CVE Vulnerability Advisory Database

[Affected Scope] MLflow versions from 3.3.0 prior to 3.15.0

[Impact] Unauthenticated attackers can bypass URL validation to access internal network resources or cloud metadata services, potentially retrieving sensitive credentials and response data.

[Mitigation] Immediately upgrade MLflow to version 3.15.0 or later, and restrict access to the webhook test endpoint in the interim.

[Affected Scope] VMware ESX hypervisor environments.

[Impact] High-privileged attackers can perform unauthorized operations without generating audit logs, hindering incident response and forensic analysis.

[Mitigation] Apply the latest security patches from Broadcom and strengthen external Syslog integration.

[Affected Scope] Kestra open-source versions prior to 1.0.45 and 1.3.21

[Impact] Unauthenticated remote attackers can bypass authentication filters to create and execute arbitrary workflows, leading to Remote Code Execution (RCE) as root inside the worker container

[Mitigation] Immediately upgrade Kestra to version 1.0.45, 1.3.21, or higher

[Affected Scope] ethos utility in RIOT OS versions up to and including 2026.01-devel-317

[Impact] Unauthenticated remote attackers can send crafted serial or TCP-framed input to corrupt memory, leading to application crashes or potential arbitrary code execution

[Mitigation] Apply the latest source code patches, or manually implement bounds checking in the ethos utility's frame parser and rebuild

[Affected Scope] Developers running Ray AI compute engine versions prior to 2.52.0 in local or development environments

[Impact] Remote Code Execution (RCE) on the developer's machine via DNS rebinding and browser-based request forgery when visiting malicious websites or viewing malvertisements

[Mitigation] Immediately upgrade the Ray package to version 2.52.0 or higher

[Affected Scope] Virtual machines and environments running on VMware ESXi hypervisors where attackers hold privileges within the VMX process

[Impact] Escape of the hypervisor sandbox and potential host takeover via arbitrary kernel write from the guest OS

[Mitigation] Immediately apply the official security patches provided by Broadcom and restrict administrative access to the VMX process

[Affected Scope] VMware ESXi and Workstation products

[Impact] A malicious actor with local administrative privileges on a guest VM can execute arbitrary code within the host's VMX process, leading to a virtual machine escape

[Mitigation] Apply the latest security patches provided by Broadcom and restrict administrative access within guest virtual machines

[Affected Scope] Wazuh server and cluster environments running versions 4.4.0 through 4.9.0

[Impact] Attackers with API access or compromised agents can execute arbitrary Python code on the Wazuh server by manipulating Distributed API (DAPI) parameters, leading to full system compromise

[Mitigation] Immediately upgrade Wazuh manager and cluster nodes to the patched version (v4.9.1 or higher) and restrict API access

[Affected Scope] Acronis Cyber Infrastructure (ACI) versions prior to 5.0.1-61, 5.1.1-71, 5.2.1-69, 5.3.1-53, and 5.4.4-132

[Impact] Unauthenticated remote attackers can exploit default credentials to execute arbitrary commands and gain full control over the infrastructure

[Mitigation] Immediately upgrade to the patched versions (5.0.1-61, 5.1.1-71, 5.2.1-69, 5.3.1-53, 5.4.4-132 or later)

[Affected Scope] VMware ESXi hosts configured to use Active Directory (AD) for user management.

[Impact] A malicious actor with group creation permissions in AD can gain full administrative access to the ESXi host by re-creating the deleted 'ESXi Admins' group.

[Mitigation] Apply the official security patches from Broadcom or change the default ESXi Admins group setting to an unprivileged/non-existent group name.

[Affected Scope] Unpatched VMware vCenter Server versions 6.5, 6.7, and 7.0

[Impact] A malicious actor with non-administrative or local access can read sensitive configuration files and credentials, potentially leading to full infrastructure compromise

[Mitigation] Apply official VMware security patches (VMSA-2022-0009) immediately, or restrict file permissions on sensitive configuration files as a temporary workaround

[Affected Scope] Container environments and host OS running Linux kernel versions prior to v5.17-rc3

[Impact] An attacker inside a container can bypass namespace isolation, escalate privileges to host root, and execute arbitrary code

[Mitigation] Update the Linux kernel to the patched version, and enforce container security profiles (AppArmor, Seccomp, non-root users)