Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-24 21:16Z
2024-06-17
2024-06-17 19:15Z
CRIT

CVE-2024-36543 — Incorrect: access control in the Kafka Connect REST API in the STRIMZI Project 0.41.0

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-36543

Incorrect access control in the Kafka Connect REST API in the STRIMZI Project 0.41.0 and earlier allows an attacker to deny the service for Kafka Mirroring, potentially mirror the topics' content to his Kafka cluster via a malicious connector (bypassing Kafka ACL if it exists), and potentially steal Kafka SASL credentials, by querying the MirrorMaker Kafka REST API. CVSSv3.1 9.8 (CRITICAL) · EPSS 41th percentile

CWECWE 400TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-06-17
2024-06-17 18:15Z
HIGH

CVE-2024-36973 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: misc: microchip: pci1xxxx: fix

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-36973

In the Linux kernel, the following vulnerability has been resolved: misc: microchip: pci1xxxx: fix double free in the error handling of gp_aux_bus_probe() When auxiliary_device_add() returns error and then calls auxiliary_device_uninit(), callback function gp_auxiliary_device_release() calls ida_free() and kfree(aux_device_wrapper) to free memory. We should't call them again in the error handling path. Fix this by skipping the redundant cleanup functions. CVSSv3.1 8.4 (HIGH)

CWECWE 415TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2024-06-15
2024-06-15 09:15Z
CRIT

CVE-2024-4258 — Yotuwp Video_gallery: The Video Gallery – YouTube Playlist, Channel Gallery by YotuWP plugin for WordPress is

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-4258

The Video Gallery – YouTube Playlist, Channel Gallery by YotuWP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.13 via the settings parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and oth CVSSv3.1 9.8 (CRITICAL)

CWECWE 98VNDYotuwpVNDVideoTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-06-15
2024-06-15 09:15Z
CRIT

CVE-2024-3105 — Woody: The Woody code snippets – Insert Header Footer Code, AdSense Ads plugin for WordPress

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-3105

The Woody code snippets – Insert Header Footer Code, AdSense Ads plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.5.0 via the 'insert_php' shortcode. This is due to the plugin not restricting the usage of the functionality to high level authorized users. This makes it possible for authenticated attackers, with contributor-level access and above, to execute code on the server. CVSSv3.1 9.9 (CRITICAL)

CWECWE 94VNDWoodyTYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2024-06-15
2024-06-15 04:15Z
CRIT

CVE-2024-5871 — Wpwebelite Woocommerce_social_login: The WooCommerce - Social Login plugin for WordPress is vulnerable to PHP Object Injection

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-5871

The WooCommerce - Social Login plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.2 via deserialization of untrusted input from the 'woo_slg_verify' vulnerable parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to d CVSSv3.1 9.8 (CRITICAL)

CWECWE 502VNDWpwebeliteVNDWoocommerceTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-06-15
2024-06-15 02:15Z
HIGH

CVE-2024-3813 — Tagdiv Tagdiv_composer: The tagDiv Composer plugin for WordPress is vulnerable to Local File Inclusion in all

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-3813

The tagDiv Composer plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.8 via the 'td_block_title' shortcode 'block_template_id' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code exe CVSSv3.1 8.8 (HIGH)

CWECWE 98VNDTagdivVNDComposerTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-06-15
2024-06-15 02:15Z
HIGH

CVE-2023-6696 — Sygnoos Popup_builder: plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-6696

The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on several functions in all versions up to, and including, 4.3.1. While some functions contain a nonce check, the nonce can be obtained from the profile page of a logged-in user. This allows subscribers to perform several actions including deleting subscribers and perform blind Server-Side CVSSv3.1 8.1 (HIGH)

CWECWE 862VNDSygnoosTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
728 × 90 / responsive · programmatic ad slot
2024-06-14
2024-06-14 13:15Z
HIGH

CVE-2024-2024 — Folders: The Folders Pro plugin for WordPress is vulnerable to arbitrary file uploads due to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-2024

The Folders Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'handle_folders_file_upload' function in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with author access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. CVSSv3.1 8.8 (HIGH)

CWECWE 22TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-06-14
2024-06-14 10:15Z
CRIT

CVE-2024-2472 — Latepoint Latepoint: The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-2472

The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'start_or_use_session_for_customer' function in all versions up to and including 4.9.9. This makes it possible for unauthenticated attackers to view other customer's cabinets, including the ability to view PII such as email addresses and to change their LatePoint user password, which may or may not be associated with a WordPr CVSSv3.1 9.1 (CRITICAL)

CWECWE 639VNDLatepointTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2024-06-14
2024-06-14 08:15Z
CRIT

CVE-2024-5577 — Where: The Where I Was, Where I Will Be plugin for WordPress is vulnerable to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-5577

The Where I Was, Where I Will Be plugin for WordPress is vulnerable to Remote File Inclusion in version <= 1.1.1 via the WIW_HEADER parameter of the /system/include/include_user.php file. This makes it possible for unauthenticated attackers to include and execute arbitrary files hosted on external servers, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution. This requires allow_url CVSSv3.1 9.8 (CRITICAL)

CWECWE 98VNDWhereTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-06-14
2024-06-14 06:15Z
HIGH

CVE-2024-4404 — Wpmet Elementskit: The ElementsKit PRO plugin for WordPress is vulnerable to Server-Side Request Forgery in versions

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-4404

The ElementsKit PRO plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.6.2 via the 'render_raw' function. This can allow authenticated attackers, with contributor-level permissions and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. CVSSv3.1 8.5 (HIGH)

CWECWE 918VNDWpmetVNDElementskitTYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2024-06-14
2024-06-14 05:15Z
CRIT

CVE-2024-4936 — Canto Canto: The Canto plugin for WordPress is vulnerable to Remote File Inclusion in all versions

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-4936

The Canto plugin for WordPress is vulnerable to Remote File Inclusion in all versions up to, and including, 3.0.8 via the abspath parameter. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. This required allow_url_include to be enabled on the target site in order to exploit. CVSSv3.1 9.8 (CRITICAL)

CWECWE 98VNDCantoTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-06-13
2024-06-13 09:15Z
CRIT

CVE-2024-4371 — Codexpert Codesigner: The CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-4371

The CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.4.1 via deserialization of untrusted input from the recently_viewed_products cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme ins CVSSv3.1 9.0 (CRITICAL)

CWECWE 502VNDCodexpertVNDCodesignerTYPVulnerability
9.0
CVSS v3.1
95
Edit Score
2024-06-13
2024-06-13 02:15Z
CRIT

CVE-2024-3922 — Dokan Dokan: The Dokan Pro plugin for WordPress is vulnerable to SQL Injection via the 'code'

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-3922

The Dokan Pro plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter in all versions up to, and including, 3.10.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVSSv3.1 10.0 (CRITICAL)

CWECWE 89VNDDokanTYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2024-06-12
2024-06-12 15:15Z
CRIT

CVE-2024-36265 — Apache Submarine: ** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Submarine Server Core.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-36265

** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Submarine Server Core. This issue affects Apache Submarine Server Core: from 0.8.0. An attacker can bypass authentication by sending specially crafted REST requests. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects product CVSSv3.1 9.8 (CRITICAL) · EPSS 50th percentile

CWECWE 863VNDApacheVNDUnsupportedTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-06-12
2024-06-12 11:15Z
CRIT

CVE-2024-4898 — Instawp Instawp_connect: The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-4898

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary option updates due to a missing authorization checks on the REST API calls in all versions up to, and including, 0.1.0.38. This makes it possible for unauthenticated attackers to connect the site to InstaWP API, edit arbitrary site options and create administrator accounts. CVSSv3.1 9.8 (CRITICAL)

CWECWE 862VNDInstawpTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-06-12
2024-06-12 10:15Z
HIGH

CVE-2024-4845 — Icegram Icegram_express: The Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘options[list_id]’

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-4845

The Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘options[list_id]’ parameter in all versions up to, and including, 5.7.22 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive informatio CVSSv3.1 8.8 (HIGH)

CWECWE 89VNDIcegramTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-06-12
2024-06-12 09:15Z
HIGH

CVE-2024-5154 — Kubernetes Cri-o: A malicious container can create a symbolic link to arbitrary files on the host

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-5154

A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal (“../“). This flaw allows the container to read and write to arbitrary files on the host system. CVSSv3.1 8.1 (HIGH) · EPSS 67th percentile

CWECWE 22VNDKubernetesTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2024-06-12
2024-06-12 02:15Z
HIGH

CVE-2024-5543 — Slideshow: The Slideshow Gallery LITE plugin for WordPress is vulnerable to time-based SQL Injection via

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-5543

The Slideshow Gallery LITE plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter in all versions up to, and including, 1.8.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive informat CVSSv3.1 8.1 (HIGH)

CWECWE 89VNDSlideshowTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2024-06-12
2024-06-12 00:00Z
HIGH

Dipping into Danger: The WARMCOOKIE backdoor

Elastic Security Labs·elastic.coin the wild

Elastic Security Labs disclosed WARMCOOKIE, a new Windows backdoor actively deployed via recruiting-themed phishing campaigns since late April 2024. The malware establishes persistence via scheduled tasks, fingerprints victims, captures screenshots, executes commands, and stages additional payloads. Threat actors rapidly rotate infrastructure and domains to evade reputation systems, with samples compiled with hardcoded C2 IPs and RC4 keys.

SRFApplicationSRFOsTACTA0005TACTA0001TACTA0002TACTA0007TACTA0011TACTA0010
78
Edit Score
2024-06-11
2024-06-11 17:16Z
HIGH

CVE-2024-37325 — Microsoft Azure_data_science_virtual_machine: Azure Science Virtual Machine (DSVM) Elevation of Privilege Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-37325

Azure Science Virtual Machine (DSVM) Elevation of Privilege Vulnerability CVSSv3.1 8.1 (HIGH) · EPSS 63th percentile

CWECWE 200VNDMicrosoftVNDAzureTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2024-06-11
2024-06-11 17:16Z
HIGH

CVE-2024-35250 — Microsoft Windows_10_1507: Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-35250in the wild

Windows Kernel-Mode Driver Elevation of Privilege Vulnerability CVSSv3.1 7.8 (HIGH) · EPSS 98th percentile

CWECWE 822VNDMicrosoftTYPVulnerabilitySTAitw exploited
7.8
CVSS v3.1
97
Edit Score
2024-06-11
2024-06-11 17:16Z
HIGH

CVE-2024-35249 — Microsoft Dynamics_365_business_central: Dynamics 365 Business Central Remote Code Execution Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-35249

Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability CVSSv3.1 8.8 (HIGH) · EPSS 88th percentile

CWECWE 502VNDMicrosoftTYPVulnerability
8.8
CVSS v3.1
95
Edit Score
2024-06-11
2024-06-11 17:15Z
HIGH

CVE-2024-30103 — Microsoft 365_apps: Outlook Remote Code Execution Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-30103

Microsoft Outlook Remote Code Execution Vulnerability CVSSv3.1 8.8 (HIGH) · EPSS 95th percentile

CWECWE 184VNDMicrosoftTYPVulnerability
8.8
CVSS v3.1
98
Edit Score
2024-06-11
2024-06-11 17:15Z
HIGH

CVE-2024-30097 — Microsoft Windows_10_1507: Speech Application Programming Interface (SAPI) Remote Code Execution Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-30097

Microsoft Speech Application Programming Interface (SAPI) Remote Code Execution Vulnerability CVSSv3.1 8.8 (HIGH) · EPSS 75th percentile

CWECWE 415VNDMicrosoftTYPVulnerability
8.8
CVSS v3.1
95
Edit Score