-37676 — An issue in htop-dev htop v.2.20 allows a local attacker to cause an out-of-bounds

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-37676

An issue in htop-dev htop v.2.20 allows a local attacker to cause an out-of-bounds access in the Header_populateFromSettings function. CVSSv3.1 8.4 (HIGH) · EPSS 12th percentile

CWECWE 787CWECWE 119TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2024-06-20
2024-06-20 12:15Z
HIGH

CVE-2022-48743 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: net: amd-xgbe: Fix skb

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-48743

In the Linux kernel, the following vulnerability has been resolved: net: amd-xgbe: Fix skb data length underflow There will be BUG_ON() triggered in include/linux/skbuff.h leading to intermittent kernel panic, when the skb length underflow is detected. Fix this by dropping the packet if such length underflows are seen because of inconsistencies in the hardware descriptors. CVSSv3.1 8.1 (HIGH) · EPSS 17th percentile

CWECWE 787TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2024-06-20
2024-06-20 11:15Z
CRIT

CVE-2022-48711 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: tipc: improve size validations

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-48711

In the Linux kernel, the following vulnerability has been resolved: tipc: improve size validations for received domain records The function tipc_mon_rcv() allows a node to receive and process domain_record structs from peer nodes to track their views of the network topology. This patch verifies that the number of members in a received domain record does not exceed the limit defined by MAX_MON_DOMAIN, something that may otherwise lead to a stack overflow. tipc_mon_rcv() is CVSSv3.1 9.8 (CRITICAL) · EPSS 15th percentile

CWECWE 787TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-06-20
2024-06-20 11:15Z
HIGH

CVE-2021-47620 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: refactor malicious adv

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-47620

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: refactor malicious adv data check Check for out-of-bound read was being performed at the end of while num_reports loop, and would fill journal with false positives. Added check to beginning of loop processing so that it doesn't get checked after ptr has been advanced. CVSSv3.1 8.1 (HIGH) · EPSS 13th percentile

CWECWE 125TYPVulnerability
8.1
CVSS v3.1
91
Edit Score