Live vulnerability intelligence

Vulnerability Intelligence Center

Track, prioritise and act on the vulnerabilities that actually threaten your external attack surface — CVEs, exploits, EPSS, CISA KEV and trending attacks, unified in one continuously updated feed.

Live feed

0 CVE available

Streaming live from the Patrowl Intelligence API.

CVE

Summary

What's being exploited right now

We correlate disclosures with real-world exploitation signals so you see the campaigns hitting exposed assets — before they reach yours.

Get the full threat feed

Criticaltoday

CVE-2025-48828 and CVE-2026-61511 in vBulletin allow attackers to execute arbitrary PHP code through unauthenticated Remote Code Execution (RCE).

vBulletin is a commercial, self-hosted forum platform written in PHP and 2 CVE impact it. CVE-2025-48828: Template Conditional Bypass RCE It is a Remote Code Execution vulnerability in vBulletin's template engine. Attackers can execute arbitrary PHP code by abusing Template Conditionals through alternative PHP function invocation syntax—specifically using the "var_dump"("test") style notation rather than standard syntax. This crafted template code bypasses security checks designed to prevent unauthorized function calls, allowing complete server compromise without any authentication. The vulnerability exploits CWE-424 (Improper Protection of Alternate Path), meaning the security filters don't account for all possible code execution paths. This flaw was confirmed as exploited in the wild in May 2025, with scanning and exploitation attempts detected starting May 25, 2025. CVE-2026-61511: Eval Injection in Template Runtime It is a Critical unauthenticated Remote Code Execution vulnerability affecting vBulletin 5.x and 6.x versions. The flaw exists in the vB5_Template_Runtime::runMaths() method, which applies an insufficiently restrictive regex filter before passing user input to PHP's dangerous eval() function. Attackers exploit this by sending specially crafted requests to the publicly accessible ajax/render AJAX endpoint with malicious input in the pagenav[pagenumber] parameter. Using phpfuck-style encoding—a technique that constructs arbitrary PHP expressions using only characters that pass the regex filter—attackers completely bypass the whitelist and execute arbitrary PHP code. This is exploitable with zero authentication, zero user interaction, and low attack complexity, making it extremely dangerous. A public Proof-of-Concept was released on July 27, 2026.

Jelsoft EnterprisesvBulletin

Criticaltoday

CVE-2025-48828 - CVE-2026-61511 - allow attackers to execute arbitrary PHP code and an Unauthenticated RCE

vBulletin is a commercial, self-hosted forum platform written in PHP and 2 CVE impact it. CVE-2025-48828: Template Conditional Bypass RCE It is a Remote Code Execution vulnerability in vBulletin's template engine. Attackers can execute arbitrary PHP code by abusing Template Conditionals through alternative PHP function invocation syntax—specifically using the "var_dump"("test") style notation rather than standard syntax. This crafted template code bypasses security checks designed to prevent unauthorized function calls, allowing complete server compromise without any authentication. The vulnerability exploits CWE-424 (Improper Protection of Alternate Path), meaning the security filters don't account for all possible code execution paths. This flaw was confirmed as exploited in the wild in May 2025, with scanning and exploitation attempts detected starting May 25, 2025. CVE-2026-61511: Eval Injection in Template Runtime It is a Critical unauthenticated Remote Code Execution vulnerability affecting vBulletin 5.x and 6.x versions. The flaw exists in the vB5_Template_Runtime::runMaths() method, which applies an insufficiently restrictive regex filter before passing user input to PHP's dangerous eval() function. Attackers exploit this by sending specially crafted requests to the publicly accessible ajax/render AJAX endpoint with malicious input in the pagenav[pagenumber] parameter. Using phpfuck-style encoding—a technique that constructs arbitrary PHP expressions using only characters that pass the regex filter—attackers completely bypass the whitelist and execute arbitrary PHP code. This is exploitable with zero authentication, zero user interaction, and low attack complexity, making it extremely dangerous. A public Proof-of-Concept was released on July 27, 2026.

Jelsoft EnterprisesvBulletin

Critical5d ago

Multiple vulnerability on n8n : Credential Authorization Bypass, Account Takeover, Arbitrary File Read & SSRF via Nodemailer, Sandbox Escape to RCE, Arbitrary File Write

n8n is an open-source workflow automation platform frequently self-hosted on internet-facing infrastructure, enabling developers and enterprises to build, deploy, and manage automation workflows without extensive coding. GHSA-6qc9-mqvw-jg7x — HTTP Request Node Credential Authorization Bypass An authenticated user with workflow editing permissions can reference another user's credentials in an HTTP Request node by specifying the credential type via an expression. Pre-execution permission checks compared the unresolved expression instead of the actual credential type, bypassing ownership validation. The credential is then loaded at runtime, allowing unauthorized access or exfiltration of credentials belonging to other users, provided the attacker knows the target credential ID. GHSA-8342-988q-86cr — Embed Login Account Takeover via Unverified Email Claims On instances with Embed Login enabled and at least one trusted key source configured, the service failed to verify that the trusted key had appropriate role ceiling coverage for the target account and that email claims were verified. Any attacker with a token accepted by a trusted key source could authenticate as any existing user, gaining complete account control without needing valid credentials. GHSA-2x35-3fw4-9jr4 — Send Email Node Arbitrary File Read & SSRF via Nodemailer The Send Email node did not enforce string-type constraints on message fields. Malicious non-string values derived from workflow expressions could be processed by the underlying mail library as file paths or URLs, enabling local file disclosure and SSRF attacks. Exploitation required a webhook-triggered workflow with valid SMTP credentials and unsanitized input mapped directly to message body fields. GHSA-gv7g-jm28-cr3m — Expression Sandbox Escape to Remote Code Execution An authenticated user with workflow creation or modification permissions could craft expressions using arrow functions to bypass the expression sandbox and trigger unintended system command execution on the n8n host. The sandbox normally blocks .constructor access, but using with() statements and arrow functions, attackers could resolve constructor to the global Function constructor at runtime, achieving arbitrary code execution. GHSA-xmc9-4f2h-jf9c — Edit Image Node Format Injection to Arbitrary File Write The Edit Image node passed its output format parameter to the underlying image library without validation. A crafted format value could write arbitrary bytes outside the node's working directory. Any authenticated user capable of executing workflows could exploit this to write arbitrary files to the n8n instance, potentially enabling persistence or privilege escalation.

n8nn8n

Built for Claude · Open source

Turn Claude into a vulnerability analyst

patrowl-cve-analyst pulls correlated CVE, CVSS, EPSS, CISA KEV, public-exploit and trending-attack data from Patrowl Intelligence — and produces decision-grade risk briefs in seconds.

One prompt, full picture — CVSS, EPSS, KEV, public exploits and trending attacks correlated in a single call.
Decision-grade output. A risk verdict and remediation window, not raw JSON to parse.
Works in Claude Code, Claude Desktop or any Claude app — drop the skill in and prompt.

Install on GitHub Read the README

~/patrowl-cve-analyst

$ claude
> Use the patrowl-cve-analyst skill —
  brief me on CVE-2025-41115

┌─ Patrowl risk brief ───────────────────────┐
│  EASM score   8.7 / 10   high              │
│  CVSS v4.0    9.1        v3.1   8.7      │
│  EPSS         12.4%      KEV    no       │
│  Public PoCs  2          Remote yes      │
│                                            │
│  Verdict Patch within 7 days. Trending     │
│          exploitation observed in the wild. │
└────────────────────────────────────────────┘