SophiaX

🔍

LIVE

· New victim: ************* — insomnia· New victim: sansilvestre.edu.pe — krybit· New victim: JMS Southeast — akira· New victim: Padget Technologies — akira· New victim: Delegal Poindexter & Underkofler, P.A. — morpheus· New KEV: CVE-2025-67038 · Lantronix· New KEV: CVE-2026-34908 · Ubiquiti· New KEV: CVE-2026-34910 · Ubiquiti· New KEV: CVE-2026-34909 · Ubiquiti· New KEV: CVE-2026-20253 · Splunk· New victim: 2,775 new IOCs ingested in last 24h ************* — insomnia· New victim: sansilvestre.edu.pe — krybit· New victim: JMS Southeast — akira· New victim: Padget Technologies — akira· New victim: Delegal Poindexter & Underkofler, P.A. — morpheus· New KEV: CVE-2025-67038 · Lantronix· New KEV: CVE-2026-34908 · Ubiquiti· New KEV: CVE-2026-34910 · Ubiquiti· New KEV: CVE-2026-34909 · Ubiquiti· New KEV: CVE-2026-20253 · Splunk· 2,775 new IOCs ingested in last 24h

← Vulnerabilities

CVE-2026-56384

Published: 2026-06-21Modified: 2026-06-22

4.3

CVSS v3

—

EPSS

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Craft CMS contains a missing authorization vulnerability in the assets/preview-thumb endpoint. A Control Panel user without permission to view a target private asset can call the endpoint with an attacker-controlled assetId and receive preview HTML containing a signed fallback transform preview link for that private asset, because no asset-view permission check is performed before preview generation. This affects versions >= 4.0.0-RC1, <= 4.17.7 and >= 5.0.0-RC1, <= 5.9.13, and is fixed in 4.17.8 and 5.9.14.

💣 Public Exploits0

From Exploit-DB

No public exploits in Exploit-DB.

🔍 Sigma Detection Rules0

Rules tagged with this CVE

No Sigma rules tagged with this CVE.

📎 References3

↗ https://github.com/craftcms/cms/commit/d30df3112220db1ffd6726a3ed11857014c7fb27 ↗ https://github.com/craftcms/cms/security/advisories/GHSA-x76w-8c62-48mg ↗ https://www.vulncheck.com/advisories/craft-cms-missing-authorization-in-assets-preview-thumb-endpoint

View on NVD ↗

Recent Victims14 today

*************

United States

insomnia

sansilvestre.edu.pe

PE

krybit

JMS Southeast

akira

Padget Technologies

akira

Delegal Poindexter & Underkofler, P.A.

morpheus

ISOPLUS

Greece

qilin

Quest Health Solutions

anubis

mlit.com.my UPDATE-FULL DATA DUMP NEW LINK 10GB

MY

stormous

jaggroup.com UPDATE-FULL DATA DUMP NEW LINK

stormous

maglificioliliana.com

stormous

lorenzoni-store.com

Italy

stormous

montechiaro-store.com

Italy

stormous

impulso-store.com

Mexico

stormous

Adapt******

shinyhunters

lpgroup

nova

alejandria

nova

transvill

nova

Jit Ex

akira

transvill.com.pe

PE

nova

Miami Machine

United States

akira

New KEV Entries4 this week

CVE-2025-67038LOW

Lantronix EDS5000 contains a code injection vulnerability that could allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.

CVE-2026-34908CRITICAL

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.

CVE-2026-34910CRITICAL

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.

CVE-2026-34909CRITICAL

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to access an unde

CVE-2026-20253CRITICAL

In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. The vulner

CVE-2026-48907LOW

A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution.

CVE-2026-54420HIGH

LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running Clou

CVE-2026-20262LOW

Cisco Catalyst SD-WAN Manager contains a directory or path traversal vulnerability that could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an aff

CVE-2026-35273CRITICAL

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploita

CVE-2026-10520CRITICAL

An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution