{"count":500,"items":[{"cveId":"CVE-2025-39682","priority":0,"added":"2026-09-18","dueDate":"2026-09-21","ransomware":false,"epss":0.00505,"cvss":9.8,"description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntls: fix handling of zero-length records on the rx_list\n\nEach recvmsg() call must process either\n - only contiguous DATA records (any number of them)\n - one non-DATA record\n\nIf the next record has different type than what has already been\nprocessed we break out of the main processing loop. If the record\nhas already been decrypted (which may be the case for TLS 1.3 where\nwe don't know type until decryption) we queue the pending record\nto the rx_list. Next recvmsg() will pick it up from there.\n\nQueuing the skb to rx_list after zero-copy decrypt is not possible,\nsince in that case we decrypted directly to the user space buffer,\nand we don't have an skb to queue (darg.skb points to the ciphertext\nskb for access to metadata like length).\n\nOnly data records are allowed zero-copy, and we break the processing\nloop after each non-data record. So we should never zero-copy and\nthen find out that the record type has changed. The corner case\nwe missed is when the initial record comes from rx_list, and it's\nzero length."},{"cveId":"CVE-2025-39964","priority":0,"added":"2026-09-18","dueDate":"2026-09-21","ransomware":false,"epss":0.00323,"cvss":7.8,"description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - Disallow concurrent writes in af_alg_sendmsg\n\nIssuing two writes to the same af_alg socket is bogus as the\ndata will be interleaved in an unpredictable fashion.  Furthermore,\nconcurrent writes may create inconsistencies in the internal\nsocket state.\n\nDisallow this by adding a new ctx->write field that indiciates\nexclusive ownership for writing."},{"cveId":"CVE-2026-53266","priority":0,"added":"2026-09-18","dueDate":"2026-09-21","ransomware":false,"epss":0.00121,"cvss":8.8,"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: bridge: make ebt_snat ARP rewrite writable\n\nThe ebtables SNAT target keeps the Ethernet source address rewrite\nbehind skb_ensure_writable(skb, 0).  This is intentional: at the bridge\nebtables hooks the Ethernet header is addressed through\nskb_mac_header()/eth_hdr(), while skb->data points at the Ethernet\npayload.  Asking skb_ensure_writable() for ETH_HLEN bytes would check\nthe payload, not the Ethernet header, and would reintroduce the small\npacket regression fixed by commit 63137bc5882a.\n\nHowever, the optional ARP sender hardware address rewrite is different.\nIt writes through skb_store_bits() at an offset relative to skb->data:\n\n        skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN)\n\nskb_header_pointer() only safely reads the ARP header; it does not make\nthe later sender hardware address range writable.  If that range is\nstill held in a nonlinear skb fragment backed by a splice-imported file\npage, skb_store_bits() maps the frag page and copies the new MAC address\ndirectly into it.\n\nEnsure the ARP SHA range is writable before reading the ARP header and\nbefore calling skb_store_bits()."},{"cveId":"CVE-2026-58704","priority":0,"added":"2026-09-16","dueDate":"2026-09-19","ransomware":false,"epss":0.00207,"cvss":null,"description":"Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges."},{"cveId":"CVE-2026-76460","priority":0,"added":"2026-09-16","dueDate":"2026-09-19","ransomware":false,"epss":0.00784,"cvss":null,"description":"Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface."},{"cveId":"CVE-2026-87886","priority":0,"added":"2026-09-16","dueDate":"2026-09-19","ransomware":false,"epss":0.00281,"cvss":7.8,"description":"Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238."},{"cveId":"CVE-2026-76461","priority":0,"added":"2026-09-14","dueDate":"2026-09-17","ransomware":false,"epss":0.02009,"cvss":9.8,"description":"A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.\r\n\r\nThis vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system."},{"cveId":"CVE-2026-84869","priority":0,"added":"2026-09-11","dueDate":"2026-09-14","ransomware":false,"epss":0.00691,"cvss":9.9,"description":"A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted."},{"cveId":"CVE-2026-85706","priority":0,"added":"2026-09-11","dueDate":"2026-09-14","ransomware":false,"epss":0.14563,"cvss":10.0,"description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API."},{"cveId":"CVE-2026-42016","priority":0,"added":"2026-09-11","dueDate":"2026-09-25","ransomware":false,"epss":0.00886,"cvss":8.1,"description":"JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope."},{"cveId":"CVE-2026-42018","priority":0,"added":"2026-09-11","dueDate":"2026-09-25","ransomware":false,"epss":0.00920,"cvss":7.5,"description":"JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources."},{"cveId":"CVE-2026-86060","priority":0,"added":"2026-09-10","dueDate":"2026-09-13","ransomware":false,"epss":0.01057,"cvss":9.8,"description":"RouterOS contains an argument-handling flaw in the SSH login\npath involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask\u00A0to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions:\u00A06.49.21 (Long-term),\u00A07.23.4 (Long-term)\u00A0and\u00A07.24.2 (Stable)"},{"cveId":"CVE-2026-67277","priority":0,"added":"2026-09-10","dueDate":"2026-09-13","ransomware":false,"epss":0.00869,"cvss":8.2,"description":"RouterOS accepts a \"related\" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With \"random-data=false\", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel.\n\n\n\nThis issue was fixed in versions:\u00A06.49.21 (Long-term),\u00A07.23.4 (Long-term)\u00A0and\u00A07.24.2 (Stable)"},{"cveId":"CVE-2026-87491","priority":0,"added":"2026-09-09","dueDate":"2026-09-23","ransomware":false,"epss":0.00997,"cvss":8.8,"description":"Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},{"cveId":"CVE-2026-19490","priority":0,"added":"2026-09-09","dueDate":"2026-09-12","ransomware":false,"epss":0.05597,"cvss":9.8,"description":"Vulnerability in NetScaler ADC and NetScaler Gateway.\n\nThis issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21."},{"cveId":"CVE-2026-20079","priority":0,"added":"2026-09-09","dueDate":"2026-09-12","ransomware":false,"epss":0.75752,"cvss":10.0,"description":"A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.&nbsp;\r\n\r\nThis vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow&nbsp;root access to the device.&nbsp;"},{"cveId":"CVE-2025-25249","priority":0,"added":"2026-09-09","dueDate":"2026-09-12","ransomware":false,"epss":0.02403,"cvss":8.1,"description":"A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets"},{"cveId":"CVE-2026-86218","priority":0,"added":"2026-09-08","dueDate":"2026-09-11","ransomware":false,"epss":0.00744,"cvss":9.8,"description":"N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14."},{"cveId":"CVE-2026-85880","priority":0,"added":"2026-09-08","dueDate":"2026-09-22","ransomware":false,"epss":0.00572,"cvss":7.8,"description":"Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally."},{"cveId":"CVE-2026-81963","priority":0,"added":"2026-09-08","dueDate":"2026-09-22","ransomware":false,"epss":0.00631,"cvss":7.8,"description":"Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally."},{"cveId":"CVE-2026-75650","priority":0,"added":"2026-09-08","dueDate":"2026-09-11","ransomware":false,"epss":0.02148,"cvss":10.0,"description":"Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed."},{"cveId":"CVE-2026-85046","priority":0,"added":"2026-09-04","dueDate":"2026-09-18","ransomware":false,"epss":0.01462,"cvss":8.8,"description":"Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},{"cveId":"CVE-2026-9586","priority":0,"added":"2026-09-02","dueDate":"2026-09-05","ransomware":false,"epss":0.11845,"cvss":9.8,"description":"An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997).\u00A0The /pa endpoint processes XML\u00A0content beginning with <PolycomIPPhone> and\u00A0directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization.\u00A0An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution."},{"cveId":"CVE-2026-82329","priority":0,"added":"2026-09-02","dueDate":"2026-09-05","ransomware":false,"epss":0.07666,"cvss":9.8,"description":"JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges."},{"cveId":"CVE-2026-83548","priority":0,"added":"2026-09-02","dueDate":"2026-09-05","ransomware":false,"epss":0.04667,"cvss":10.0,"description":"A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations."},{"cveId":"CVE-2026-83549","priority":0,"added":"2026-09-02","dueDate":"2026-09-05","ransomware":false,"epss":0.08505,"cvss":7.8,"description":"Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution."},{"cveId":"CVE-2026-59822","priority":0,"added":"2026-09-02","dueDate":"2026-09-16","ransomware":false,"epss":0.00870,"cvss":8.2,"description":"LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid LiteLLM key. This issue is fixed in version 1.84.0."},{"cveId":"CVE-2026-48710","priority":0,"added":"2026-09-02","dueDate":"2026-09-16","ransomware":false,"epss":0.36257,"cvss":6.5,"description":"Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope[\"server\"]` for malformed values."},{"cveId":"CVE-2026-49869","priority":0,"added":"2026-09-02","dueDate":"2026-09-05","ransomware":false,"epss":0.01917,"cvss":10.0,"description":"Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith(\"/configs\") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated remote attacker can exploit this to create and execute arbitrary workflows without credentials. Because Kestra ships with script execution plugins (plugin-script-shell, plugin-script-python, etc.) enabled by default, this directly results in unauthenticated Remote Code Execution as root inside the Kestra worker container.  This vulnerability is fixed in 1.0.45 and 1.3.21."},{"cveId":"CVE-2026-81578","priority":0,"added":"2026-08-31","dueDate":"2026-09-14","ransomware":false,"epss":0.03290,"cvss":9.8,"description":"An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific\u00A0conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the  completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations."},{"cveId":"CVE-2026-82078","priority":0,"added":"2026-08-31","dueDate":"2026-09-14","ransomware":false,"epss":0.03574,"cvss":9.1,"description":"An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process."},{"cveId":"CVE-2026-66384","priority":0,"added":"2026-08-27","dueDate":"2026-09-10","ransomware":false,"epss":0.00579,"cvss":5.3,"description":"An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions."},{"cveId":"CVE-2026-53362","priority":0,"added":"2026-08-27","dueDate":"2026-08-30","ransomware":false,"epss":0.00510,"cvss":7.8,"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: account for fraggap on the paged allocation path\n\nIn __ip6_append_data(), when the paged-allocation branch is taken\n(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are\ncomputed as\n\n\talloclen = fragheaderlen + transhdrlen;\n\tpagedlen = datalen - transhdrlen;\n\ndatalen already includes fraggap (datalen = length + fraggap). When\nfraggap is non-zero, this is not the first skb and transhdrlen is zero.\nThe fraggap bytes carried over from the previous skb are copied just past\nthe fragment headers in the new skb's linear area. The linear area is\ntherefore undersized by fraggap bytes while pagedlen is overstated by the\nsame amount, and the copy writes past skb->end into the trailing\nskb_shared_info.\n\nAn unprivileged user can trigger this via a UDPv6 socket using\nMSG_MORE together with MSG_SPLICE_PAGES.\n\nThe bad accounting was introduced by commit 773ba4fe9104 (\"ipv6:\navoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix\n__ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative\ncopy value caused -EINVAL to be returned. That later commit allowed\nMSG_SPLICE_PAGES to proceed in this case, making the corruption\ntriggerable.\n\nThe non-paged branch sets alloclen to fraglen, which already accounts\nfor fraggap because datalen does. Bring the paged branch in line by\nadding fraggap to alloclen and subtracting it from pagedlen.\n\nAfter this adjustment, copy no longer collapses to -fraggap on the\npaged path, so remove the stale comment describing that old arithmetic.\nSince a negative copy is no longer expected for a valid MSG_SPLICE_PAGES\ncase, remove the MSG_SPLICE_PAGES exception from the negative copy check."},{"cveId":"CVE-2023-49105","priority":0,"added":"2026-08-27","dueDate":"2026-08-30","ransomware":false,"epss":0.43205,"cvss":9.8,"description":"An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no signing-key is configured for the owner of the files. The earliest affected version is 10.6.0."},{"cveId":"CVE-2026-8452","priority":0,"added":"2026-08-26","dueDate":"2026-08-29","ransomware":false,"epss":0.01606,"cvss":9.8,"description":"Memory overflow vulnerability\u00A0NetScaler ADC and NetScaler Gateway\u00A0leading to unpredictable or erroneous behavior and Denial of Service if the appliance is configured as a\u00A0Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server"},{"cveId":"CVE-2015-3246","priority":0,"added":"2026-08-26","dueDate":"2026-09-09","ransomware":false,"epss":0.08799,"cvss":5.1,"description":"libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges."},{"cveId":"CVE-2015-5287","priority":0,"added":"2026-08-26","dueDate":"2026-09-09","ransomware":false,"epss":0.04962,"cvss":7.8,"description":"The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump."},{"cveId":"CVE-2019-1068","priority":0,"added":"2026-08-26","dueDate":"2026-08-29","ransomware":false,"epss":0.52845,"cvss":8.8,"description":"A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'."},{"cveId":"CVE-2021-23758","priority":0,"added":"2026-08-26","dueDate":"2026-09-09","ransomware":false,"epss":0.83633,"cvss":8.1,"description":"All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution."},{"cveId":"CVE-2022-0995","priority":0,"added":"2026-08-26","dueDate":"2026-09-09","ransomware":false,"epss":0.09518,"cvss":7.8,"description":"An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This flaw can overwrite parts of the kernel state, potentially allowing a local user to gain privileged access or cause a denial of service on the system."},{"cveId":"CVE-2026-60004","priority":0,"added":"2026-08-25","dueDate":"2026-08-28","ransomware":false,"epss":0.86777,"cvss":9.8,"description":"Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation."},{"cveId":"CVE-2026-21962","priority":0,"added":"2026-08-24","dueDate":"2026-08-27","ransomware":false,"epss":0.42475,"cvss":10.0,"description":"Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in.  While the vulnerability is in Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data as well as  unauthorized access to critical data or complete access to all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data. Note: Affected version for Weblogic Server Proxy Plug-in for IIS is 12.2.1.4.0 only. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N)."},{"cveId":"CVE-2026-73570","priority":0,"added":"2026-08-21","dueDate":"2026-08-24","ransomware":false,"epss":0.32383,"cvss":8.9,"description":"A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user."},{"cveId":"CVE-2026-72529","priority":0,"added":"2026-08-20","dueDate":"2026-08-23","ransomware":false,"epss":0.01554,"cvss":9.8,"description":"A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function."},{"cveId":"CVE-2026-72530","priority":0,"added":"2026-08-20","dueDate":"2026-09-03","ransomware":false,"epss":0.01827,"cvss":9.0,"description":"A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system."},{"cveId":"CVE-2026-64849","priority":0,"added":"2026-08-19","dueDate":"2026-09-02","ransomware":false,"epss":0.16410,"cvss":9.3,"description":"MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0."},{"cveId":"CVE-2026-65400","priority":0,"added":"2026-08-18","dueDate":"2026-08-21","ransomware":false,"epss":0.10461,"cvss":9.8,"description":"An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1, macOS Tahoe 26.7. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials."},{"cveId":"CVE-2026-59310","priority":0,"added":"2026-08-18","dueDate":"2026-08-21","ransomware":true,"epss":0.49675,"cvss":9.8,"description":"VMware vCenter contains a directory traversal vulnerability in the Syslog server.\u00A0A malicious actor with network access to vCenter\u00A0may exploit this issue to execute arbitrary code."},{"cveId":"CVE-2026-55040","priority":0,"added":"2026-08-18","dueDate":"2026-08-21","ransomware":false,"epss":0.50585,"cvss":9.1,"description":"Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network."},{"cveId":"CVE-2026-33824","priority":0,"added":"2026-08-18","dueDate":"2026-08-21","ransomware":false,"epss":0.72695,"cvss":9.8,"description":"Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network."},{"cveId":"CVE-2025-62593","priority":0,"added":"2026-08-17","dueDate":"2026-08-20","ransomware":false,"epss":0.16888,"cvss":8.8,"description":"Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient guard against browser-based attacks, as the current defense uses the User-Agent header starting with the string \"Mozilla\" as a defense mechanism. This defense is insufficient as the fetch specification allows the User-Agent header to be modified. Combined with a DNS rebinding attack against the browser, and this vulnerability is exploitable against a developer running Ray who inadvertently visits a malicious website, or is served a malicious advertisement (malvertising). This issue has been patched in version 2.52.0."},{"cveId":"CVE-2026-20349","priority":0,"added":"2026-08-11","dueDate":"2026-08-14","ransomware":false,"epss":0.02213,"cvss":8.6,"description":"A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.&nbsp;\r\n\r\nThis vulnerability is due to insufficient error checking when processing HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the Remote Access SSL VPN service on an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition."},{"cveId":"CVE-2026-72898","priority":0,"added":"2026-08-11","dueDate":"2026-08-14","ransomware":false,"epss":0.94217,"cvss":10.0,"description":"Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance."},{"cveId":"CVE-2026-68820","priority":0,"added":"2026-08-11","dueDate":"2026-08-25","ransomware":false,"epss":0.06184,"cvss":7.0,"description":"Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally."},{"cveId":"CVE-2026-8037","priority":0,"added":"2026-08-07","dueDate":"2026-08-10","ransomware":false,"epss":0.99571,"cvss":9.6,"description":"OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints"},{"cveId":"CVE-2026-63077","priority":0,"added":"2026-08-05","dueDate":"2026-08-08","ransomware":false,"epss":0.86518,"cvss":9.8,"description":"In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol"},{"cveId":"CVE-2026-9198","priority":0,"added":"2026-08-04","dueDate":"2026-08-07","ransomware":false,"epss":0.60597,"cvss":9.8,"description":"IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments"},{"cveId":"CVE-2026-34486","priority":0,"added":"2026-08-04","dueDate":"2026-08-07","ransomware":false,"epss":0.98616,"cvss":7.5,"description":"Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the\u00A0fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.\n\nThis issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.\n\nUsers are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue."},{"cveId":"CVE-2026-18556","priority":0,"added":"2026-08-04","dueDate":"2026-08-07","ransomware":false,"epss":0.40158,"cvss":7.4,"description":"Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass.\n\nThis issue affects N-central: through 2026.1."},{"cveId":"CVE-2026-18577","priority":0,"added":"2026-08-03","dueDate":"2026-08-06","ransomware":false,"epss":0.54068,"cvss":8.1,"description":"An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1"},{"cveId":"CVE-2026-20316","priority":0,"added":"2026-07-29","dueDate":"2026-08-01","ransomware":true,"epss":0.11153,"cvss":5.3,"description":"A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.\r\n\r\nThis vulnerability is due to the presence of static user credentials for a low-privileged&nbsp;account. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and access sensitive data as the low-privileged user.&nbsp;\r\nNote:&nbsp;If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.&nbsp;&nbsp;\r\nCisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges."},{"cveId":"CVE-2026-16812","priority":0,"added":"2026-07-27","dueDate":"2026-07-30","ransomware":false,"epss":0.01568,"cvss":10.0,"description":"VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.\n\n\n\n\nThis functionality was intended to be for internal use only and is not intended to be remotely accessible.\n\n\n\n\nHosted and Dedicated versions of VCO have already been patched in advance of this notice going out.\n\n\n\n\nThis issue was discovered externally and is known to be actively exploited."},{"cveId":"CVE-2025-68686","priority":0,"added":"2026-07-27","dueDate":"2026-08-10","ransomware":false,"epss":0.29601,"cvss":5.9,"description":"An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level."},{"cveId":"CVE-2026-16232","priority":0,"added":"2026-07-22","dueDate":"2026-07-25","ransomware":false,"epss":0.72051,"cvss":9.8,"description":"An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers."},{"cveId":"CVE-2026-50522","priority":0,"added":"2026-07-22","dueDate":"2026-07-25","ransomware":false,"epss":0.85400,"cvss":9.8,"description":"Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network."},{"cveId":"CVE-2026-60137","priority":0,"added":"2026-07-21","dueDate":"2026-08-04","ransomware":false,"epss":0.78305,"cvss":5.9,"description":"WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter."},{"cveId":"CVE-2026-63030","priority":0,"added":"2026-07-21","dueDate":"2026-07-24","ransomware":false,"epss":0.97271,"cvss":9.8,"description":"WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution."},{"cveId":"CVE-2026-0770","priority":0,"added":"2026-07-21","dueDate":"2026-07-24","ransomware":false,"epss":0.63417,"cvss":9.8,"description":"Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of the exec_globals parameter provided to the validate endpoint. The issue results from the inclusion of a resource from an untrusted control sphere. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27325."},{"cveId":"CVE-2021-27137","priority":0,"added":"2026-07-21","dueDate":"2026-07-24","ransomware":false,"epss":0.03995,"cvss":8.1,"description":"An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP (which is off by default, and only listens on internal interfaces by default). This occurs in ssdp_msearch (reachable by an M-SEARCH request)."},{"cveId":"CVE-2026-58644","priority":0,"added":"2026-07-16","dueDate":"2026-07-19","ransomware":false,"epss":0.15873,"cvss":null,"description":"Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network."},{"cveId":"CVE-2026-25089","priority":0,"added":"2026-07-16","dueDate":"2026-07-19","ransomware":false,"epss":0.76112,"cvss":9.8,"description":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests"},{"cveId":"CVE-2026-39808","priority":0,"added":"2026-07-16","dueDate":"2026-07-19","ransomware":false,"epss":0.92819,"cvss":null,"description":"Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests."},{"cveId":"CVE-2026-46817","priority":0,"added":"2026-07-15","dueDate":"2026-07-18","ransomware":false,"epss":0.13017,"cvss":9.8,"description":"Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments.  Successful attacks of this vulnerability can result in takeover of Oracle Payments. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)."},{"cveId":"CVE-2023-4346","priority":0,"added":"2026-07-15","dueDate":"2026-07-29","ransomware":false,"epss":0.01294,"cvss":null,"description":"KNX Association KNX Protocol Connection Authorization Option 1 contains an overly restrictive account lockout mechanism vulnerability that could allow an attacker to purge all devices without additional security options enabled and set a BCU key to lock the device. "},{"cveId":"CVE-2026-56155","priority":0,"added":"2026-07-14","dueDate":"2026-07-28","ransomware":false,"epss":0.00346,"cvss":null,"description":"Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally."},{"cveId":"CVE-2026-56164","priority":0,"added":"2026-07-14","dueDate":"2026-07-17","ransomware":false,"epss":0.26636,"cvss":null,"description":"Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network."},{"cveId":"CVE-2026-15409","priority":0,"added":"2026-07-14","dueDate":"2026-07-17","ransomware":true,"epss":0.84535,"cvss":null,"description":"SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location."},{"cveId":"CVE-2026-15410","priority":0,"added":"2026-07-14","dueDate":"2026-07-17","ransomware":true,"epss":0.11791,"cvss":null,"description":"SonicWall SMA1000 Appliances contain a code injection vulnerability which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands."},{"cveId":"CVE-2008-4128","priority":0,"added":"2026-07-13","dueDate":"2026-07-16","ransomware":false,"epss":0.33917,"cvss":null,"description":"Cisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via (1) a certain \"show privilege\" command to the /level/15/exec/- URI, and (2) a certain \"alias exec\" command to the /level/15/exec/-/configure/http URI."},{"cveId":"CVE-2026-56291","priority":0,"added":"2026-07-10","dueDate":"2026-07-13","ransomware":false,"epss":0.14854,"cvss":9.8,"description":"Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1 - The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE."},{"cveId":"CVE-2026-48939","priority":0,"added":"2026-07-10","dueDate":"2026-07-13","ransomware":false,"epss":0.20069,"cvss":null,"description":"iCagenda contains an unrestricted upload of file with dangerous type vulnerability that allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution."},{"cveId":"CVE-2026-48908","priority":0,"added":"2026-07-07","dueDate":"2026-07-10","ransomware":false,"epss":0.15086,"cvss":null,"description":"JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability that allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code."},{"cveId":"CVE-2026-48282","priority":0,"added":"2026-07-07","dueDate":"2026-07-10","ransomware":false,"epss":0.42388,"cvss":10.0,"description":"ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed."},{"cveId":"CVE-2026-56290","priority":0,"added":"2026-07-07","dueDate":"2026-07-10","ransomware":false,"epss":0.30866,"cvss":9.8,"description":"Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 - The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE."},{"cveId":"CVE-2026-55255","priority":0,"added":"2026-07-07","dueDate":"2026-07-10","ransomware":false,"epss":0.00887,"cvss":null,"description":"Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request."},{"cveId":"CVE-2026-45659","priority":0,"added":"2026-07-01","dueDate":"2026-07-04","ransomware":true,"epss":0.76075,"cvss":8.8,"description":"Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network."},{"cveId":"CVE-2026-48558","priority":0,"added":"2026-06-29","dueDate":"2026-07-02","ransomware":false,"epss":0.64313,"cvss":null,"description":"SimpleHelp contains an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication."},{"cveId":"CVE-2026-20230","priority":0,"added":"2026-06-25","dueDate":"2026-06-28","ransomware":false,"epss":0.88200,"cvss":8.6,"description":"A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device.\r\n\r\nThis vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to write files to the underlying operating system that could be used later to elevate to root.\r\nNote: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root.\r\nNote: To exploit this vulnerability, the WebDialer service must be enabled. WebDialer is disabled by default."},{"cveId":"CVE-2026-12569","priority":0,"added":"2026-06-25","dueDate":"2026-06-28","ransomware":true,"epss":0.40586,"cvss":9.8,"description":"A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.\u00A0  *  This advisory also applies to all CPS versions\n  *  The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030"},{"cveId":"CVE-2025-67038","priority":0,"added":"2026-06-23","dueDate":"2026-06-26","ransomware":false,"epss":0.19260,"cvss":9.8,"description":"An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authentication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges."},{"cveId":"CVE-2026-34908","priority":0,"added":"2026-06-23","dueDate":"2026-06-26","ransomware":false,"epss":0.85194,"cvss":10.0,"description":"A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system."},{"cveId":"CVE-2026-34909","priority":0,"added":"2026-06-23","dueDate":"2026-06-26","ransomware":false,"epss":0.65044,"cvss":10.0,"description":"A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to access an underlying account."},{"cveId":"CVE-2026-34910","priority":0,"added":"2026-06-23","dueDate":"2026-06-26","ransomware":false,"epss":0.87468,"cvss":10.0,"description":"A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection."},{"cveId":"CVE-2026-20253","priority":0,"added":"2026-06-18","dueDate":"2026-06-21","ransomware":false,"epss":0.96939,"cvss":9.8,"description":"In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials. Splunk Enterprise versions 9.4 and earlier are not affected. If you cannot immediately upgrade to a fixed version, you can mitigate this vulnerability by disabling the PostgreSQL sidecar service."},{"cveId":"CVE-2026-48907","priority":0,"added":"2026-06-16","dueDate":"2026-06-19","ransomware":false,"epss":0.78100,"cvss":9.8,"description":"A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution."},{"cveId":"CVE-2026-54420","priority":0,"added":"2026-06-15","dueDate":"2026-06-18","ransomware":false,"epss":0.01439,"cvss":8.5,"description":"LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS, as exploited in the wild in May 2026."},{"cveId":"CVE-2026-20262","priority":0,"added":"2026-06-15","dueDate":"2026-06-29","ransomware":false,"epss":0.28171,"cvss":6.5,"description":"A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system.\r\n\r\nThis vulnerability exists because the affected software does not properly validate user-supplied input during a file upload process. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected API endpoint of the affected system. A successful exploit could allow the attacker to create or overwrite any file on the underlying operating system. This file could later be used to elevate to root. To exploit this vulnerability, the attacker must have valid credentials with at least a lower-privileged, single-task user account."},{"cveId":"CVE-2026-35273","priority":0,"added":"2026-06-12","dueDate":"2026-06-15","ransomware":true,"epss":0.95473,"cvss":9.8,"description":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)."},{"cveId":"CVE-2026-10520","priority":0,"added":"2026-06-11","dueDate":"2026-06-14","ransomware":false,"epss":0.99915,"cvss":10.0,"description":"An OS Command Injection vulnerability\u00A0in Ivanti\u00A0Sentry before\u00A0the\u00A0R10.5.2, R10.6.2 and R10.7.1\u00A0versions\u00A0allows\u00A0a remote unauthenticated user to achieve root-level remote code execution"},{"cveId":"CVE-2026-11645","priority":0,"added":"2026-06-09","dueDate":"2026-06-23","ransomware":false,"epss":0.02190,"cvss":8.8,"description":"Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)"},{"cveId":"CVE-2026-20245","priority":0,"added":"2026-06-09","dueDate":"2026-06-23","ransomware":false,"epss":0.25323,"cvss":7.8,"description":"A vulnerability in the CLI of Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system.\r\n\r\nThis vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by uploading a crafted file to the affected system. A successful exploit could allow the attacker to perform command injection attacks on an affected system and elevate their privileges as the root user.\r\nTo exploit this vulnerability, the attacker must have netadmin privileges on the affected system. This would require valid credentials or exploitation of  or . Cisco is not aware of successful exploitation by other methods. Cisco has observed limited cases where the exploitation of this bug resulted in a configuration change pushed to edge devices.\r\nCisco recommends that customers upgrade to the fixed software that is documented in the  that was published on May 14, 2026, and verify the configuration of the edge devices."},{"cveId":"CVE-2026-7473","priority":0,"added":"2026-06-09","dueDate":"2026-06-23","ransomware":false,"epss":0.01108,"cvss":null,"description":"Arista Extensible Operating System (EOS) contains an incomplete comparison with missing factors vulnerability when the switch incorrectly decapsulate and forwards other unexpected tunneled packet with a destination IP matching its configured decapsulation IP."},{"cveId":"CVE-2026-42271","priority":0,"added":"2026-06-08","dueDate":"2026-06-22","ransomware":false,"epss":0.83594,"cvss":null,"description":"BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, including holders of low-privilege internal-user keys, to run arbitrary commands on the host."},{"cveId":"CVE-2026-50751","priority":0,"added":"2026-06-08","dueDate":"2026-06-11","ransomware":true,"epss":0.83771,"cvss":9.3,"description":"A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password."},{"cveId":"CVE-2026-28318","priority":0,"added":"2026-06-05","dueDate":"2026-06-19","ransomware":false,"epss":0.40012,"cvss":7.5,"description":"SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the update"},{"cveId":"CVE-2026-45247","priority":0,"added":"2026-06-03","dueDate":"2026-06-06","ransomware":false,"epss":0.27546,"cvss":9.8,"description":"Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. Attackers can exploit the unrestricted call to PHP's native unserialize() function combined with gadget chains available in Magento and its dependencies to execute arbitrary code on the server."},{"cveId":"CVE-2025-48595","priority":0,"added":"2026-06-02","dueDate":"2026-06-05","ransomware":false,"epss":0.01714,"cvss":8.4,"description":"In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."},{"cveId":"CVE-2022-0492","priority":0,"added":"2026-06-02","dueDate":"2026-06-05","ransomware":false,"epss":0.05528,"cvss":null,"description":"Linux Kernel contains an improper authentication vulnerability which could allow for privilege escalation via the cgroups v1 release_agent feature."},{"cveId":"CVE-2024-21182","priority":0,"added":"2026-06-01","dueDate":"2026-06-04","ransomware":false,"epss":0.74162,"cvss":null,"description":"Oracle WebLogic contains an unspecified vulnerability that could allow an unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data."},{"cveId":"CVE-2026-0257","priority":0,"added":"2026-05-29","dueDate":"2026-06-01","ransomware":true,"epss":0.95156,"cvss":null,"description":"Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection."},{"cveId":"CVE-2026-45321","priority":0,"added":"2026-05-27","dueDate":"2026-06-10","ransomware":true,"epss":0.02342,"cvss":null,"description":"TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity."},{"cveId":"CVE-2026-48027","priority":0,"added":"2026-05-27","dueDate":"2026-06-10","ransomware":true,"epss":0.01850,"cvss":null,"description":"Nx Console contains an embedded malicious code vulnerability that allowed a malicious version of Nx Console to be published. The compromised extension fetched an obfuscated payload that could harvested credentials from multiple sources on disk and in memory."},{"cveId":"CVE-2026-8398","priority":0,"added":"2026-05-27","dueDate":"2026-05-30","ransomware":false,"epss":0.01456,"cvss":null,"description":"Daemon Tools contains an unspecified vulnerability that has a high impact on confidentiality, integrity, and availability."},{"cveId":"CVE-2026-48172","priority":0,"added":"2026-05-26","dueDate":"2026-05-29","ransomware":false,"epss":0.18914,"cvss":9.8,"description":"LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE \"cpanel_jsonapi_func=redisAble\" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If you get no output, you have not been hit with exploitation of the vulnerability. If there is output, we recommend you examine the IP addresses in the list, determine if they are valid IP addresses, and if not, block them. To determine damage done, examine the system logs for use by the detected IP addresses. The issue is related to mishandling of Redis enable/disable features. The recommended minimum version is 2.4.7."},{"cveId":"CVE-2026-9082","priority":0,"added":"2026-05-22","dueDate":"2026-05-27","ransomware":false,"epss":0.89986,"cvss":9.8,"description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection.\n\nThis issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10."},{"cveId":"CVE-2026-34926","priority":0,"added":"2026-05-21","dueDate":"2026-06-04","ransomware":false,"epss":0.12682,"cvss":6.7,"description":"A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.\n\n\r\nThis vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability."},{"cveId":"CVE-2025-34291","priority":0,"added":"2026-05-21","dueDate":"2026-06-04","ransomware":false,"epss":0.83629,"cvss":null,"description":"Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. This could allow the attacker to execute arbitrary code and achieve full system compromise via obtained tokens that permit access to authenticated endpoints."},{"cveId":"CVE-2026-41091","priority":0,"added":"2026-05-20","dueDate":"2026-06-03","ransomware":false,"epss":0.08202,"cvss":7.8,"description":"Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally."},{"cveId":"CVE-2026-45498","priority":0,"added":"2026-05-20","dueDate":"2026-06-03","ransomware":false,"epss":0.63076,"cvss":4.0,"description":"Microsoft Defender Denial of Service Vulnerability"},{"cveId":"CVE-2008-4250","priority":0,"added":"2026-05-20","dueDate":"2026-06-03","ransomware":false,"epss":0.98751,"cvss":null,"description":"Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote attackers to execute arbitrary code via a crafted RPC request that triggers an overflow during path canonicalization."},{"cveId":"CVE-2009-1537","priority":0,"added":"2026-05-20","dueDate":"2026-06-03","ransomware":false,"epss":0.51207,"cvss":null,"description":"Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which could allow remote attackers to execute arbitrary code via a crafted QuickTime media file."},{"cveId":"CVE-2009-3459","priority":0,"added":"2026-05-20","dueDate":"2026-06-03","ransomware":false,"epss":0.86583,"cvss":null,"description":"Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption."},{"cveId":"CVE-2010-0249","priority":0,"added":"2026-05-20","dueDate":"2026-06-03","ransomware":false,"epss":0.91939,"cvss":null,"description":"Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization."},{"cveId":"CVE-2010-0806","priority":0,"added":"2026-05-20","dueDate":"2026-06-03","ransomware":false,"epss":0.82172,"cvss":null,"description":"Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization."},{"cveId":"CVE-2026-42897","priority":0,"added":"2026-05-15","dueDate":"2026-05-29","ransomware":false,"epss":0.71766,"cvss":null,"description":"Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context."},{"cveId":"CVE-2026-20182","priority":0,"added":"2026-05-14","dueDate":"2026-05-17","ransomware":false,"epss":0.91522,"cvss":null,"description":"Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system."},{"cveId":"CVE-2026-42208","priority":0,"added":"2026-05-08","dueDate":"2026-05-11","ransomware":false,"epss":0.89420,"cvss":null,"description":"BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the proxy's database and potentially modify it, leading to unauthorized access to the proxy and the credentials it manages."},{"cveId":"CVE-2026-6973","priority":0,"added":"2026-05-07","dueDate":"2026-05-10","ransomware":false,"epss":0.34454,"cvss":null,"description":"Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vulnerability that allows a remotely authenticated user with administrative access to achieve remote code execution."},{"cveId":"CVE-2026-0300","priority":0,"added":"2026-05-06","dueDate":"2026-05-09","ransomware":false,"epss":0.31725,"cvss":null,"description":"Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service that can allow an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets."},{"cveId":"CVE-2026-31431","priority":0,"added":"2026-05-01","dueDate":"2026-05-15","ransomware":false,"epss":0.99907,"cvss":7.8,"description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: algif_aead - Revert to operating out-of-place\n\nThis mostly reverts commit 72548b093ee3 except for the copying of\nthe associated data.\n\nThere is no benefit in operating in-place in algif_aead since the\nsource and destination come from different mappings.  Get rid of\nall the complexity added for in-place operation and just copy the\nAD directly."},{"cveId":"CVE-2026-41940","priority":0,"added":"2026-04-30","dueDate":"2026-05-03","ransomware":true,"epss":0.98527,"cvss":null,"description":"WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel."},{"cveId":"CVE-2026-32202","priority":0,"added":"2026-04-28","dueDate":"2026-05-12","ransomware":false,"epss":0.63686,"cvss":4.3,"description":"Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network."},{"cveId":"CVE-2024-1708","priority":0,"added":"2026-04-28","dueDate":"2026-05-12","ransomware":true,"epss":0.95490,"cvss":null,"description":"ConnectWise ScreenConnect contains a path traversal vulnerability which could allow an attacker to execute remote code or directly impact confidential data and critical systems."},{"cveId":"CVE-2025-29635","priority":0,"added":"2026-04-24","dueDate":"2026-05-08","ransomware":false,"epss":0.87944,"cvss":null,"description":"D-Link DIR-823X contains a command injection vulnerability that allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization."},{"cveId":"CVE-2024-57726","priority":0,"added":"2026-04-24","dueDate":"2026-05-08","ransomware":true,"epss":0.66601,"cvss":null,"description":"SimpleHelp contains a missing authorization vulnerability that could allow low-privileged technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role."},{"cveId":"CVE-2024-57728","priority":0,"added":"2026-04-24","dueDate":"2026-05-08","ransomware":true,"epss":0.06982,"cvss":null,"description":"SimpleHelp contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user."},{"cveId":"CVE-2024-7399","priority":0,"added":"2026-04-24","dueDate":"2026-05-08","ransomware":false,"epss":0.91941,"cvss":null,"description":"Samsung MagicINFO 9 Server contains a path traversal vulnerability that could allow an attacker to write arbitrary files as system authority."},{"cveId":"CVE-2026-39987","priority":0,"added":"2026-04-23","dueDate":"2026-05-07","ransomware":false,"epss":0.98945,"cvss":null,"description":"Marimo contains an pre-authorization remote code execution vulnerability, allowing an unauthenticated attacked to shell access and execute arbitrary system commands."},{"cveId":"CVE-2026-33825","priority":0,"added":"2026-04-22","dueDate":"2026-05-06","ransomware":true,"epss":0.06749,"cvss":7.8,"description":"Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally."},{"cveId":"CVE-2026-20133","priority":0,"added":"2026-04-20","dueDate":"2026-04-23","ransomware":false,"epss":0.31353,"cvss":null,"description":"Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to an unauthorized actor vulnerability that could allow remote attackers to view sensitive information on affected systems."},{"cveId":"CVE-2026-20128","priority":0,"added":"2026-04-20","dueDate":"2026-04-23","ransomware":false,"epss":0.06943,"cvss":null,"description":"Cisco Catalyst SD-WAN Manager contains a storing passwords in a recoverable format vulnerability that allows an authenticated, local attacker to gain DCA user privileges by accessing a credential file for the DCA user on the filesystem as a low-privileged user."},{"cveId":"CVE-2026-20122","priority":0,"added":"2026-04-20","dueDate":"2026-04-23","ransomware":false,"epss":0.24585,"cvss":null,"description":"Cisco Catalyst SD-WAN Manager contains an incorrect use of privileged APIs vulnerability due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges."},{"cveId":"CVE-2025-32975","priority":0,"added":"2026-04-20","dueDate":"2026-05-04","ransomware":false,"epss":0.02458,"cvss":null,"description":"Quest KACE Systems Management Appliance (SMA) contains an improper authentication vulnerability that could allow attackers to impersonate legitimate users without valid credentials."},{"cveId":"CVE-2025-48700","priority":0,"added":"2026-04-20","dueDate":"2026-04-23","ransomware":false,"epss":0.01690,"cvss":null,"description":"Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that could allow attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information."},{"cveId":"CVE-2025-2749","priority":0,"added":"2026-04-20","dueDate":"2026-05-04","ransomware":false,"epss":0.03986,"cvss":null,"description":"Kentico Xperience contains a path traversal vulnerability that could allow an authenticated user's Staging Sync Server to upload arbitrary data to path relative locations."},{"cveId":"CVE-2024-27199","priority":0,"added":"2026-04-20","dueDate":"2026-05-04","ransomware":true,"epss":0.99991,"cvss":null,"description":"JetBrains TeamCity contains a relative path traversal vulnerability that could allow limited admin actions to be performed."},{"cveId":"CVE-2023-27351","priority":0,"added":"2026-04-20","dueDate":"2026-05-04","ransomware":true,"epss":0.78052,"cvss":null,"description":"PaperCut NG/MF contains an improper authentication vulnerability that could allow remote attackers to bypass authentication on affected installations via the SecurityRequestFilter class."},{"cveId":"CVE-2026-34197","priority":0,"added":"2026-04-16","dueDate":"2026-04-30","ransomware":false,"epss":0.98256,"cvss":8.8,"description":"Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ.\n\nApache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including\nBrokerService.addNetworkConnector(String) and BrokerService.addConnector(String).\n\nAn authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext.\nBecause Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().\n\n\n\nThis issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3.\n\n\n\nUsers are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue"},{"cveId":"CVE-2026-32201","priority":0,"added":"2026-04-14","dueDate":"2026-04-28","ransomware":false,"epss":0.43378,"cvss":null,"description":"Microsoft SharePoint Server contains an improper input validation vulnerability that allows an unauthorized attacker to perform spoofing over a network."},{"cveId":"CVE-2009-0238","priority":0,"added":"2026-04-14","dueDate":"2026-04-28","ransomware":false,"epss":0.43212,"cvss":null,"description":"Microsoft Office Excel contains a remote code execution vulnerability that could allow an attacker to take complete control of an affected system if a user opens a specially crafted Excel file that includes a malformed object."},{"cveId":"CVE-2012-1854","priority":0,"added":"2026-04-13","dueDate":"2026-04-27","ransomware":false,"epss":0.21028,"cvss":null,"description":"Microsoft Visual Basic for Applications (VBA) contains an insecure library loading vulnerability that could allow for remote code execution."},{"cveId":"CVE-2023-21529","priority":0,"added":"2026-04-13","dueDate":"2026-04-27","ransomware":true,"epss":0.62104,"cvss":8.8,"description":"Microsoft Exchange Server Remote Code Execution Vulnerability"},{"cveId":"CVE-2023-36424","priority":0,"added":"2026-04-13","dueDate":"2026-04-27","ransomware":false,"epss":0.12184,"cvss":null,"description":"Microsoft Windows Common Log File System Driver contains an out-of-bounds read vulnerability that could allow a threat actor for privileges escalation"},{"cveId":"CVE-2020-9715","priority":0,"added":"2026-04-13","dueDate":"2026-04-27","ransomware":false,"epss":0.48595,"cvss":null,"description":"Adobe Acrobat contains a use-after-free vulnerability that allows for code execution"},{"cveId":"CVE-2026-34621","priority":0,"added":"2026-04-13","dueDate":"2026-04-27","ransomware":false,"epss":0.07086,"cvss":8.6,"description":"Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file."},{"cveId":"CVE-2026-21643","priority":0,"added":"2026-04-13","dueDate":"2026-04-16","ransomware":false,"epss":0.94085,"cvss":null,"description":"Fortinet FortiClient EMS contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests."},{"cveId":"CVE-2025-60710","priority":0,"added":"2026-04-13","dueDate":"2026-04-27","ransomware":true,"epss":0.04598,"cvss":null,"description":"Microsoft Windows contains a link following vulnerability that allows for privilege escalation"},{"cveId":"CVE-2026-1340","priority":0,"added":"2026-04-08","dueDate":"2026-04-11","ransomware":false,"epss":0.98676,"cvss":null,"description":"Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution."},{"cveId":"CVE-2026-35616","priority":0,"added":"2026-04-06","dueDate":"2026-04-09","ransomware":false,"epss":0.90749,"cvss":9.8,"description":"A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests."},{"cveId":"CVE-2026-3502","priority":0,"added":"2026-04-02","dueDate":"2026-04-16","ransomware":false,"epss":0.05746,"cvss":null,"description":"TrueConf Client contains a download of code without integrity check vulnerability. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user."},{"cveId":"CVE-2026-5281","priority":0,"added":"2026-04-01","dueDate":"2026-04-15","ransomware":false,"epss":0.04938,"cvss":8.8,"description":"Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)"},{"cveId":"CVE-2026-3055","priority":0,"added":"2026-03-30","dueDate":"2026-04-02","ransomware":false,"epss":0.87166,"cvss":null,"description":"Citrix NetScaler ADC (formerly Citrix ADC), NetScaler Gateway (formerly Citrix Gateway) and NetScaler ADC FIPS and NDcPP contain an out-of-bounds reads vulnerability when configured as a SAML IDP leading to memory overread."},{"cveId":"CVE-2025-53521","priority":0,"added":"2026-03-27","dueDate":"2026-03-30","ransomware":false,"epss":0.02295,"cvss":null,"description":"F5 BIG-IP APM contains a stack-based buffer overflow vulnerability that could allow a threat actor to achieve remote code execution."},{"cveId":"CVE-2026-33634","priority":0,"added":"2026-03-26","dueDate":"2026-04-09","ransomware":false,"epss":0.59164,"cvss":null,"description":"Aquasecurity Trivy contains an embedded malicious code vulnerability that could allow an attacker to gain access to everything in the CI/CD environment, including all tokens, SSH keys, cloud credentials, database passwords, and any sensitive configuration in memory."},{"cveId":"CVE-2026-33017","priority":0,"added":"2026-03-25","dueDate":"2026-04-08","ransomware":false,"epss":0.96177,"cvss":null,"description":"Langflow contains a code injection vulnerability that could allow building public flows without requiring authentication."},{"cveId":"CVE-2025-54068","priority":0,"added":"2026-03-20","dueDate":"2026-04-03","ransomware":false,"epss":0.97072,"cvss":null,"description":"Laravel Livewire contain a code injection vulnerability that could allow unauthenticated attackers to achieve remote command execution in specific scenarios."},{"cveId":"CVE-2025-43510","priority":0,"added":"2026-03-20","dueDate":"2026-04-03","ransomware":false,"epss":0.00355,"cvss":null,"description":"Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain an improper locking vulnerability that could allow a malicious application to cause unexpected changes in memory shared between processes."},{"cveId":"CVE-2025-43520","priority":0,"added":"2026-03-20","dueDate":"2026-04-03","ransomware":false,"epss":0.00425,"cvss":null,"description":"Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain a classic buffer overflow vulnerability which could allow a malicious application to cause unexpected system termination or write kernel memory."},{"cveId":"CVE-2025-31277","priority":0,"added":"2026-03-20","dueDate":"2026-04-03","ransomware":false,"epss":0.01534,"cvss":null,"description":"Apple Safari, iOS, watchOS, visionOS, iPadOS, macOS, and tvOS contain a buffer overflow vulnerability that could allow the processing of maliciously crafted web content which may lead to memory corruption."},{"cveId":"CVE-2025-32432","priority":0,"added":"2026-03-20","dueDate":"2026-04-03","ransomware":false,"epss":0.99837,"cvss":null,"description":"Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary code."},{"cveId":"CVE-2026-20131","priority":0,"added":"2026-03-19","dueDate":"2026-03-22","ransomware":true,"epss":0.33379,"cvss":null,"description":"Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management interface that could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device."},{"cveId":"CVE-2026-20963","priority":0,"added":"2026-03-18","dueDate":"2026-03-21","ransomware":false,"epss":0.32613,"cvss":null,"description":"Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network."},{"cveId":"CVE-2025-66376","priority":0,"added":"2026-03-18","dueDate":"2026-04-01","ransomware":false,"epss":0.19559,"cvss":null,"description":"Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability in the Classic UI where attackers could abuse Cascading Style Sheets (CSS) @import directives in email HTML."},{"cveId":"CVE-2025-47813","priority":0,"added":"2026-03-16","dueDate":"2026-03-30","ransomware":false,"epss":0.62967,"cvss":null,"description":"Wing FTP Server contains a generation of error message containing sensitive information vulnerability when using a long value in the UID cookie."},{"cveId":"CVE-2026-3909","priority":0,"added":"2026-03-13","dueDate":"2026-03-27","ransomware":false,"epss":0.01629,"cvss":null,"description":"Google Skia contains an out-of-bounds write vulnerability that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products."},{"cveId":"CVE-2026-3910","priority":0,"added":"2026-03-13","dueDate":"2026-03-27","ransomware":false,"epss":0.02000,"cvss":null,"description":"Google Chromium V8 contains an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera."},{"cveId":"CVE-2025-68613","priority":0,"added":"2026-03-11","dueDate":"2026-03-25","ransomware":false,"epss":0.99105,"cvss":null,"description":"n8n contains an improper control of dynamically managed code resources vulnerability in its workflow expression evaluation system that allows for remote code execution."},{"cveId":"CVE-2026-1603","priority":0,"added":"2026-03-09","dueDate":"2026-03-23","ransomware":false,"epss":0.80560,"cvss":null,"description":"Ivanti Endpoint Manager (EPM) contains an authentication bypass using an alternate path or channel vulnerability that could allow a remote unauthenticated attacker to leak specific stored credential data."},{"cveId":"CVE-2025-26399","priority":0,"added":"2026-03-09","dueDate":"2026-03-12","ransomware":true,"epss":0.89500,"cvss":null,"description":"SolarWinds Web Help Desk contain a deserialization of untrusted data vulnerability in AjaxProxy that could allow an attacker to run commands on the host machine."},{"cveId":"CVE-2021-22054","priority":0,"added":"2026-03-09","dueDate":"2026-03-23","ransomware":false,"epss":0.97369,"cvss":null,"description":"Omnissa Workspace One UEM formerly known as VMware Workspace One UEM contains a server-side request forgery (SSRF) vulnerability that could allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information."},{"cveId":"CVE-2021-22681","priority":0,"added":"2026-03-05","dueDate":"2026-03-26","ransomware":false,"epss":0.63630,"cvss":null,"description":"Multiple Rockwell products contain an insufficient protected credentials vulnerability. Studio 5000 Logix Designer software may allow a key to be discovered. This key is used to verify Logix controllers are communicating with Rockwell Automation design software. If successfully exploited, this vulnerability could allow an unauthorized application to connect with Logix controllers. To leverage this vulnerability, an unauthorized user would require network access to the controller."},{"cveId":"CVE-2021-30952","priority":0,"added":"2026-03-05","dueDate":"2026-03-26","ransomware":false,"epss":0.06964,"cvss":null,"description":"Apple tvOS, macOS, Safari, iPadOS and watchOS contain an integer overflow or wraparound vulnerability due to the processing of maliciously crafted web content that may lead to arbitrary code execution."},{"cveId":"CVE-2023-41974","priority":0,"added":"2026-03-05","dueDate":"2026-03-26","ransomware":false,"epss":0.01398,"cvss":null,"description":"Apple iOS and iPadOS contain a use-after-free vulnerability. An app may be able to execute arbitrary code with kernel privileges."},{"cveId":"CVE-2017-7921","priority":0,"added":"2026-03-05","dueDate":"2026-03-26","ransomware":false,"epss":0.99998,"cvss":null,"description":"Multiple Hikvision products contain an improper authentication vulnerability that could allow a malicious user to escalate privileges on the system and gain access to sensitive information."},{"cveId":"CVE-2023-43000","priority":0,"added":"2026-03-05","dueDate":"2026-03-26","ransomware":false,"epss":0.03898,"cvss":null,"description":"Apple macOS, iOS, iPadOS, and Safari 16.6 contain a use-after-free vulnerability due to the processing of maliciously crafted web content that may lead to memory corruption."},{"cveId":"CVE-2026-21385","priority":0,"added":"2026-03-03","dueDate":"2026-03-24","ransomware":false,"epss":0.01287,"cvss":null,"description":"Multiple Qualcomm chipsets contain a memory corruption vulnerability while using alignments for memory allocation. "},{"cveId":"CVE-2026-22719","priority":0,"added":"2026-03-03","dueDate":"2026-03-24","ransomware":false,"epss":0.17424,"cvss":null,"description":"Broadcom VMware Aria Operations formerly known as vRealize Operations (vROps) contains a command injection vulnerability that allows an unauthenticated attacker to execute arbitrary commands, potentially leading to remote code execution during support‑assisted product migration."},{"cveId":"CVE-2026-20127","priority":0,"added":"2026-02-25","dueDate":"2026-02-27","ransomware":false,"epss":0.88243,"cvss":null,"description":"Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, contain an authentication bypass vulnerability could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric."},{"cveId":"CVE-2022-20775","priority":0,"added":"2026-02-25","dueDate":"2026-02-27","ransomware":false,"epss":0.12475,"cvss":null,"description":"Cisco SD-WAN CLI contains a path traversal vulnerability that could allow an authenticated local attacker to gain elevated privileges via improper access controls on commands within the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user."},{"cveId":"CVE-2026-25108","priority":0,"added":"2026-02-24","dueDate":"2026-03-17","ransomware":false,"epss":0.05066,"cvss":null,"description":"Soliton Systems K.K FileZen contains an OS command injection vulnerability when an user logs-in to the affected product and sends a specially crafted HTTP request."},{"cveId":"CVE-2025-68461","priority":0,"added":"2026-02-20","dueDate":"2026-03-13","ransomware":false,"epss":0.26842,"cvss":null,"description":"RoundCube Webmail contains a cross-site scripting vulnerability via the animate tag in an SVG document."},{"cveId":"CVE-2025-49113","priority":0,"added":"2026-02-20","dueDate":"2026-03-13","ransomware":false,"epss":0.98897,"cvss":null,"description":"RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php."},{"cveId":"CVE-2026-22769","priority":0,"added":"2026-02-18","dueDate":"2026-02-21","ransomware":false,"epss":0.13345,"cvss":null,"description":"Dell RecoverPoint for Virtual Machines (RP4VMs) contains an use of hard-coded credentials vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access to the underlying operating system and root-level persistence."},{"cveId":"CVE-2021-22175","priority":0,"added":"2026-02-18","dueDate":"2026-03-11","ransomware":false,"epss":0.53372,"cvss":null,"description":"GitLab contains a server-side request forgery (SSRF) vulnerability when requests to the internal network for webhooks are enabled."},{"cveId":"CVE-2020-7796","priority":0,"added":"2026-02-17","dueDate":"2026-03-10","ransomware":false,"epss":0.84418,"cvss":null,"description":"Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery vulnerability if WebEx zimlet installed and zimlet JSP is enabled."},{"cveId":"CVE-2008-0015","priority":0,"added":"2026-02-17","dueDate":"2026-03-10","ransomware":false,"epss":0.76733,"cvss":null,"description":"Microsoft Windows Video ActiveX Control contains a remote code execution vulnerability. An attacker could exploit the vulnerability by constructing a specially crafted Web page. When a user views the Web page, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user."},{"cveId":"CVE-2026-2441","priority":0,"added":"2026-02-17","dueDate":"2026-03-10","ransomware":false,"epss":0.22378,"cvss":null,"description":"Google Chromium CSS contains a use-after-free vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera."},{"cveId":"CVE-2024-7694","priority":0,"added":"2026-02-17","dueDate":"2026-03-10","ransomware":false,"epss":0.01807,"cvss":null,"description":"TeamT5 ThreatSonar Anti-Ransomware contains an unrestricted upload of file with dangerous type vulnerability. ThreatSonar Anti-Ransomware does not properly validate the content of uploaded files. Remote attackers with administrator privileges on the product platform can upload malicious files, which can be used to execute arbitrary system commands on the server."},{"cveId":"CVE-2026-1731","priority":0,"added":"2026-02-13","dueDate":"2026-02-16","ransomware":true,"epss":0.89500,"cvss":null,"description":"BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user. Successful exploitation requires no authentication or user interaction and may lead to system compromise, including unauthorized access, data exfiltration, and service disruption."},{"cveId":"CVE-2026-20700","priority":0,"added":"2026-02-12","dueDate":"2026-03-05","ransomware":false,"epss":0.01343,"cvss":null,"description":"Apple iOS, macOS, tvOS, watchOS, and visionOS contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow an attacker with memory write the capability to execute arbitrary code."},{"cveId":"CVE-2025-40536","priority":0,"added":"2026-02-12","dueDate":"2026-02-15","ransomware":false,"epss":0.81960,"cvss":null,"description":"SolarWinds Web Help Desk contains a security control bypass vulnerability that could allow an unauthenticated attacker to gain access to certain restricted functionality."},{"cveId":"CVE-2025-15556","priority":0,"added":"2026-02-12","dueDate":"2026-03-05","ransomware":false,"epss":0.01710,"cvss":null,"description":"Notepad++ when using the WinGUp updater, contains a download of code without integrity check vulnerability that could allow an attacker to intercept or redirect update traffic to download and execute an attacker-controlled installer. This could lead to arbitrary code execution with the privileges of the user."},{"cveId":"CVE-2024-43468","priority":0,"added":"2026-02-12","dueDate":"2026-03-05","ransomware":false,"epss":0.82022,"cvss":null,"description":"Microsoft Configuration Manager contains an SQL injection vulnerability. An unauthenticated attacker could exploit this vulnerability by sending specially crafted requests to the target environment which are processed in an unsafe manner enabling the attacker to execute commands on the server and/or underlying database."},{"cveId":"CVE-2026-21510","priority":0,"added":"2026-02-10","dueDate":"2026-03-03","ransomware":false,"epss":0.26244,"cvss":null,"description":"Microsoft Windows Shell contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network. "},{"cveId":"CVE-2026-21513","priority":0,"added":"2026-02-10","dueDate":"2026-03-03","ransomware":false,"epss":0.15642,"cvss":null,"description":"Microsoft MSHTML Framework contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network."},{"cveId":"CVE-2026-21514","priority":0,"added":"2026-02-10","dueDate":"2026-03-03","ransomware":false,"epss":0.01544,"cvss":null,"description":"Microsoft Office Word contains a reliance on untrusted inputs in a security decision vulnerability that could allow an authorized attacker to elevate privileges locally."},{"cveId":"CVE-2026-21519","priority":0,"added":"2026-02-10","dueDate":"2026-03-03","ransomware":false,"epss":0.02462,"cvss":null,"description":"Microsoft Desktop Windows Manager contains a type confusion vulnerability that could allow an authorized attacker to elevate privileges locally."},{"cveId":"CVE-2026-21525","priority":0,"added":"2026-02-10","dueDate":"2026-03-03","ransomware":false,"epss":0.05042,"cvss":null,"description":"Microsoft Windows Remote Access Connection Manager contains a NULL pointer dereference that could allow an unauthorized attacker to deny service locally."},{"cveId":"CVE-2026-21533","priority":0,"added":"2026-02-10","dueDate":"2026-03-03","ransomware":false,"epss":0.03913,"cvss":null,"description":"Microsoft Windows Remote Desktop Services contains an improper privilege management vulnerability that could allow an authorized attacker to elevate privileges locally."},{"cveId":"CVE-2026-24423","priority":0,"added":"2026-02-05","dueDate":"2026-02-26","ransomware":true,"epss":0.87988,"cvss":9.8,"description":"SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the vulnerable application."},{"cveId":"CVE-2025-11953","priority":0,"added":"2026-02-05","dueDate":"2026-02-26","ransomware":false,"epss":0.93980,"cvss":null,"description":"React Native Community CLI contains an OS command injection vulnerability which could allow unauthenticated network attackers to send POST requests to the Metro Development Server and run arbitrary executables via a vulnerable endpoint exposed by the server. On Windows, attackers can also execute arbitrary shell commands with fully controlled arguments."},{"cveId":"CVE-2025-64328","priority":0,"added":"2026-02-03","dueDate":"2026-02-24","ransomware":false,"epss":0.84618,"cvss":null,"description":"Sangoma FreePBX Endpoint Manager contains an OS command injection vulnerability that could allow for a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to potentially obtain remote access to the system as an asterisk user. "},{"cveId":"CVE-2025-40551","priority":0,"added":"2026-02-03","dueDate":"2026-02-06","ransomware":false,"epss":0.83622,"cvss":null,"description":"SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication."},{"cveId":"CVE-2019-19006","priority":0,"added":"2026-02-03","dueDate":"2026-02-24","ransomware":false,"epss":0.36615,"cvss":null,"description":"Sangoma FreePBX contains an improper authentication vulnerability that potentially allows unauthorized users to bypass password authentication and access services provided by the FreePBX admin."},{"cveId":"CVE-2021-39935","priority":0,"added":"2026-02-03","dueDate":"2026-02-24","ransomware":false,"epss":0.35649,"cvss":null,"description":"GitLab Community and Enterprise Editions contain a server-side request forgery vulnerability which could allow unauthorized external users to perform Server Side Requests via the CI Lint API. "},{"cveId":"CVE-2026-1281","priority":0,"added":"2026-01-29","dueDate":"2026-02-01","ransomware":false,"epss":0.98575,"cvss":null,"description":"Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution."},{"cveId":"CVE-2026-24858","priority":0,"added":"2026-01-27","dueDate":"2026-01-30","ransomware":false,"epss":0.86088,"cvss":null,"description":"Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contain an authentication bypass using an alternate path or channel that could allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices."},{"cveId":"CVE-2026-23760","priority":0,"added":"2026-01-26","dueDate":"2026-02-16","ransomware":true,"epss":0.96438,"cvss":9.8,"description":"SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. NOTE:\u00A0SmarterMail system administrator privileges grant the ability to execute operating system commands via built-in management functionality, effectively providing administrative (SYSTEM or root) access on the underlying host."},{"cveId":"CVE-2026-24061","priority":0,"added":"2026-01-26","dueDate":"2026-02-16","ransomware":false,"epss":0.98064,"cvss":null,"description":"GNU InetUtils contains an argument injection vulnerability in telnetd that could allow for remote authentication bypass via a \"-f root\" value for the USER environment variable."},{"cveId":"CVE-2026-21509","priority":0,"added":"2026-01-26","dueDate":"2026-02-16","ransomware":false,"epss":0.72554,"cvss":null,"description":"Microsoft Office contains a security feature bypass vulnerability in which reliance on untrusted inputs in a security decision in Microsoft Office could allow an unauthorized attacker to bypass a security feature locally. Some of the impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version."},{"cveId":"CVE-2025-52691","priority":0,"added":"2026-01-26","dueDate":"2026-02-16","ransomware":true,"epss":0.85655,"cvss":null,"description":"SmarterTools SmarterMail contains an unrestricted upload of file with dangerous type vulnerability that could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution."},{"cveId":"CVE-2018-14634","priority":0,"added":"2026-01-26","dueDate":"2026-02-16","ransomware":false,"epss":0.14689,"cvss":null,"description":"Linux Kernel contains an integer overflow vulnerability in the create_elf_tables() function which could allow an unprivileged local user with access to SUID (or otherwise privileged) binary to escalate their privileges on the system."},{"cveId":"CVE-2024-37079","priority":0,"added":"2026-01-23","dueDate":"2026-02-13","ransomware":false,"epss":0.22377,"cvss":null,"description":"Broadcom VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. This could allow a malicious actor with network access to vCenter Server to send specially crafted network packets, potentially leading to remote code execution."},{"cveId":"CVE-2025-31125","priority":0,"added":"2026-01-22","dueDate":"2026-02-12","ransomware":false,"epss":0.58462,"cvss":null,"description":"Vite Vitejs contains an improper access control vulnerability that exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected."},{"cveId":"CVE-2025-54313","priority":0,"added":"2026-01-22","dueDate":"2026-02-12","ransomware":false,"epss":0.04522,"cvss":null,"description":"Prettier eslint-config-prettier contains an embedded malicious code vulnerability. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows."},{"cveId":"CVE-2025-34026","priority":0,"added":"2026-01-22","dueDate":"2026-02-12","ransomware":false,"epss":0.81940,"cvss":null,"description":"Versa Concerto SD-WAN orchestration platform contains an improper authentication vulnerability in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs."},{"cveId":"CVE-2025-68645","priority":0,"added":"2026-01-22","dueDate":"2026-02-12","ransomware":false,"epss":0.48873,"cvss":null,"description":"Synacor Zimbra Collaboration Suite (ZCS) contains a PHP remote file inclusion vulnerability that could allow for remote attackers to craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory."},{"cveId":"CVE-2026-20045","priority":0,"added":"2026-01-21","dueDate":"2026-02-11","ransomware":false,"epss":0.04541,"cvss":null,"description":"Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance contain a code injection vulnerability that could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root."},{"cveId":"CVE-2026-20805","priority":0,"added":"2026-01-13","dueDate":"2026-02-03","ransomware":false,"epss":0.05187,"cvss":5.5,"description":"Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally."},{"cveId":"CVE-2025-8110","priority":0,"added":"2026-01-12","dueDate":"2026-02-02","ransomware":false,"epss":0.82471,"cvss":null,"description":"Gogs contains a path traversal vulnerability affecting improper Symbolic link handling in the PutContents API that could allow for code execution."},{"cveId":"CVE-2025-37164","priority":0,"added":"2026-01-07","dueDate":"2026-01-28","ransomware":false,"epss":0.90193,"cvss":null,"description":"Hewlett Packard Enterprise (HPE) OneView contains a code injection vulnerability that allows a remote unauthenticated user to perform remote code execution."},{"cveId":"CVE-2009-0556","priority":0,"added":"2026-01-07","dueDate":"2026-01-28","ransomware":false,"epss":0.67312,"cvss":null,"description":"Microsoft Office PowerPoint contains a code injection vulnerability that allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an invalid index value that triggers memory corruption."},{"cveId":"CVE-2025-14847","priority":0,"added":"2025-12-29","dueDate":"2026-01-19","ransomware":false,"epss":0.83218,"cvss":null,"description":"MongoDB Server contains an improper handling of length parameter inconsistency vulnerability in Zlib compressed protocol headers. This vulnerability may allow a read of uninitialized heap memory by an unauthenticated client."},{"cveId":"CVE-2023-52163","priority":0,"added":"2025-12-22","dueDate":"2026-01-12","ransomware":false,"epss":0.96921,"cvss":null,"description":"Digiever DS-2105 Pro contains a missing authorization vulnerability which could allow for command injection via time_tzsetup.cgi."},{"cveId":"CVE-2025-14733","priority":0,"added":"2025-12-19","dueDate":"2025-12-26","ransomware":true,"epss":0.26510,"cvss":9.8,"description":"An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.\n\nIf the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured."},{"cveId":"CVE-2025-20393","priority":0,"added":"2025-12-17","dueDate":"2025-12-24","ransomware":false,"epss":0.29875,"cvss":null,"description":"Cisco Secure Email Gateway, Secure Email, AsyncOS Software, and Web Manager appliances contains an improper input validation vulnerability that allows threat actors to execute arbitrary commands with root privileges on the underlying operating system of an affected appliance."},{"cveId":"CVE-2025-40602","priority":0,"added":"2025-12-17","dueDate":"2025-12-24","ransomware":false,"epss":0.02083,"cvss":null,"description":"SonicWall SMA1000 contains a missing authorization vulnerability that could allow for privilege escalation appliance management console (AMC) of affected devices."},{"cveId":"CVE-2025-59374","priority":0,"added":"2025-12-17","dueDate":"2026-01-07","ransomware":false,"epss":0.01197,"cvss":null,"description":"ASUS Live Update contains an embedded malicious code vulnerability client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization."},{"cveId":"CVE-2025-59718","priority":0,"added":"2025-12-16","dueDate":"2025-12-23","ransomware":false,"epss":0.68293,"cvss":null,"description":"Fortinet FortiOS, FortiSwitchMaster, FortiProxy, and FortiWeb contain an improper verification of cryptographic signature vulnerability that may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML message. Please be aware that CVE-2025-59719 pertains to the same problem and is mentioned in the same vendor advisory. Ensure to apply all patches mentioned in the advisory."},{"cveId":"CVE-2025-43529","priority":0,"added":"2025-12-15","dueDate":"2026-01-05","ransomware":false,"epss":0.08763,"cvss":null,"description":"Apple iOS, iPadOS, macOS, and other Apple products contain a use-after-free vulnerability in WebKit. Processing maliciously crafted web content may lead to memory corruption. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing."},{"cveId":"CVE-2025-14611","priority":0,"added":"2025-12-15","dueDate":"2026-01-05","ransomware":false,"epss":0.53302,"cvss":null,"description":"Gladinet CentreStack and TrioFox contain a hardcoded cryptographic keys vulnerability for their implementation of the AES cryptoscheme. This vulnerability degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication."},{"cveId":"CVE-2025-14174","priority":0,"added":"2025-12-12","dueDate":"2026-01-02","ransomware":false,"epss":0.22327,"cvss":null,"description":"Google Chromium contains an out of bounds memory access vulnerability in ANGLE that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera."},{"cveId":"CVE-2018-4063","priority":0,"added":"2025-12-12","dueDate":"2026-01-02","ransomware":false,"epss":0.27059,"cvss":null,"description":"Sierra Wireless AirLink ALEOS contains an unrestricted upload of file with dangerous type vulnerability. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticated HTTP request to trigger this vulnerability. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization."},{"cveId":"CVE-2025-58360","priority":0,"added":"2025-12-11","dueDate":"2026-01-01","ransomware":false,"epss":0.64874,"cvss":null,"description":"OSGeo GeoServer contains an improper restriction of XML external entity reference vulnerability that occurs when the application accepts XML input through a specific endpoint /geoserver/wms operation GetMap and could allow an attacker to define external entities within the XML request."},{"cveId":"CVE-2025-6218","priority":0,"added":"2025-12-09","dueDate":"2025-12-30","ransomware":false,"epss":0.90538,"cvss":null,"description":"RARLAB WinRAR contains a path traversal vulnerability allowing an attacker to execute code in the context of the current user."},{"cveId":"CVE-2025-62221","priority":0,"added":"2025-12-09","dueDate":"2025-12-30","ransomware":false,"epss":0.02505,"cvss":null,"description":"Microsoft Windows Cloud Files Mini Filter Driver contains a use after free vulnerability that can allow an authorized attacker to elevate privileges locally."},{"cveId":"CVE-2025-66644","priority":0,"added":"2025-12-08","dueDate":"2025-12-29","ransomware":false,"epss":0.03415,"cvss":null,"description":"Array Networks ArrayOS AG contains an OS command injection vulnerability that could allow an attacker to execute arbitrary commands."},{"cveId":"CVE-2022-37055","priority":0,"added":"2025-12-08","dueDate":"2025-12-29","ransomware":false,"epss":0.55531,"cvss":null,"description":"D-Link Routers contains a buffer overflow vulnerability that has a high impact on confidentiality, integrity, and availability. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization."},{"cveId":"CVE-2025-55182","priority":0,"added":"2025-12-05","dueDate":"2025-12-12","ransomware":true,"epss":0.99802,"cvss":10.0,"description":"A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints."},{"cveId":"CVE-2021-26828","priority":0,"added":"2025-12-03","dueDate":"2025-12-24","ransomware":false,"epss":0.39356,"cvss":null,"description":"OpenPLC ScadaBR contains an unrestricted upload of file with dangerous type vulnerability that allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm."},{"cveId":"CVE-2025-48633","priority":0,"added":"2025-12-02","dueDate":"2025-12-23","ransomware":false,"epss":0.00262,"cvss":null,"description":"Android Framework contains an unspecified vulnerability that allows for information disclosure."},{"cveId":"CVE-2025-48572","priority":0,"added":"2025-12-02","dueDate":"2025-12-23","ransomware":false,"epss":0.00259,"cvss":null,"description":"Android Framework contains an unspecified vulnerability that allows for privilege escalation."},{"cveId":"CVE-2021-26829","priority":0,"added":"2025-11-28","dueDate":"2025-12-19","ransomware":false,"epss":0.48050,"cvss":null,"description":"OpenPLC ScadaBR contains a cross-site scripting vulnerability via system_settings.shtm."},{"cveId":"CVE-2025-61757","priority":0,"added":"2025-11-21","dueDate":"2025-12-12","ransomware":false,"epss":0.88312,"cvss":null,"description":"Oracle Fusion Middleware contains a missing authentication for critical function vulnerability, allowing unauthenticated remote attackers to take over Identity Manager."},{"cveId":"CVE-2025-13223","priority":0,"added":"2025-11-19","dueDate":"2025-12-10","ransomware":false,"epss":0.05026,"cvss":null,"description":"Google Chromium V8 contains a type confusion vulnerability that allows for heap corruption."},{"cveId":"CVE-2025-58034","priority":0,"added":"2025-11-18","dueDate":"2025-11-25","ransomware":false,"epss":0.55580,"cvss":null,"description":"Fortinet FortiWeb contains an OS command Injection vulnerability that may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands."},{"cveId":"CVE-2025-64446","priority":0,"added":"2025-11-14","dueDate":"2025-11-21","ransomware":false,"epss":0.91838,"cvss":null,"description":"Fortinet FortiWeb contains a relative path traversal vulnerability that may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests."},{"cveId":"CVE-2025-62215","priority":0,"added":"2025-11-12","dueDate":"2025-12-03","ransomware":false,"epss":0.05985,"cvss":null,"description":"Microsoft Windows Kernel contains a race condition vulnerability that allows a local attacker with low-level privileges to escalate privileges. Successful exploitation of this vulnerability could enable the attacker to gain SYSTEM-level access."},{"cveId":"CVE-2025-9242","priority":0,"added":"2025-11-12","dueDate":"2025-12-03","ransomware":false,"epss":0.91300,"cvss":9.8,"description":"An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.\nIf the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured."},{"cveId":"CVE-2025-12480","priority":0,"added":"2025-11-12","dueDate":"2025-12-03","ransomware":false,"epss":0.90532,"cvss":null,"description":"Gladinet Triofox contains an improper access control vulnerability that allows access to initial setup pages even after setup is complete."},{"cveId":"CVE-2025-21042","priority":0,"added":"2025-11-10","dueDate":"2025-12-01","ransomware":false,"epss":0.33170,"cvss":null,"description":"Samsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so. This vulnerability could allow remote attackers to execute arbitrary code."},{"cveId":"CVE-2025-11371","priority":0,"added":"2025-11-04","dueDate":"2025-11-25","ransomware":false,"epss":0.92137,"cvss":null,"description":"Gladinet CentreStack and Triofox contains a files or directories accessible to external parties vulnerability that allows unintended disclosure of system files."},{"cveId":"CVE-2025-48703","priority":0,"added":"2025-11-04","dueDate":"2025-11-25","ransomware":false,"epss":0.99655,"cvss":null,"description":"CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command Injection vulnerability that allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known."},{"cveId":"CVE-2025-41244","priority":0,"added":"2025-10-30","dueDate":"2025-11-20","ransomware":false,"epss":0.08438,"cvss":null,"description":"Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM."},{"cveId":"CVE-2025-24893","priority":0,"added":"2025-10-30","dueDate":"2025-11-20","ransomware":false,"epss":0.99864,"cvss":null,"description":"XWiki Platform contains an eval injection vulnerability that could allow any guest to perform arbitrary remote code execution through a request to SolrSearch."},{"cveId":"CVE-2025-6204","priority":0,"added":"2025-10-28","dueDate":"2025-11-18","ransomware":false,"epss":0.77322,"cvss":null,"description":"Dassault Systèmes DELMIA Apriso contains a code injection vulnerability that could allow an attacker to execute arbitrary code."},{"cveId":"CVE-2025-6205","priority":0,"added":"2025-10-28","dueDate":"2025-11-18","ransomware":false,"epss":0.73308,"cvss":null,"description":"Dassault Systèmes DELMIA Apriso contains a missing authorization vulnerability that could allow an attacker to gain privileged access to the application."},{"cveId":"CVE-2025-59287","priority":0,"added":"2025-10-24","dueDate":"2025-11-14","ransomware":false,"epss":0.99980,"cvss":null,"description":"Microsoft Windows Server Update Service (WSUS) contains a deserialization of untrusted data vulnerability that allows for remote code execution."},{"cveId":"CVE-2025-54236","priority":0,"added":"2025-10-24","dueDate":"2025-11-14","ransomware":false,"epss":0.94532,"cvss":null,"description":"Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API."},{"cveId":"CVE-2025-61932","priority":0,"added":"2025-10-22","dueDate":"2025-11-12","ransomware":false,"epss":0.02628,"cvss":null,"description":"Motex LANSCOPE Endpoint Manager contains an improper verification of source of a communication channel vulnerability allowing an attacker to execute arbitrary code by sending specially crafted packets."},{"cveId":"CVE-2025-61884","priority":0,"added":"2025-10-20","dueDate":"2025-11-10","ransomware":true,"epss":0.95891,"cvss":7.5,"description":"Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI).  Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)."},{"cveId":"CVE-2025-33073","priority":0,"added":"2025-10-20","dueDate":"2025-11-10","ransomware":false,"epss":0.82699,"cvss":null,"description":"Microsoft Windows SMB Client contains an improper access control vulnerability that could allow for privilege escalation. An attacker could execute a specially crafted malicious script to coerce the victim machine to connect back to the attack system using SMB and authenticate."},{"cveId":"CVE-2025-2746","priority":0,"added":"2025-10-20","dueDate":"2025-11-10","ransomware":false,"epss":0.59052,"cvss":null,"description":"Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects."},{"cveId":"CVE-2025-2747","priority":0,"added":"2025-10-20","dueDate":"2025-11-10","ransomware":false,"epss":0.92488,"cvss":null,"description":"Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects."},{"cveId":"CVE-2022-48503","priority":0,"added":"2025-10-20","dueDate":"2025-11-10","ransomware":false,"epss":0.03213,"cvss":null,"description":"Apple macOS, iOS, tvOS, Safari, and watchOS contain an unspecified vulnerability in JavaScriptCore that when processing web content may lead to arbitrary code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization."},{"cveId":"CVE-2025-54253","priority":0,"added":"2025-10-15","dueDate":"2025-11-05","ransomware":false,"epss":0.87989,"cvss":null,"description":"Adobe Experience Manager Forms in JEE contains an unspecified vulnerability that allows for arbitrary code execution."},{"cveId":"CVE-2025-59230","priority":0,"added":"2025-10-14","dueDate":"2025-11-04","ransomware":false,"epss":0.02684,"cvss":null,"description":"Microsoft Windows contains an improper access control vulnerability in Windows Remote Access Connection Manager which could allow an authorized attacker to elevate privileges locally."},{"cveId":"CVE-2025-47827","priority":0,"added":"2025-10-14","dueDate":"2025-11-04","ransomware":false,"epss":0.04927,"cvss":null,"description":"IGEL OS contains a use of a key past its expiration date vulnerability that allows for Secure Boot bypass. The igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image."},{"cveId":"CVE-2025-24990","priority":0,"added":"2025-10-14","dueDate":"2025-11-04","ransomware":false,"epss":0.06369,"cvss":null,"description":"Microsoft Windows Agere Modem Driver contains an untrusted pointer dereference vulnerability that allows for privilege escalation. An attacker who successfully exploited this vulnerability could gain administrator privileges."},{"cveId":"CVE-2016-7836","priority":0,"added":"2025-10-14","dueDate":"2025-11-04","ransomware":false,"epss":0.19230,"cvss":null,"description":"SKYSEA Client View contains an improper authentication vulnerability that allows remote code execution via a flaw in processing authentication on the TCP connection with the management console program."},{"cveId":"CVE-2021-43798","priority":0,"added":"2025-10-09","dueDate":"2025-10-30","ransomware":false,"epss":0.88503,"cvss":null,"description":"Grafana contains a path traversal vulnerability that could allow access to local files."},{"cveId":"CVE-2025-27915","priority":0,"added":"2025-10-07","dueDate":"2025-10-28","ransomware":false,"epss":0.03986,"cvss":null,"description":"Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration."},{"cveId":"CVE-2025-61882","priority":0,"added":"2025-10-06","dueDate":"2025-10-27","ransomware":true,"epss":0.99732,"cvss":9.8,"description":"Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration).  Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing.  Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)."},{"cveId":"CVE-2021-43226","priority":0,"added":"2025-10-06","dueDate":"2025-10-27","ransomware":true,"epss":0.03072,"cvss":7.8,"description":"Windows Common Log File System Driver Elevation of Privilege Vulnerability"},{"cveId":"CVE-2021-22555","priority":0,"added":"2025-10-06","dueDate":"2025-10-27","ransomware":false,"epss":0.78684,"cvss":null,"description":"Linux Kernel contains a heap out-of-bounds write vulnerability that could allow an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space."},{"cveId":"CVE-2010-3765","priority":0,"added":"2025-10-06","dueDate":"2025-10-27","ransomware":false,"epss":0.83156,"cvss":null,"description":"Mozilla Firefox, SeaMonkey, and Thunderbird contain an unspecified vulnerability when JavaScript is enabled. This allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption."},{"cveId":"CVE-2010-3962","priority":0,"added":"2025-10-06","dueDate":"2025-10-27","ransomware":false,"epss":0.96831,"cvss":null,"description":"Microsoft Internet Explorer contains an uninitialized memory corruption vulnerability that could allow for remote code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization."},{"cveId":"CVE-2011-3402","priority":0,"added":"2025-10-06","dueDate":"2025-10-27","ransomware":false,"epss":0.78138,"cvss":null,"description":"Microsoft Windows Kernel contains an unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers that allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page."},{"cveId":"CVE-2013-3918","priority":0,"added":"2025-10-06","dueDate":"2025-10-27","ransomware":false,"epss":0.73693,"cvss":null,"description":"Microsoft Windows contains an out-of-bounds write vulnerability in the InformationCardSigninHelper Class ActiveX control, icardie.dll. An attacker could exploit the vulnerability by constructing a specially crafted webpage. When a user views the webpage, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization."},{"cveId":"CVE-2017-1000353","priority":0,"added":"2025-10-02","dueDate":"2025-10-23","ransomware":false,"epss":0.99679,"cvss":null,"description":"Jenkins contains a remote code execution vulnerability. This vulnerability that could allowed attackers to transfer a serialized Java SignedObject object to the remoting-based Jenkins CLI, that would be deserialized using a new ObjectInputStream, bypassing the existing blocklist-based protection mechanism."},{"cveId":"CVE-2015-7755","priority":0,"added":"2025-10-02","dueDate":"2025-10-23","ransomware":false,"epss":0.61139,"cvss":null,"description":"Juniper ScreenOS contains an improper authentication vulnerability that could allow unauthorized remote administrative access to the device."},{"cveId":"CVE-2014-6278","priority":0,"added":"2025-10-02","dueDate":"2025-10-23","ransomware":false,"epss":0.99520,"cvss":null,"description":"GNU Bash contains an OS command injection vulnerability which allows remote attackers to execute arbitrary commands via a crafted environment."},{"cveId":"CVE-2025-4008","priority":0,"added":"2025-10-02","dueDate":"2025-10-23","ransomware":false,"epss":0.93667,"cvss":null,"description":"Smartbedded Meteobridge contains a command injection vulnerability that could allow remote unauthenticated attackers to gain arbitrary command execution with elevated privileges (root) on affected devices."},{"cveId":"CVE-2025-21043","priority":0,"added":"2025-10-02","dueDate":"2025-10-23","ransomware":false,"epss":0.01907,"cvss":null,"description":"Samsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so which allows remote attackers to execute arbitrary code."},{"cveId":"CVE-2025-20352","priority":0,"added":"2025-09-29","dueDate":"2025-10-20","ransomware":false,"epss":0.39447,"cvss":null,"description":"Cisco IOS and IOS XE contains a stack-based buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) subsystem that could allow for denial of service or remote code execution. A successful exploit could allow a low-privileged attacker to cause the affected system to reload, resulting in a DoS condition, or allow a high-privileged attacker to execute arbitrary code as the root user and obtain full control of the affected system."},{"cveId":"CVE-2025-32463","priority":0,"added":"2025-09-29","dueDate":"2025-10-20","ransomware":false,"epss":0.59417,"cvss":null,"description":"Sudo contains an inclusion of functionality from untrusted control sphere vulnerability. This vulnerability could allow local attacker to leverage sudo’s -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file."},{"cveId":"CVE-2025-10035","priority":0,"added":"2025-09-29","dueDate":"2025-10-20","ransomware":true,"epss":0.99799,"cvss":10.0,"description":"A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection."},{"cveId":"CVE-2025-59689","priority":0,"added":"2025-09-29","dueDate":"2025-10-20","ransomware":false,"epss":0.01864,"cvss":null,"description":"Libraesva Email Security Gateway (ESG) contains a command injection vulnerability which allows command injection via a compressed e-mail attachment."},{"cveId":"CVE-2021-21311","priority":0,"added":"2025-09-29","dueDate":"2025-10-20","ransomware":false,"epss":0.90461,"cvss":null,"description":"Adminer contains a server-side request forgery vulnerability that, when exploited, allows a remote attacker to obtain potentially sensitive information."},{"cveId":"CVE-2025-20362","priority":0,"added":"2025-09-25","dueDate":"2025-09-26","ransomware":false,"epss":0.87085,"cvss":6.5,"description":"Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial of service (DoS) conditions. Cisco strongly recommends that all customers upgrade to the fixed software releases that are listed in the Fixed Software [\"#fs\"] section of this advisory.\r\n\r A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to access restricted URL endpoints that are related to remote access VPN that should otherwise be inaccessible without authentication.\r\n\r This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web server on a device. A successful exploit could allow the attacker to access a restricted URL without authentication."},{"cveId":"CVE-2025-20333","priority":0,"added":"2025-09-25","dueDate":"2025-09-26","ransomware":false,"epss":0.70651,"cvss":9.9,"description":"A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device.\r\n\r This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of the affected device."},{"cveId":"CVE-2025-10585","priority":0,"added":"2025-09-23","dueDate":"2025-10-14","ransomware":false,"epss":0.05391,"cvss":null,"description":"Google Chromium contains a type confusion vulnerability in the V8 JavaScript and WebAssembly engine."},{"cveId":"CVE-2025-5086","priority":0,"added":"2025-09-11","dueDate":"2025-10-02","ransomware":false,"epss":0.91917,"cvss":null,"description":"Dassault Systèmes DELMIA Apriso contains a deserialization of untrusted data vulnerability that could lead to a remote code execution."},{"cveId":"CVE-2025-53690","priority":0,"added":"2025-09-04","dueDate":"2025-09-25","ransomware":false,"epss":0.51094,"cvss":null,"description":"Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution. "},{"cveId":"CVE-2025-48543","priority":0,"added":"2025-09-04","dueDate":"2025-09-25","ransomware":false,"epss":0.00531,"cvss":null,"description":"Android Runtime contains a use-after-free vulnerability potentially allowing a chrome sandbox escape leading to local privilege escalation."},{"cveId":"CVE-2025-38352","priority":0,"added":"2025-09-04","dueDate":"2025-09-25","ransomware":false,"epss":0.01254,"cvss":7.8,"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nposix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()\n\nIf an exiting non-autoreaping task has already passed exit_notify() and\ncalls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent\nor debugger right after unlock_task_sighand().\n\nIf a concurrent posix_cpu_timer_del() runs at that moment, it won't be\nable to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or\nlock_task_sighand() will fail.\n\nAdd the tsk->exit_state check into run_posix_cpu_timers() to fix this.\n\nThis fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because\nexit_task_work() is called before exit_notify(). But the check still\nmakes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail\nanyway in this case."},{"cveId":"CVE-2025-9377","priority":0,"added":"2025-09-03","dueDate":"2025-09-24","ransomware":false,"epss":0.33524,"cvss":null,"description":"TP-Link Archer C7(EU) and TL-WR841N/ND(MS) contain an OS command injection vulnerability that exists in the Parental Control page. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization."},{"cveId":"CVE-2023-50224","priority":0,"added":"2025-09-03","dueDate":"2025-09-24","ransomware":false,"epss":0.15558,"cvss":6.5,"description":"TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-19899."},{"cveId":"CVE-2025-55177","priority":0,"added":"2025-09-02","dueDate":"2025-09-23","ransomware":false,"epss":0.04304,"cvss":null,"description":"Meta Platforms WhatsApp contains an incorrect authorization vulnerability due to an incomplete authorization of linked device synchronization messages. This vulnerability could allow an unrelated user to trigger processing of content from an arbitrary URL on a target’s device."},{"cveId":"CVE-2020-24363","priority":0,"added":"2025-09-02","dueDate":"2025-09-23","ransomware":false,"epss":0.20689,"cvss":null,"description":"TP-link TL-WA855RE contains a missing authentication for critical function vulnerability. This vulnerability could allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization."},{"cveId":"CVE-2025-57819","priority":0,"added":"2025-08-29","dueDate":"2025-09-19","ransomware":false,"epss":0.85463,"cvss":null,"description":"Sangoma FreePBX contains an authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution."},{"cveId":"CVE-2025-7775","priority":0,"added":"2025-08-26","dueDate":"2025-08-28","ransomware":false,"epss":0.19631,"cvss":null,"description":"Citrix NetScaler ADC and NetScaler Gateway contain a memory overflow vulnerability that could allow for remote code execution and/or denial of service."},{"cveId":"CVE-2025-48384","priority":0,"added":"2025-08-25","dueDate":"2025-09-15","ransomware":false,"epss":0.04109,"cvss":null,"description":"Git contains a link following vulnerability that stems from Git’s inconsistent handling of carriage return characters in configuration files."},{"cveId":"CVE-2024-8068","priority":0,"added":"2025-08-25","dueDate":"2025-09-15","ransomware":false,"epss":0.01395,"cvss":null,"description":"Citrix Session Recording contains an improper privilege management vulnerability that could allow for privilege escalation to NetworkService Account access. An attacker must be an authenticated user in the same Windows Active Directory domain as the session recording server domain."},{"cveId":"CVE-2024-8069","priority":0,"added":"2025-08-25","dueDate":"2025-09-15","ransomware":false,"epss":0.14643,"cvss":null,"description":"Citrix Session Recording contains a deserialization of untrusted data vulnerability that allows limited remote code execution with privilege of a NetworkService Account access. Attacker must be an authenticated user on the same intranet as the session recording server."},{"cveId":"CVE-2025-43300","priority":0,"added":"2025-08-21","dueDate":"2025-09-11","ransomware":false,"epss":0.21994,"cvss":null,"description":"Apple iOS, iPadOS, and macOS contain an out-of-bounds write vulnerability in the Image I/O framework."},{"cveId":"CVE-2025-54948","priority":0,"added":"2025-08-18","dueDate":"2025-09-08","ransomware":false,"epss":0.22040,"cvss":null,"description":"Trend Micro Apex One Management Console (on-premise) contains an OS command injection vulnerability that could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations."},{"cveId":"CVE-2025-8875","priority":0,"added":"2025-08-13","dueDate":"2025-08-20","ransomware":false,"epss":0.01721,"cvss":null,"description":"N-able N-Central contains an insecure deserialization vulnerability that could lead to command execution."},{"cveId":"CVE-2025-8876","priority":0,"added":"2025-08-13","dueDate":"2025-08-20","ransomware":false,"epss":0.03330,"cvss":null,"description":"N-able N-Central contains a command injection vulnerability via improper sanitization of user input."},{"cveId":"CVE-2025-8088","priority":0,"added":"2025-08-12","dueDate":"2025-09-02","ransomware":true,"epss":0.94051,"cvss":8.8,"description":"A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by\u00A0Anton Cherepanov, Peter Košinár, and Peter Strýček\n     from ESET."},{"cveId":"CVE-2013-3893","priority":0,"added":"2025-08-12","dueDate":"2025-09-02","ransomware":false,"epss":0.85813,"cvss":null,"description":"Microsoft Internet Explorer contains a memory corruption vulnerability that allows for remote code execution. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization."},{"cveId":"CVE-2007-0671","priority":0,"added":"2025-08-12","dueDate":"2025-09-02","ransomware":false,"epss":0.42379,"cvss":null,"description":"Microsoft Office Excel contains a remote code execution vulnerability that can be exploited when a specially crafted Excel file is opened. This malicious file could be delivered as an email attachment or hosted on a malicious website. An attacker could leverage this vulnerability by creating a specially crafted Excel file, which, when opened, allowing an attacker to execute remote code on the affected system."},{"cveId":"CVE-2020-25078","priority":0,"added":"2025-08-05","dueDate":"2025-08-26","ransomware":false,"epss":0.97901,"cvss":null,"description":"D-Link DCS-2530L and DCS-2670L devices contains an unspecified vulnerability that could allow for remote administrator password disclosure. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization."},{"cveId":"CVE-2020-25079","priority":0,"added":"2025-08-05","dueDate":"2025-08-26","ransomware":false,"epss":0.56317,"cvss":null,"description":"D-Link DCS-2530L and DCS-2670L devices contains a command injection vulnerability in the cgi-bin/ddns_enc.cgi. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization."},{"cveId":"CVE-2022-40799","priority":0,"added":"2025-08-05","dueDate":"2025-08-26","ransomware":false,"epss":0.33650,"cvss":null,"description":"D-Link DNR-322L contains a download of code without integrity check vulnerability that could allow an authenticated attacker to execute OS level commands on the device. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization."},{"cveId":"CVE-2023-2533","priority":0,"added":"2025-07-28","dueDate":"2025-08-18","ransomware":false,"epss":0.29246,"cvss":null,"description":"PaperCut NG/MF contains a cross-site request forgery (CSRF) vulnerability, which, under specific conditions, could potentially enable an attacker to alter security settings or execute arbitrary code. "},{"cveId":"CVE-2025-20337","priority":0,"added":"2025-07-28","dueDate":"2025-08-18","ransomware":false,"epss":0.67600,"cvss":null,"description":"Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device."},{"cveId":"CVE-2025-20281","priority":0,"added":"2025-07-28","dueDate":"2025-08-18","ransomware":false,"epss":0.97230,"cvss":null,"description":"Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device."},{"cveId":"CVE-2025-2775","priority":0,"added":"2025-07-22","dueDate":"2025-08-12","ransomware":false,"epss":0.42952,"cvss":null,"description":"SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives."},{"cveId":"CVE-2025-2776","priority":0,"added":"2025-07-22","dueDate":"2025-08-12","ransomware":false,"epss":0.64397,"cvss":null,"description":"SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives."},{"cveId":"CVE-2025-6558","priority":0,"added":"2025-07-22","dueDate":"2025-08-12","ransomware":false,"epss":0.09585,"cvss":null,"description":"Google Chromium contains an improper input validation vulnerability in ANGLE and GPU. This vulnerability could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera."},{"cveId":"CVE-2025-54309","priority":0,"added":"2025-07-22","dueDate":"2025-08-12","ransomware":false,"epss":0.94905,"cvss":null,"description":"CrushFTP contains an unprotected alternate channel vulnerability. When the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS."},{"cveId":"CVE-2025-49704","priority":0,"added":"2025-07-22","dueDate":"2025-07-23","ransomware":true,"epss":0.99995,"cvss":null,"description":"Microsoft SharePoint contains a code injection vulnerability that could allow an authorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-49706. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704."},{"cveId":"CVE-2025-49706","priority":0,"added":"2025-07-22","dueDate":"2025-07-23","ransomware":true,"epss":0.99063,"cvss":6.5,"description":"Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network."},{"cveId":"CVE-2025-53770","priority":0,"added":"2025-07-20","dueDate":"2025-07-21","ransomware":true,"epss":0.99998,"cvss":9.8,"description":"Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network.\nMicrosoft is aware that an exploit for CVE-2025-53770 exists in the wild.\nMicrosoft is preparing and fully testing a comprehensive update to address this vulnerability.  In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation."},{"cveId":"CVE-2025-25257","priority":0,"added":"2025-07-18","dueDate":"2025-08-08","ransomware":false,"epss":0.99775,"cvss":null,"description":"Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests."},{"cveId":"CVE-2025-47812","priority":0,"added":"2025-07-14","dueDate":"2025-08-04","ransomware":false,"epss":0.92862,"cvss":null,"description":"Wing FTP Server contains an improper neutralization of null byte or NUL character vulnerability that can allow injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default)."},{"cveId":"CVE-2025-5777","priority":0,"added":"2025-07-10","dueDate":"2025-07-11","ransomware":true,"epss":0.99972,"cvss":7.5,"description":"Insufficient input validation leading to memory overread when the\u00A0NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server"},{"cveId":"CVE-2014-3931","priority":0,"added":"2025-07-07","dueDate":"2025-07-28","ransomware":false,"epss":0.28978,"cvss":null,"description":"Multi-Router Looking Glass (MRLG) contains a buffer overflow vulnerability that could allow remote attackers to cause an arbitrary memory write and memory corruption."},{"cveId":"CVE-2016-10033","priority":0,"added":"2025-07-07","dueDate":"2025-07-28","ransomware":false,"epss":0.99714,"cvss":null,"description":"PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition."},{"cveId":"CVE-2019-5418","priority":0,"added":"2025-07-07","dueDate":"2025-07-28","ransomware":false,"epss":0.98507,"cvss":null,"description":"Rails Ruby on Rails contains a path traversal vulnerability in Action View. Specially crafted accept headers in combination with calls to `render file:` can cause arbitrary files on the target server to be rendered, disclosing the file contents."},{"cveId":"CVE-2019-9621","priority":0,"added":"2025-07-07","dueDate":"2025-07-28","ransomware":false,"epss":0.81037,"cvss":null,"description":"Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery (SSRF) vulnerability via the ProxyServlet component."},{"cveId":"CVE-2025-6554","priority":0,"added":"2025-07-02","dueDate":"2025-07-23","ransomware":false,"epss":0.12723,"cvss":null,"description":"Google Chromium V8 contains a type confusion vulnerability that could allow a remote attacker to perform arbitrary read/write via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera."},{"cveId":"CVE-2025-48927","priority":0,"added":"2025-07-01","dueDate":"2025-07-22","ransomware":false,"epss":0.11104,"cvss":null,"description":"TeleMessage TM SGNL contains an initialization of a resource with an insecure default vulnerability. This vulnerability relies on how the Spring Boot Actuator is configured with an exposed heap dump endpoint at a /heapdump URI."},{"cveId":"CVE-2025-48928","priority":0,"added":"2025-07-01","dueDate":"2025-07-22","ransomware":false,"epss":0.00553,"cvss":null,"description":"TeleMessage TM SGNL contains an exposure of core dump file to an unauthorized control sphere Vulnerability. This vulnerability is based on a JSP application in which the heap content is roughly equivalent to a \"core dump\" in which a password previously sent over HTTP would be included in this dump."},{"cveId":"CVE-2025-6543","priority":0,"added":"2025-06-30","dueDate":"2025-07-21","ransomware":false,"epss":0.10140,"cvss":null,"description":"Citrix NetScaler ADC and Gateway contain a buffer overflow vulnerability leading to unintended control flow and Denial of Service. NetScaler must be configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server."},{"cveId":"CVE-2024-54085","priority":0,"added":"2025-06-25","dueDate":"2025-07-16","ransomware":false,"epss":0.60747,"cvss":null,"description":"AMI MegaRAC SPx contains an authentication bypass by spoofing vulnerability in the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability."},{"cveId":"CVE-2024-0769","priority":0,"added":"2025-06-25","dueDate":"2025-07-16","ransomware":false,"epss":0.82714,"cvss":null,"description":"D-Link DIR-859 routers contain a path traversal vulnerability in the file /hedwig.cgi of the component HTTP POST Request Handler. Manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml allows for the leakage of session data potentially enabling privilege escalation and unauthorized control of the device. This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions."},{"cveId":"CVE-2019-6693","priority":0,"added":"2025-06-25","dueDate":"2025-07-16","ransomware":true,"epss":0.05828,"cvss":6.5,"description":"Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set)."},{"cveId":"CVE-2023-0386","priority":0,"added":"2025-06-17","dueDate":"2025-07-08","ransomware":false,"epss":0.07880,"cvss":null,"description":"Linux Kernel contains an improper ownership management vulnerability, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system."},{"cveId":"CVE-2023-33538","priority":0,"added":"2025-06-16","dueDate":"2025-07-07","ransomware":false,"epss":0.41874,"cvss":null,"description":"TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization."},{"cveId":"CVE-2025-43200","priority":0,"added":"2025-06-16","dueDate":"2025-07-07","ransomware":false,"epss":0.01082,"cvss":null,"description":"Apple iOS, iPadOS, macOS, watchOS, and visionOS, contain an unspecified vulnerability when processing a maliciously crafted photo or video shared via an iCloud Link."},{"cveId":"CVE-2025-33053","priority":0,"added":"2025-06-10","dueDate":"2025-07-01","ransomware":false,"epss":0.87607,"cvss":null,"description":"Microsoft Windows contains an external control of file name or path vulnerability that could allow an attacker to execute code from a remote WebDAV location specified by the WorkingDirectory attribute of Internet Shortcut files."},{"cveId":"CVE-2025-24016","priority":0,"added":"2025-06-10","dueDate":"2025-07-01","ransomware":false,"epss":0.93840,"cvss":null,"description":"Wazuh contains a deserialization of untrusted data vulnerability that allows for remote code execution on Wazuh servers."},{"cveId":"CVE-2025-32433","priority":0,"added":"2025-06-09","dueDate":"2025-06-30","ransomware":false,"epss":0.98754,"cvss":null,"description":"Erlang Erlang/OTP SSH server contains a missing authentication for critical function vulnerability. This could allow an attacker to execute arbitrary commands without valid credentials, potentially leading to unauthenticated remote code execution (RCE). By exploiting a flaw in how SSH protocol messages are handled, a malicious actor could gain unauthorized access to affected systems. This vulnerability could affect various products that implement Erlang/OTP SSH server, including—but not limited to—Cisco, NetApp, and SUSE."},{"cveId":"CVE-2024-42009","priority":0,"added":"2025-06-09","dueDate":"2025-06-30","ransomware":false,"epss":0.82882,"cvss":null,"description":"RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php."},{"cveId":"CVE-2025-5419","priority":0,"added":"2025-06-05","dueDate":"2025-06-26","ransomware":false,"epss":0.07821,"cvss":null,"description":"Google Chromium V8 contains an out-of-bounds read and write vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera."},{"cveId":"CVE-2025-27038","priority":0,"added":"2025-06-03","dueDate":"2025-06-24","ransomware":false,"epss":0.01016,"cvss":null,"description":"Multiple Qualcomm chipsets contain a use-after-free vulnerability. This vulnerability allows for memory corruption while rendering graphics using Adreno GPU drivers in Chrome."},{"cveId":"CVE-2025-21479","priority":0,"added":"2025-06-03","dueDate":"2025-06-24","ransomware":false,"epss":0.00843,"cvss":null,"description":"Multiple Qualcomm chipsets contain an incorrect authorization vulnerability. This vulnerability allows for memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands."},{"cveId":"CVE-2025-21480","priority":0,"added":"2025-06-03","dueDate":"2025-06-24","ransomware":false,"epss":0.00460,"cvss":null,"description":"Multiple Qualcomm chipsets contain an incorrect authorization vulnerability. This vulnerability allows for memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands."},{"cveId":"CVE-2024-56145","priority":0,"added":"2025-06-02","dueDate":"2025-06-23","ransomware":false,"epss":0.97446,"cvss":null,"description":"Craft CMS contains a code injection vulnerability. Users with affected versions are vulnerable to remote code execution if their php.ini configuration has `register_argc_argv` enabled."},{"cveId":"CVE-2025-35939","priority":0,"added":"2025-06-02","dueDate":"2025-06-23","ransomware":false,"epss":0.01317,"cvss":null,"description":"Craft CMS contains an external control of assumed-immutable web parameter vulnerability. This vulnerability could allow an unauthenticated client to introduce arbitrary values, such as PHP code, to a known local file location on the server. This vulnerability could be chained with CVE-2024-58136 as represented by CVE-2025-32432."},{"cveId":"CVE-2025-3935","priority":0,"added":"2025-06-02","dueDate":"2025-06-23","ransomware":false,"epss":0.03392,"cvss":null,"description":"ConnectWise ScreenConnect contains an improper authentication vulnerability. This vulnerability could allow a ViewState code injection attack, which could allow remote code execution if machine keys are compromised."},{"cveId":"CVE-2023-39780","priority":0,"added":"2025-06-02","dueDate":"2025-06-23","ransomware":false,"epss":0.40189,"cvss":null,"description":"ASUS RT-AX55 devices contain an OS command injection vulnerability that could allow a remote, authenticated attacker to execute arbitrary commands. As represented by CVE-2023-41346."},{"cveId":"CVE-2021-32030","priority":0,"added":"2025-06-02","dueDate":"2025-06-23","ransomware":false,"epss":0.99393,"cvss":null,"description":"ASUS Lyra Mini and ASUS GT-AC2900 devices contain an improper authentication vulnerability that allows an attacker to gain unauthorized access to the administrative interface. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization."},{"cveId":"CVE-2025-4632","priority":0,"added":"2025-05-22","dueDate":"2025-06-12","ransomware":false,"epss":0.24295,"cvss":null,"description":"Samsung MagicINFO 9 Server contains a path traversal vulnerability that allows an attacker to write arbitrary file as system authority."},{"cveId":"CVE-2025-4427","priority":0,"added":"2025-05-19","dueDate":"2025-06-09","ransomware":false,"epss":0.99927,"cvss":null,"description":"Ivanti Endpoint Manager Mobile (EPMM) contains an authentication bypass vulnerability in the API component that allows an attacker to access protected resources without proper credentials via crafted API requests. This vulnerability results from an insecure implementation of the Spring Framework open-source library."},{"cveId":"CVE-2025-4428","priority":0,"added":"2025-05-19","dueDate":"2025-06-09","ransomware":false,"epss":0.86519,"cvss":null,"description":"Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability in the API component that allows an authenticated attacker to remotely execute arbitrary code via crafted API requests. This vulnerability results from an insecure implementation of the Hibernate Validator open-source library, as represented by CVE-2025-35036."},{"cveId":"CVE-2025-27920","priority":0,"added":"2025-05-19","dueDate":"2025-06-09","ransomware":false,"epss":0.01855,"cvss":null,"description":"Srimax Output Messenger contains a directory traversal vulnerability that allows an attacker to access sensitive files outside the intended directory, potentially leading to configuration leakage or arbitrary file access."},{"cveId":"CVE-2024-27443","priority":0,"added":"2025-05-19","dueDate":"2025-06-09","ransomware":false,"epss":0.23632,"cvss":null,"description":"Zimbra Collaboration contains a cross-site scripting (XSS) vulnerability in the CalendarInvite feature of the Zimbra webmail classic user interface. An attacker can exploit this vulnerability via an email message containing a crafted calendar header, leading to the execution of arbitrary JavaScript code."},{"cveId":"CVE-2024-11182","priority":0,"added":"2025-05-19","dueDate":"2025-06-09","ransomware":false,"epss":0.17705,"cvss":null,"description":"MDaemon Email Server contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to load arbitrary JavaScript code via an HTML e-mail message."},{"cveId":"CVE-2023-38950","priority":0,"added":"2025-05-19","dueDate":"2025-06-09","ransomware":false,"epss":0.84702,"cvss":null,"description":"ZKTeco BioTime contains a path traversal vulnerability in the iclock API that allows an unauthenticated attacker to read arbitrary files via supplying a crafted payload."},{"cveId":"CVE-2024-12987","priority":0,"added":"2025-05-15","dueDate":"2025-06-05","ransomware":false,"epss":0.98084,"cvss":null,"description":"DrayTek Vigor2960, Vigor300B, and Vigor3900 routers contain an OS command injection vulnerability due to an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component web management interface."},{"cveId":"CVE-2025-42999","priority":0,"added":"2025-05-15","dueDate":"2025-06-05","ransomware":true,"epss":0.13868,"cvss":9.1,"description":"SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system."},{"cveId":"CVE-2025-32756","priority":0,"added":"2025-05-14","dueDate":"2025-06-04","ransomware":false,"epss":0.29812,"cvss":null,"description":"Fortinet FortiFone, FortiVoice, FortiNDR and FortiMail contain a stack-based overflow vulnerability that may allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted HTTP requests."},{"cveId":"CVE-2025-32701","priority":0,"added":"2025-05-13","dueDate":"2025-06-03","ransomware":false,"epss":0.01392,"cvss":null,"description":"Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally."},{"cveId":"CVE-2025-32706","priority":0,"added":"2025-05-13","dueDate":"2025-06-03","ransomware":false,"epss":0.02294,"cvss":null,"description":"Microsoft Windows Common Log File System (CLFS) Driver contains a heap-based buffer overflow vulnerability that allows an authorized attacker to elevate privileges locally."},{"cveId":"CVE-2025-32709","priority":0,"added":"2025-05-13","dueDate":"2025-06-03","ransomware":false,"epss":0.02140,"cvss":null,"description":"Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to escalate privileges to administrator."},{"cveId":"CVE-2025-30397","priority":0,"added":"2025-05-13","dueDate":"2025-06-03","ransomware":false,"epss":0.26835,"cvss":null,"description":"Microsoft Windows Scripting Engine contains a type confusion vulnerability that allows an unauthorized attacker to execute code over a network via a specially crafted URL."},{"cveId":"CVE-2025-30400","priority":0,"added":"2025-05-13","dueDate":"2025-06-03","ransomware":false,"epss":0.01900,"cvss":null,"description":"Microsoft Windows DWM Core Library contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally."},{"cveId":"CVE-2025-47729","priority":0,"added":"2025-05-12","dueDate":"2025-06-02","ransomware":false,"epss":0.00428,"cvss":null,"description":"TeleMessage TM SGNL contains a hidden functionality vulnerability in which the archiving backend holds cleartext copies of messages from TM SGNL application users."},{"cveId":"CVE-2024-6047","priority":0,"added":"2025-05-07","dueDate":"2025-05-28","ransomware":false,"epss":0.10072,"cvss":null,"description":"Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization."},{"cveId":"CVE-2024-11120","priority":0,"added":"2025-05-07","dueDate":"2025-05-28","ransomware":false,"epss":0.28386,"cvss":null,"description":"Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization."},{"cveId":"CVE-2025-27363","priority":0,"added":"2025-05-06","dueDate":"2025-05-27","ransomware":false,"epss":0.27775,"cvss":null,"description":"FreeType contains an out-of-bounds write vulnerability when attempting to parse font subglyph structures related to TrueType GX and variable font files that may allow for arbitrary code execution."},{"cveId":"CVE-2025-3248","priority":0,"added":"2025-05-05","dueDate":"2025-05-26","ransomware":true,"epss":0.99990,"cvss":null,"description":"Langflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated attacker to execute arbitrary code via crafted HTTP requests."},{"cveId":"CVE-2024-58136","priority":0,"added":"2025-05-02","dueDate":"2025-05-23","ransomware":false,"epss":0.87757,"cvss":null,"description":"Yii Framework contains an improper protection of alternate path vulnerability that may allow a remote attacker to execute arbitrary code. This vulnerability could affect other products that implement Yii, including—but not limited to—Craft CMS, as represented by CVE-2025-32432."},{"cveId":"CVE-2025-34028","priority":0,"added":"2025-05-02","dueDate":"2025-05-23","ransomware":false,"epss":0.97551,"cvss":null,"description":"Commvault Command Center contains a path traversal vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code."},{"cveId":"CVE-2023-44221","priority":0,"added":"2025-05-01","dueDate":"2025-05-22","ransomware":false,"epss":0.76250,"cvss":null,"description":"SonicWall SMA100 appliances contain an OS command injection vulnerability in the SSL-VPN management interface that allows a remote, authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user."},{"cveId":"CVE-2024-38475","priority":0,"added":"2025-05-01","dueDate":"2025-05-22","ransomware":false,"epss":0.99957,"cvss":null,"description":"Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure."},{"cveId":"CVE-2025-31324","priority":0,"added":"2025-04-29","dueDate":"2025-05-20","ransomware":true,"epss":0.99512,"cvss":10.0,"description":"SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system."},{"cveId":"CVE-2025-1976","priority":0,"added":"2025-04-28","dueDate":"2025-05-19","ransomware":false,"epss":0.00694,"cvss":null,"description":"Broadcom Brocade Fabric OS contains a code injection vulnerability that allows a local user with administrative privileges to execute arbitrary code with full root privileges."},{"cveId":"CVE-2025-3928","priority":0,"added":"2025-04-28","dueDate":"2025-05-19","ransomware":false,"epss":0.02140,"cvss":null,"description":"Commvault Web Server contains an unspecified vulnerability that allows a remote, authenticated attacker to create and execute webshells."},{"cveId":"CVE-2025-42599","priority":0,"added":"2025-04-28","dueDate":"2025-05-19","ransomware":false,"epss":0.03298,"cvss":null,"description":"Qualitia Active! Mail contains a stack-based buffer overflow vulnerability that allows a remote, unauthenticated attacker to execute arbitrary or trigger a denial-of-service via a specially crafted request."},{"cveId":"CVE-2025-24054","priority":0,"added":"2025-04-17","dueDate":"2025-05-08","ransomware":false,"epss":0.58909,"cvss":null,"description":"Microsoft Windows NTLM contains an external control of file name or path vulnerability that allows an unauthorized attacker to perform spoofing over a network."},{"cveId":"CVE-2025-31200","priority":0,"added":"2025-04-17","dueDate":"2025-05-08","ransomware":false,"epss":0.18593,"cvss":null,"description":"Apple iOS, iPadOS, macOS, and other Apple products contain a memory corruption vulnerability that allows for code execution when processing an audio stream in a maliciously crafted media file."},{"cveId":"CVE-2025-31201","priority":0,"added":"2025-04-17","dueDate":"2025-05-08","ransomware":false,"epss":0.13853,"cvss":null,"description":"Apple iOS, iPadOS, macOS, and other Apple products contain an arbitrary read and write vulnerability that allows an attacker to bypass Pointer Authentication."},{"cveId":"CVE-2021-20035","priority":0,"added":"2025-04-16","dueDate":"2025-05-07","ransomware":false,"epss":0.04181,"cvss":null,"description":"SonicWall SMA100 appliances contain an OS command injection vulnerability in the management interface that allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user, which could potentially lead to code execution."},{"cveId":"CVE-2024-53150","priority":0,"added":"2025-04-09","dueDate":"2025-04-30","ransomware":false,"epss":0.01351,"cvss":null,"description":"Linux Kernel contains an out-of-bounds read vulnerability in the USB-audio driver that allows a local, privileged attacker to obtain potentially sensitive information."},{"cveId":"CVE-2024-53197","priority":0,"added":"2025-04-09","dueDate":"2025-04-30","ransomware":false,"epss":0.03558,"cvss":null,"description":"Linux Kernel contains an out-of-bounds access vulnerability in the USB-audio driver that allows an attacker with physical access to the system to use a malicious USB device to potentially manipulate system memory, escalate privileges, or execute arbitrary code."},{"cveId":"CVE-2025-30406","priority":0,"added":"2025-04-08","dueDate":"2025-04-29","ransomware":false,"epss":0.94343,"cvss":null,"description":"Gladinet CentreStack and Triofox contains a use of hard-coded cryptographic key vulnerability in the way that the application manages keys used for ViewState integrity verification. Successful exploitation allows an attacker to forge ViewState payloads for server-side deserialization, allowing for remote code execution."},{"cveId":"CVE-2025-29824","priority":0,"added":"2025-04-08","dueDate":"2025-04-29","ransomware":true,"epss":0.13904,"cvss":null,"description":"Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally."},{"cveId":"CVE-2025-31161","priority":0,"added":"2025-04-07","dueDate":"2025-04-28","ransomware":true,"epss":0.99976,"cvss":null,"description":"CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin), potentially leading to a full compromise. "},{"cveId":"CVE-2025-22457","priority":0,"added":"2025-04-04","dueDate":"2025-04-11","ransomware":true,"epss":0.99981,"cvss":9.0,"description":"A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution."},{"cveId":"CVE-2025-24813","priority":0,"added":"2025-04-01","dueDate":"2025-04-22","ransomware":false,"epss":0.99927,"cvss":null,"description":"Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request. This vulnerability can be chained with CVE‑2026‑34486."},{"cveId":"CVE-2024-20439","priority":0,"added":"2025-03-31","dueDate":"2025-04-21","ransomware":false,"epss":0.92062,"cvss":null,"description":"Cisco Smart Licensing Utility contains a static credential vulnerability that allows an unauthenticated, remote attacker to log in to an affected system and gain administrative credentials."},{"cveId":"CVE-2025-2783","priority":0,"added":"2025-03-27","dueDate":"2025-04-17","ransomware":false,"epss":0.09238,"cvss":null,"description":"Google Chromium Mojo on Windows contains a sandbox escape vulnerability caused by a logic error, which results from an incorrect handle being provided in unspecified circumstances. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera."},{"cveId":"CVE-2019-9874","priority":0,"added":"2025-03-26","dueDate":"2025-04-16","ransomware":false,"epss":0.83736,"cvss":null,"description":"Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN."},{"cveId":"CVE-2019-9875","priority":0,"added":"2025-03-26","dueDate":"2025-04-16","ransomware":false,"epss":0.14042,"cvss":null,"description":"Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN."},{"cveId":"CVE-2025-30154","priority":0,"added":"2025-03-24","dueDate":"2025-04-14","ransomware":false,"epss":0.02395,"cvss":null,"description":"reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that dumps exposed secrets to Github Actions Workflow Logs."},{"cveId":"CVE-2024-48248","priority":0,"added":"2025-03-19","dueDate":"2025-04-09","ransomware":false,"epss":0.94356,"cvss":null,"description":"NAKIVO Backup and Replication contains an absolute path traversal vulnerability that enables an attacker to read arbitrary files."},{"cveId":"CVE-2025-1316","priority":0,"added":"2025-03-19","dueDate":"2025-04-09","ransomware":false,"epss":0.74482,"cvss":null,"description":"Edimax IC-7100 IP camera contains an OS command injection vulnerability due to improper input sanitization that allows an attacker to achieve remote code execution via specially crafted requests. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization."},{"cveId":"CVE-2017-12637","priority":0,"added":"2025-03-19","dueDate":"2025-04-09","ransomware":false,"epss":0.95111,"cvss":null,"description":"SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. (dot dot) in the query string."},{"cveId":"CVE-2025-30066","priority":0,"added":"2025-03-18","dueDate":"2025-04-08","ransomware":false,"epss":0.69794,"cvss":null,"description":"tj-actions/changed-files GitHub Action contains an embedded malicious code vulnerability that allows a remote attacker to discover secrets by reading Github Actions Workflow Logs. These secrets may include, but are not limited to, valid AWS access keys, GitHub personal access tokens (PATs), npm tokens, and private RSA keys."},{"cveId":"CVE-2025-24472","priority":0,"added":"2025-03-18","dueDate":"2025-04-08","ransomware":true,"epss":0.07235,"cvss":8.1,"description":"An\u00A0Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests."},{"cveId":"CVE-2025-24201","priority":0,"added":"2025-03-13","dueDate":"2025-04-03","ransomware":false,"epss":0.03804,"cvss":null,"description":"Apple iOS, iPadOS, macOS, and other Apple products contain an out-of-bounds write vulnerability in WebKit that may allow maliciously crafted web content to break out of Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing."},{"cveId":"CVE-2025-21590","priority":0,"added":"2025-03-13","dueDate":"2025-04-03","ransomware":false,"epss":0.01715,"cvss":null,"description":"Juniper Junos OS contains an improper isolation or compartmentalization vulnerability. This vulnerability could allows a local attacker with high privileges to inject arbitrary code."},{"cveId":"CVE-2025-24983","priority":0,"added":"2025-03-11","dueDate":"2025-04-01","ransomware":false,"epss":0.01348,"cvss":null,"description":"Microsoft Windows Win32 Kernel Subsystem contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally."},{"cveId":"CVE-2025-24984","priority":0,"added":"2025-03-11","dueDate":"2025-04-01","ransomware":false,"epss":0.01956,"cvss":null,"description":"Microsoft Windows New Technology File System (NTFS) contains an insertion of sensitive Information into log file vulnerability that allows an unauthorized attacker to disclose information with a physical attack. An attacker who successfully exploited this vulnerability could potentially read portions of heap memory."},{"cveId":"CVE-2025-24985","priority":0,"added":"2025-03-11","dueDate":"2025-04-01","ransomware":false,"epss":0.03846,"cvss":null,"description":"Microsoft Windows Fast FAT File System Driver contains an integer overflow or wraparound vulnerability that allows an unauthorized attacker to execute code locally."},{"cveId":"CVE-2025-26633","priority":0,"added":"2025-03-11","dueDate":"2025-04-01","ransomware":true,"epss":0.30391,"cvss":7.0,"description":"Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally."},{"cveId":"CVE-2025-24991","priority":0,"added":"2025-03-11","dueDate":"2025-04-01","ransomware":false,"epss":0.01979,"cvss":null,"description":"Microsoft Windows New Technology File System (NTFS) contains an out-of-bounds read vulnerability that allows an authorized attacker to disclose information locally."},{"cveId":"CVE-2025-24993","priority":0,"added":"2025-03-11","dueDate":"2025-04-01","ransomware":false,"epss":0.02173,"cvss":null,"description":"Microsoft Windows New Technology File System (NTFS) contains a heap-based buffer overflow vulnerability that allows an unauthorized attacker to execute code locally."},{"cveId":"CVE-2025-25181","priority":0,"added":"2025-03-10","dueDate":"2025-03-31","ransomware":false,"epss":0.57031,"cvss":null,"description":"Advantive VeraCore contains a SQL injection vulnerability in timeoutWarning.asp that allows a remote attacker to execute arbitrary SQL commands via the PmSess1 parameter."},{"cveId":"CVE-2024-57968","priority":0,"added":"2025-03-10","dueDate":"2025-03-31","ransomware":false,"epss":0.32284,"cvss":null,"description":"Advantive VeraCore contains an unrestricted file upload vulnerability that allows a remote unauthenticated attacker to upload files to unintended folders via upload.apsx."},{"cveId":"CVE-2024-13159","priority":0,"added":"2025-03-10","dueDate":"2025-03-31","ransomware":false,"epss":0.99992,"cvss":null,"description":"Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information."},{"cveId":"CVE-2024-13160","priority":0,"added":"2025-03-10","dueDate":"2025-03-31","ransomware":false,"epss":0.91247,"cvss":null,"description":"Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information."},{"cveId":"CVE-2024-13161","priority":0,"added":"2025-03-10","dueDate":"2025-03-31","ransomware":false,"epss":0.90081,"cvss":null,"description":"Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information."},{"cveId":"CVE-2024-50302","priority":0,"added":"2025-03-04","dueDate":"2025-03-25","ransomware":false,"epss":0.00811,"cvss":null,"description":"The Linux kernel contains a use of uninitialized resource vulnerability that allows an attacker to leak kernel memory via a specially crafted HID report."},{"cveId":"CVE-2025-22224","priority":0,"added":"2025-03-04","dueDate":"2025-03-25","ransomware":false,"epss":0.01561,"cvss":null,"description":"VMware ESXi and Workstation contain a time-of-check time-of-use (TOCTOU) race condition vulnerability that leads to an out-of-bounds write. Successful exploitation enables an attacker with local administrative privileges on a virtual machine to execute code as the virtual machine's VMX process running on the host."},{"cveId":"CVE-2025-22225","priority":0,"added":"2025-03-04","dueDate":"2025-03-25","ransomware":true,"epss":0.00997,"cvss":8.2,"description":"VMware ESXi contains an arbitrary write\u00A0vulnerability.\u00A0A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox."},{"cveId":"CVE-2025-22226","priority":0,"added":"2025-03-04","dueDate":"2025-03-25","ransomware":false,"epss":0.01735,"cvss":null,"description":"VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. Successful exploitation allows an attacker with administrative privileges to a virtual machine to leak memory from the vmx process."},{"cveId":"CVE-2024-4885","priority":0,"added":"2025-03-03","dueDate":"2025-03-24","ransomware":false,"epss":0.99288,"cvss":null,"description":"Progress WhatsUp Gold contains a path traversal vulnerability that allows an unauthenticated attacker to achieve remote code execution."},{"cveId":"CVE-2018-8639","priority":0,"added":"2025-03-03","dueDate":"2025-03-24","ransomware":true,"epss":0.22179,"cvss":null,"description":"Microsoft Windows Win32k contains an improper resource shutdown or release vulnerability that allows for local, authenticated privilege escalation. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode."},{"cveId":"CVE-2022-43769","priority":0,"added":"2025-03-03","dueDate":"2025-03-24","ransomware":false,"epss":0.97670,"cvss":null,"description":"Hitachi Vantara Pentaho BA Server contains a special element injection vulnerability that allows an attacker to inject Spring templates into properties files, allowing for arbitrary command execution."},{"cveId":"CVE-2022-43939","priority":0,"added":"2025-03-03","dueDate":"2025-03-24","ransomware":false,"epss":0.92266,"cvss":null,"description":"Hitachi Vantara Pentaho BA Server contains a use of non-canonical URL paths for authorization decisions vulnerability that enables an attacker to bypass authorization."},{"cveId":"CVE-2023-20118","priority":0,"added":"2025-03-03","dueDate":"2025-03-24","ransomware":false,"epss":0.54107,"cvss":null,"description":"Multiple Cisco Small Business RV Series Routers contains a command injection vulnerability in the web-based management interface. Successful exploitation could allow an authenticated, remote attacker to gain root-level privileges and access unauthorized data."},{"cveId":"CVE-2023-34192","priority":0,"added":"2025-02-25","dueDate":"2025-03-18","ransomware":false,"epss":0.77266,"cvss":null,"description":"Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability that allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function."},{"cveId":"CVE-2024-49035","priority":0,"added":"2025-02-25","dueDate":"2025-03-18","ransomware":false,"epss":0.01300,"cvss":null,"description":"Microsoft Partner Center contains an improper access control vulnerability that allows an attacker to escalate privileges."},{"cveId":"CVE-2024-20953","priority":0,"added":"2025-02-24","dueDate":"2025-03-17","ransomware":false,"epss":0.03934,"cvss":null,"description":"Oracle Agile Product Lifecycle Management (PLM) contains a deserialization vulnerability that allows a low-privileged attacker with network access via HTTP to compromise the system."},{"cveId":"CVE-2017-3066","priority":0,"added":"2025-02-24","dueDate":"2025-03-17","ransomware":false,"epss":0.90597,"cvss":null,"description":"Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution."},{"cveId":"CVE-2025-24989","priority":0,"added":"2025-02-21","dueDate":"2025-03-14","ransomware":false,"epss":0.01622,"cvss":null,"description":"Microsoft Power Pages contains an improper access control vulnerability that allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control."},{"cveId":"CVE-2025-23209","priority":0,"added":"2025-02-20","dueDate":"2025-03-13","ransomware":false,"epss":0.21776,"cvss":null,"description":"Craft CMS contains a code injection vulnerability caused by improper validation of the database backup path, ultimately enabling remote code execution."},{"cveId":"CVE-2025-0111","priority":0,"added":"2025-02-20","dueDate":"2025-03-13","ransomware":false,"epss":0.01999,"cvss":null,"description":"Palo Alto Networks PAN-OS contains an external control of file name or path vulnerability. Successful exploitation enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user."},{"cveId":"CVE-2025-0108","priority":0,"added":"2025-02-18","dueDate":"2025-03-11","ransomware":false,"epss":0.98455,"cvss":null,"description":"Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in its management web interface. This vulnerability allows an unauthenticated attacker with network access to the management web interface to bypass the authentication normally required and invoke certain PHP scripts."},{"cveId":"CVE-2024-53704","priority":0,"added":"2025-02-18","dueDate":"2025-03-11","ransomware":true,"epss":0.95132,"cvss":9.8,"description":"An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication."},{"cveId":"CVE-2024-57727","priority":0,"added":"2025-02-13","dueDate":"2025-03-06","ransomware":true,"epss":0.95151,"cvss":7.5,"description":"SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files include server configuration files containing various secrets and hashed user passwords."},{"cveId":"CVE-2025-24200","priority":0,"added":"2025-02-12","dueDate":"2025-03-05","ransomware":false,"epss":0.04457,"cvss":null,"description":"Apple iOS and iPadOS contains an incorrect authorization vulnerability that allows a physical attacker to disable USB Restricted Mode on a locked device."},{"cveId":"CVE-2024-41710","priority":0,"added":"2025-02-12","dueDate":"2025-03-05","ransomware":false,"epss":0.41646,"cvss":null,"description":"Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, contain an argument injection vulnerability due to insufficient parameter sanitization during the boot process. Successful exploitation may allow an attacker to execute arbitrary commands within the context of the system."},{"cveId":"CVE-2024-40890","priority":0,"added":"2025-02-11","dueDate":"2025-03-04","ransomware":false,"epss":0.22251,"cvss":null,"description":"Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the CGI program that could allow an authenticated attacker to execute OS commands via a crafted HTTP request."},{"cveId":"CVE-2024-40891","priority":0,"added":"2025-02-11","dueDate":"2025-03-04","ransomware":false,"epss":0.21536,"cvss":null,"description":"Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the management commands that could allow an authenticated attacker to execute OS commands via Telnet."},{"cveId":"CVE-2025-21391","priority":0,"added":"2025-02-11","dueDate":"2025-03-04","ransomware":false,"epss":0.02303,"cvss":null,"description":"Microsoft Windows Storage contains a link following vulnerability that could allow for privilege escalation. This vulnerability could allow an attacker to delete data including data that results in the service being unavailable."},{"cveId":"CVE-2025-21418","priority":0,"added":"2025-02-11","dueDate":"2025-03-04","ransomware":false,"epss":0.01568,"cvss":null,"description":"Microsoft Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges."},{"cveId":"CVE-2025-0994","priority":0,"added":"2025-02-07","dueDate":"2025-02-28","ransomware":false,"epss":0.31309,"cvss":null,"description":"Trimble Cityworks contains a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer's Microsoft Internet Information Services (IIS) web server."},{"cveId":"CVE-2025-0411","priority":0,"added":"2025-02-06","dueDate":"2025-02-27","ransomware":false,"epss":0.67071,"cvss":null,"description":"7-Zip contains a protection mechanism failure vulnerability that allows remote attackers to bypass the Mark-of-the-Web security feature to execute arbitrary code in the context of the current user."},{"cveId":"CVE-2024-21413","priority":0,"added":"2025-02-06","dueDate":"2025-02-27","ransomware":false,"epss":0.94660,"cvss":9.8,"description":"Microsoft Outlook Remote Code Execution Vulnerability"},{"cveId":"CVE-2022-23748","priority":0,"added":"2025-02-06","dueDate":"2025-02-27","ransomware":false,"epss":0.09092,"cvss":null,"description":"Dante Discovery contains a process control vulnerability in mDNSResponder.exe that all allows for a DLL sideloading attack. A local attacker can leverage this vulnerability in the Dante Application Library to execute arbitrary code."},{"cveId":"CVE-2020-29574","priority":0,"added":"2025-02-06","dueDate":"2025-02-27","ransomware":true,"epss":0.04658,"cvss":9.8,"description":"An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely."},{"cveId":"CVE-2020-15069","priority":0,"added":"2025-02-06","dueDate":"2025-02-27","ransomware":false,"epss":0.10674,"cvss":null,"description":"Sophos XG Firewall contains a buffer overflow vulnerability that allows for remote code execution via the \"HTTP/S bookmark\" feature."},{"cveId":"CVE-2024-53104","priority":0,"added":"2025-02-05","dueDate":"2025-02-26","ransomware":false,"epss":0.03395,"cvss":null,"description":"Linux kernel contains an out-of-bounds write vulnerability in the uvc_parse_streaming component of the USB Video Class (UVC) driver that could allow for physical escalation of privilege."},{"cveId":"CVE-2024-45195","priority":0,"added":"2025-02-04","dueDate":"2025-02-25","ransomware":false,"epss":0.99983,"cvss":null,"description":"Apache OFBiz contains a forced browsing vulnerability that allows a remote attacker to obtain unauthorized access."},{"cveId":"CVE-2024-29059","priority":0,"added":"2025-02-04","dueDate":"2025-02-25","ransomware":false,"epss":0.98624,"cvss":null,"description":"Microsoft .NET Framework contains an information disclosure vulnerability that exposes the ObjRef URI to an attacker, ultimately enabling remote code execution."},{"cveId":"CVE-2018-19410","priority":0,"added":"2025-02-04","dueDate":"2025-02-25","ransomware":false,"epss":0.97939,"cvss":null,"description":"Paessler PRTG Network Monitor contains a local file inclusion vulnerability that allows a remote, unauthenticated attacker to create users with read-write privileges (including administrator)."},{"cveId":"CVE-2018-9276","priority":0,"added":"2025-02-04","dueDate":"2025-02-25","ransomware":false,"epss":0.86996,"cvss":null,"description":"Paessler PRTG Network Monitor contains an OS command injection vulnerability that allows an attacker with administrative privileges to execute commands via the PRTG System Administrator web console."},{"cveId":"CVE-2025-24085","priority":0,"added":"2025-01-29","dueDate":"2025-02-19","ransomware":false,"epss":0.17648,"cvss":null,"description":"Apple iOS, macOS, and other Apple products contain a user-after-free vulnerability that could allow a malicious application to elevate privileges."},{"cveId":"CVE-2025-23006","priority":0,"added":"2025-01-24","dueDate":"2025-02-14","ransomware":true,"epss":0.23432,"cvss":9.8,"description":"Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), which in specific conditions could potentially enable a remote unauthenticated attacker to execute arbitrary OS commands."},{"cveId":"CVE-2020-11023","priority":0,"added":"2025-01-23","dueDate":"2025-02-13","ransomware":false,"epss":0.84887,"cvss":null,"description":"JQuery contains a persistent cross-site scripting (XSS) vulnerability. When passing maliciously formed, untrusted input enclosed in HTML tags, JQuery's DOM manipulators can execute untrusted code in the context of the user's browser."},{"cveId":"CVE-2024-50603","priority":0,"added":"2025-01-16","dueDate":"2025-02-06","ransomware":false,"epss":0.98545,"cvss":null,"description":"Aviatrix Controllers contain an OS command injection vulnerability that could allow an unauthenticated attacker to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test."},{"cveId":"CVE-2024-55591","priority":0,"added":"2025-01-14","dueDate":"2025-01-21","ransomware":true,"epss":0.98259,"cvss":9.8,"description":"An\u00A0Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to\u00A0Node.js websocket module."},{"cveId":"CVE-2025-21333","priority":0,"added":"2025-01-14","dueDate":"2025-02-04","ransomware":false,"epss":0.09988,"cvss":null,"description":"Microsoft Windows Hyper-V NT Kernel Integration VSP contains a heap-based buffer overflow vulnerability that allows a local attacker to gain SYSTEM privileges."},{"cveId":"CVE-2025-21334","priority":0,"added":"2025-01-14","dueDate":"2025-02-04","ransomware":false,"epss":0.01561,"cvss":null,"description":"Microsoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges."},{"cveId":"CVE-2025-21335","priority":0,"added":"2025-01-14","dueDate":"2025-02-04","ransomware":false,"epss":0.01390,"cvss":null,"description":"Microsoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges."},{"cveId":"CVE-2024-12686","priority":0,"added":"2025-01-13","dueDate":"2025-02-03","ransomware":false,"epss":0.13788,"cvss":null,"description":"BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain an OS command injection vulnerability that can be exploited by an attacker with existing administrative privileges to upload a malicious file. Successful exploitation of this vulnerability can allow a remote attacker to execute underlying operating system commands within the context of the site user."},{"cveId":"CVE-2023-48365","priority":0,"added":"2025-01-13","dueDate":"2025-02-03","ransomware":true,"epss":0.24491,"cvss":null,"description":"Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software."},{"cveId":"CVE-2025-0282","priority":0,"added":"2025-01-08","dueDate":"2025-01-15","ransomware":true,"epss":0.99979,"cvss":9.0,"description":"A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution."},{"cveId":"CVE-2024-55550","priority":0,"added":"2025-01-07","dueDate":"2025-01-28","ransomware":true,"epss":0.37899,"cvss":2.7,"description":"Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization. A successful exploit could allow the authenticated admin attacker to access resources that are constrained to the admin access level, and the disclosure is limited to non-sensitive system information. This vulnerability does not allow file modification or privilege escalation."},{"cveId":"CVE-2024-41713","priority":0,"added":"2025-01-07","dueDate":"2025-01-28","ransomware":true,"epss":0.98110,"cvss":9.1,"description":"A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the attacker to view, corrupt, or delete users' data and system configurations."},{"cveId":"CVE-2020-2883","priority":0,"added":"2025-01-07","dueDate":"2025-01-28","ransomware":false,"epss":0.94928,"cvss":null,"description":"Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an unspecified vulnerability exploitable by an unauthenticated attacker with network access via IIOP or T3."},{"cveId":"CVE-2024-3393","priority":0,"added":"2024-12-30","dueDate":"2025-01-20","ransomware":false,"epss":0.28408,"cvss":null,"description":"Palo Alto Networks PAN-OS contains a vulnerability in parsing and logging malicious DNS packets in the DNS Security feature that, when exploited, allows an unauthenticated attacker to remotely reboot the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode."},{"cveId":"CVE-2021-44207","priority":0,"added":"2024-12-23","dueDate":"2025-01-13","ransomware":false,"epss":0.17578,"cvss":null,"description":"Acclaim Systems USAHERDS contains a hard-coded credentials vulnerability that could allow an attacker to achieve remote code execution on the system that runs the application. The MachineKey must be obtained via a separate vulnerability or other channel."},{"cveId":"CVE-2024-12356","priority":0,"added":"2024-12-19","dueDate":"2024-12-27","ransomware":false,"epss":0.87991,"cvss":null,"description":"BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain a command injection vulnerability, which can allow an unauthenticated attacker to inject commands that are run as a site user. "},{"cveId":"CVE-2022-23227","priority":0,"added":"2024-12-18","dueDate":"2025-01-08","ransomware":false,"epss":0.48497,"cvss":null,"description":"NUUO NVRmini2 devices contain a missing authentication vulnerability that allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users. "},{"cveId":"CVE-2021-40407","priority":0,"added":"2024-12-18","dueDate":"2025-01-08","ransomware":false,"epss":0.47635,"cvss":null,"description":"Reolink RLC-410W IP cameras contain an authenticated OS command injection vulnerability in the device network settings functionality."},{"cveId":"CVE-2019-11001","priority":0,"added":"2024-12-18","dueDate":"2025-01-08","ransomware":false,"epss":0.37542,"cvss":null,"description":"Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W IP cameras contain an authenticated OS command injection vulnerability. This vulnerability allows an authenticated admin to use the \"TestEmail\" functionality to inject and run OS commands as root."},{"cveId":"CVE-2018-14933","priority":0,"added":"2024-12-18","dueDate":"2025-01-08","ransomware":false,"epss":0.94884,"cvss":null,"description":"NUUO NVRmini devices contain an OS command injection vulnerability. This vulnerability allows remote command execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command."},{"cveId":"CVE-2024-55956","priority":0,"added":"2024-12-17","dueDate":"2025-01-07","ransomware":true,"epss":0.94037,"cvss":9.8,"description":"In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory."},{"cveId":"CVE-2024-20767","priority":0,"added":"2024-12-16","dueDate":"2025-01-06","ransomware":false,"epss":0.98514,"cvss":null,"description":"Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel."},{"cveId":"CVE-2024-35250","priority":0,"added":"2024-12-16","dueDate":"2025-01-06","ransomware":false,"epss":0.25033,"cvss":null,"description":"Microsoft Windows Kernel-Mode Driver contains an untrusted pointer dereference vulnerability that allows a local attacker to escalate privileges."},{"cveId":"CVE-2024-50623","priority":0,"added":"2024-12-13","dueDate":"2025-01-03","ransomware":true,"epss":0.98607,"cvss":9.8,"description":"In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution."},{"cveId":"CVE-2024-49138","priority":0,"added":"2024-12-10","dueDate":"2024-12-31","ransomware":false,"epss":0.26215,"cvss":null,"description":"Microsoft Windows Common Log File System (CLFS) driver contains a heap-based buffer overflow vulnerability that allows a local attacker to escalate privileges."},{"cveId":"CVE-2024-51378","priority":0,"added":"2024-12-04","dueDate":"2024-12-25","ransomware":true,"epss":0.94668,"cvss":10.0,"description":"getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected."},{"cveId":"CVE-2024-11667","priority":0,"added":"2024-12-03","dueDate":"2024-12-24","ransomware":true,"epss":0.02929,"cvss":7.5,"description":"A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware\u00A0versions V5.00 through V5.38,\u00A0USG FLEX 50(W) series firmware\u00A0versions V5.10 through V5.38, and\u00A0USG20(W)-VPN series firmware\u00A0versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL."},{"cveId":"CVE-2024-11680","priority":0,"added":"2024-12-03","dueDate":"2024-12-24","ransomware":false,"epss":0.91697,"cvss":null,"description":"ProjectSend contains an improper authentication vulnerability that allows a remote, unauthenticated attacker to enable unauthorized modification of the application's configuration via crafted HTTP requests to options.php. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript."},{"cveId":"CVE-2023-45727","priority":0,"added":"2024-12-03","dueDate":"2024-12-24","ransomware":false,"epss":0.03542,"cvss":null,"description":"North Grid Proself Enterprise/Standard, Gateway, and Mail Sanitize contain an improper restriction of XML External Entity (XXE) reference vulnerability, which could allow a remote, unauthenticated attacker to conduct an XXE attack."},{"cveId":"CVE-2023-28461","priority":0,"added":"2024-11-25","dueDate":"2024-12-16","ransomware":true,"epss":0.68079,"cvss":9.8,"description":"Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. The product could then be exploited through a vulnerable URL. The 2023-03-09 vendor advisory stated \"a new Array AG release with the fix will be available soon.\""},{"cveId":"CVE-2024-21287","priority":0,"added":"2024-11-21","dueDate":"2024-12-12","ransomware":false,"epss":0.01723,"cvss":null,"description":"Oracle Agile Product Lifecycle Management (PLM) contains an incorrect authorization vulnerability in the Process Extension component of the Software Development Kit. Successful exploitation of this vulnerability may result in unauthenticated file disclosure."},{"cveId":"CVE-2024-44308","priority":0,"added":"2024-11-21","dueDate":"2024-12-12","ransomware":false,"epss":0.10157,"cvss":null,"description":"Apple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lead to arbitrary code execution."},{"cveId":"CVE-2024-44309","priority":0,"added":"2024-11-21","dueDate":"2024-12-12","ransomware":false,"epss":0.22590,"cvss":null,"description":"Apple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lead to a cross-site scripting (XSS) attack."},{"cveId":"CVE-2024-38812","priority":0,"added":"2024-11-20","dueDate":"2024-12-11","ransomware":false,"epss":0.54571,"cvss":null,"description":"VMware vCenter Server contains a heap-based buffer overflow vulnerability in the implementation of the DCERPC protocol. This vulnerability could allow an attacker with network access to the vCenter Server to execute remote code by sending a specially crafted packet."},{"cveId":"CVE-2024-38813","priority":0,"added":"2024-11-20","dueDate":"2024-12-11","ransomware":false,"epss":0.17355,"cvss":null,"description":"VMware vCenter contains an improper check for dropped privileges vulnerability. This vulnerability could allow an attacker with network access to the vCenter Server to escalate privileges to root by sending a specially crafted packet."},{"cveId":"CVE-2024-1212","priority":0,"added":"2024-11-18","dueDate":"2024-12-09","ransomware":false,"epss":0.95388,"cvss":null,"description":"Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution."}]}