CVE Vulnerability Advisory Database

[Affected Scope] Citrix NetScaler ADC and Gateway appliances configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server

[Impact] Unauthenticated remote attackers can exploit insufficient input validation to read sensitive system memory, potentially exposing active session tokens and credentials

[Mitigation] Immediately apply the official security patches provided by Citrix (CTX693420) and terminate all active user sessions

[Affected Scope] Apple operating systems including iOS 15/16/17/18, iPadOS 15/16/17/18, macOS Ventura/Sonoma/Sequoia, visionOS, and watchOS

[Impact] A logic issue in processing maliciously crafted photos or videos shared via iCloud Links allows unauthorized data access and modification, with active exploitation observed in highly targeted attacks

[Mitigation] Immediately apply the official security updates released by Apple (e.g., iOS 18.3.1, macOS 15.3.1) and exercise caution when opening untrusted iCloud shared links

[Affected Scope] All Windows and Windows Server systems utilizing the SMBv3 protocol within Active Directory domains or workgroups

[Impact] An authenticated attacker with network access can exploit improper access control in SMB to elevate privileges to SYSTEM and execute arbitrary code

[Mitigation] Apply the latest Microsoft Cumulative Updates immediately and restrict SMB (TCP 445) inbound traffic using firewalls

[Affected Scope] Microsoft Windows operating systems including Windows 10, Windows 11, and Windows Server supporting Internet Shortcut (.url) files.

[Impact] An unauthorized remote attacker can execute arbitrary code with the privileges of the logged-in user by tricking them into opening a crafted .url file that references a malicious WebDAV/SMB share.

[Mitigation] Apply the latest Microsoft cumulative security updates immediately, disable the WebClient service, and block outbound SMB and WebDAV traffic at the perimeter firewall.

[Affected Scope] IGEL OS systems prior to version 11

[Impact] Attackers can bypass cryptographic signature verification to mount a crafted root filesystem from an unverified SquashFS image, leading to complete system compromise

[Mitigation] Immediately upgrade IGEL OS to version 11 or later and restrict physical access to boot interfaces

[Affected Scope] Android and embedded devices powered by Qualcomm chipsets utilizing specific GPU micronode firmware

[Impact] Local attackers can execute unauthorized command sequences to bypass security controls, corrupt GPU memory, and achieve local privilege escalation (LPE) to kernel level

[Mitigation] Immediately apply the latest security patches released by Qualcomm and device OEMs, and restrict the installation of untrusted applications

[Affected Scope] Android devices equipped with Qualcomm Adreno GPU drivers and running Google Chrome browser

[Impact] Remote attackers can exploit GPU rendering pipelines to trigger memory corruption, potentially leading to sandbox escape and arbitrary code execution

[Mitigation] Apply the latest security patches released by Qualcomm and device OEMs, and update Google Chrome to the latest version

[Affected Scope] Android and embedded devices utilizing Qualcomm Adreno GPU chipsets and associated drivers

[Impact] Local attackers can execute unauthorized commands within the GPU micronode by sending a specific sequence of commands, leading to memory corruption and local privilege escalation (LPE) to kernel level

[Mitigation] Immediately apply the official security patches released by Qualcomm and device OEMs in or after the June 2025 security bulletin

[Affected Scope] Google Chrome and Chromium-based browsers (including Microsoft Edge) prior to version 137.0.7151.68

[Impact] A remote attacker can trigger heap corruption and potentially execute arbitrary code within the browser renderer process via a crafted HTML page

[Mitigation] Immediately update all affected browsers to the latest stable version (137.0.7151.68 or higher) and enforce automatic update policies

[Affected Scope] Dassault Systèmes DELMIA Apriso from Release 2020 through Release 2025.

[Impact] Successful exploitation allows unauthenticated remote attackers to execute arbitrary code with system privileges via specially crafted serialized payloads.

[Mitigation] Immediately apply the official vendor security patches, restrict external network exposure, and perform compromise assessment using IoC logs.

[Affected Scope] Roundcube Webmail versions before 1.5.10 and 1.6.x versions before 1.6.11

[Impact] Authenticated remote attackers can trigger PHP Object Deserialization via the manipulated _from parameter, leading to arbitrary Remote Code Execution (RCE) on the host server

[Mitigation] Immediately upgrade Roundcube Webmail to the patched versions (1.5.10, 1.6.11, or later)

[Affected Scope] TeleMessage services and associated JSP applications through 2025-05-05

[Impact] Local attackers can extract plaintext passwords and sensitive credentials previously transmitted over HTTP by analyzing memory heap dumps

[Mitigation] Apply the latest security patches, restrict access to heap dump files, and optimize JVM garbage collection to prevent sensitive data from persisting in memory

[Affected Scope] TeleMessage service deployments through 2025-05-05

[Impact] Unauthenticated remote attackers can download the JVM heap dump via the exposed /heapdump endpoint, leading to the extraction of sensitive credentials, API keys, and user data from memory

[Mitigation] Disable the heapdump Actuator endpoint immediately, restrict external access via reverse proxies/WAFs, and rotate all potentially compromised credentials

[Affected Scope] Versa Concerto SD-WAN orchestration platform versions 12.1.2 through 12.2.0

[Impact] Unauthenticated attackers can bypass authentication via Traefik misconfiguration to access administrative and internal Actuator endpoints, potentially exposing heap dumps and trace logs containing sensitive credentials

[Mitigation] Immediately apply the official security patches provided by the vendor and restrict external access to administrative and Actuator endpoints

[Affected Scope] Web management interface of Smartbedded Meteobridge weather station devices

[Impact] Adjacent unauthenticated attackers can execute arbitrary system commands with root privileges, leading to full device compromise

[Mitigation] Apply the latest firmware patches immediately and restrict network access to the web administration interface

[Affected Scope] Windows and Windows Server operating systems utilizing the WinSock Ancillary Function Driver (afd.sys)

[Impact] An authorized local attacker can execute arbitrary code in kernel mode, elevating privileges to SYSTEM, which is actively exploited in the wild

[Mitigation] Immediately apply the official Microsoft security updates and restrict unauthorized local access to critical systems

[Affected Scope] Microsoft Windows 10, 11, and Windows Server operating systems utilizing the Common Log File System (CLFS) driver

[Impact] An authorized local attacker can exploit this vulnerability to elevate privileges to SYSTEM level and gain full control of the host

[Mitigation] Apply the latest Microsoft cumulative security updates immediately and monitor for anomalous CLFS log file activities

[Affected Scope] All supported versions of Microsoft Windows and Windows Server utilizing the Common Log File System (CLFS) driver.

[Impact] An authorized local attacker can exploit this vulnerability to execute arbitrary code with SYSTEM privileges, leading to complete host compromise.

[Mitigation] Immediately apply the latest cumulative security updates provided by Microsoft and restrict unauthorized local interactive access.

[Affected Scope] Desktop Window Manager (DWM) component in Microsoft Windows 10, Windows 11, and Windows Server operating systems

[Impact] An authorized local attacker can exploit a Use-After-Free vulnerability to execute arbitrary code with SYSTEM privileges, leading to complete host takeover

[Mitigation] Immediately apply the official Microsoft cumulative security updates and monitor unpatched systems for anomalous DWM crashes

[Affected Scope] Windows operating systems and applications utilizing the Microsoft Scripting Engine

[Impact] Unauthorized remote attackers can execute arbitrary code and compromise system integrity via crafted web content or documents

[Mitigation] Immediately apply the official Microsoft security updates and restrict untrusted script execution policies