CVE Vulnerability Advisory Database

[Affected Scope] Arista VeloCloud Orchestrator (VCO) On-premise deployments.

[Impact] Unauthenticated remote attackers can access privileged internal functions, leading to full compromise of the orchestrator and managed SD-WAN infrastructure.

[Mitigation] Immediately apply the latest security patches from Arista and restrict access to management interfaces via VPN/ACLs.

[Affected Scope] All Cisco Secure Email Gateway appliances running vulnerable versions of Cisco AsyncOS Software.

[Impact] An unauthenticated remote attacker can execute arbitrary commands with root privileges by sending a crafted email, leading to full system compromise.

[Mitigation] Immediately apply the official security patches provided by Cisco and monitor for signs of exploitation.

[Affected Scope] All Check Point Quantum Security Gateway versions with VPN Blade enabled.

[Impact] Unauthenticated remote attackers can execute arbitrary code with root privileges, leading to full gateway compromise.

[Mitigation] Immediately apply the latest Jumbo Hotfix and enforce strict certificate validation policies.

[Affected Scope] Google Chrome versions prior to 153.0.8010.36 and Chromium-based browsers

[Impact] Remote attackers can execute arbitrary code within the browser sandbox via a crafted HTML page

[Mitigation] Immediately update Google Chrome to version 153.0.8010.36 or later

[Affected Scope] ConnectWise ScreenConnect client software (Servers are not impacted)

[Impact] Attackers can exploit active remote sessions to transfer and execute malicious files without host confirmation, leading to full system compromise.

[Mitigation] Immediately update all ScreenConnect clients to the latest patched version and enforce session consent policies.

[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.

[Impact] Unauthenticated attackers can execute arbitrary code with server privileges, leading to full system compromise and sensitive data theft.

[Mitigation] Immediately apply Adobe security patches (APSB26-146) and implement WAF rules to block malicious template patterns.

[Affected Scope] N-able N-central versions prior to 2026.3.1.14

[Impact] Unauthenticated remote attackers can execute arbitrary code with high privileges and fully compromise the system by sending specially crafted requests

[Mitigation] Immediately upgrade N-central to version 2026.3.1.14 or later, and restrict external access until patched

[Affected Scope] SonicWall SMA1000 Appliance Management Console (AMC) management interface

[Impact] A remote authenticated attacker with administrator privileges can execute arbitrary OS commands under specific conditions, leading to complete system compromise

[Mitigation] Immediately apply the official security patches provided by SonicWall and restrict access to the AMC management interface

[Affected Scope] PaperCut MF and PaperCut NG print management solutions

[Impact] Attackers capable of manipulating system configuration parameters can execute arbitrary Java bytecode under the security context of the PaperCut server process

[Mitigation] Apply the official vendor security patches immediately and restrict access to database configuration utilities

[Affected Scope] Web management interface of PaperCut MF and PaperCut NG.

[Impact] Unauthenticated remote attackers can trigger backend actions and modify system configurations before access validation checks complete, potentially leading to Remote Code Execution (RCE).

[Mitigation] Apply the official vendor security patches immediately and restrict external access to the web management ports (default 9191, 9192).

[Affected Scope] Gitea versions prior to 1.27.1

[Impact] Unauthenticated remote attackers can install malicious Git hooks via the diffpatch API, leading to arbitrary system command execution with Gitea server privileges.

[Mitigation] Immediately upgrade Gitea instances to version 1.27.1 or later, and disable Git Hook functionality in the configuration.

[Affected Scope] TrueConf Server versions 5.3.0 to 5.3.9, 5.4.0 to 5.4.9, 5.5.0 to 5.5.5, and earlier

[Impact] An unauthenticated remote attacker can bypass sandbox isolation and execute arbitrary code on the host system by sending a crafted script via TCP port 4307.

[Mitigation] Immediately upgrade TrueConf Server to the latest patched version and restrict network access to TCP port 4307 using firewalls.

[Affected Scope] TrueConf Server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier

[Impact] Remote unauthorized attackers can execute arbitrary scripts and compromise the server by calling undocumented functions via TCP port 4307 without authentication

[Mitigation] Immediately upgrade TrueConf Server to the latest secure version and restrict external network access to TCP port 4307

[Affected Scope] NetScaler ADC and Gateway versions 14.1 (prior to 73.32) and 13.1 (prior to 63.21)

[Impact] Potential for administrative privilege gain and Remote Code Execution (RCE) via authentication bypass

[Mitigation] Apply official Citrix patches and restrict Management Interface (NSIP) access

[Affected Scope] Zimbra Collaboration (ZCS) versions prior to 10.1.20, specifically when the optional zimbra-snmp package is installed and SNMP notifications are enabled.

[Impact] An unauthenticated remote attacker can execute arbitrary operating system commands as the Zimbra user by sending specially crafted SMTP requests.

[Mitigation] Immediately upgrade Zimbra Collaboration to version 10.1.20 or later, or temporarily disable the zimbra-snmp service.

[Affected Scope] Microsoft SharePoint Server 2016, 2019, and Subscription Edition.

[Impact] Authorized attackers can execute arbitrary code over the network, leading to full server compromise.

[Mitigation] Apply official Microsoft security updates immediately and monitor for unauthorized web shell activity.

[Affected Scope] macOS systems running versions prior to Sequoia 15.7.9, Sonoma 14.8.9, Tahoe 26.6.1/26.7, or Golden Gate 27 with Screen Sharing or VNC services enabled

[Impact] A remote attacker on the network can bypass authentication mechanisms to establish an unauthorized Screen Sharing session without valid credentials, gaining full GUI-level control over the target system

[Mitigation] Immediately apply the latest macOS security updates, or disable 'Screen Sharing' and 'Remote Management' services until patches can be deployed

[Affected Scope] All on-premises and cloud instances of N-able N-central running version 2026.1 and prior

[Impact] Unauthenticated attackers can bypass authentication mechanisms to gain administrative privileges, potentially leading to full compromise of managed client environments

[Mitigation] Apply the official security patches immediately and restrict external internet access to the N-central management console

[Affected Scope] On-premises deployments of VeloCloud Orchestrator (VCO)

[Impact] Unauthenticated remote attackers can access privileged internal functionalities and execute arbitrary OS commands (CWE-78), leading to complete compromise of the orchestrator's confidentiality, integrity, and availability

[Mitigation] Immediately apply the official security patches provided by the vendor and restrict external network access to the orchestrator management interface

[Affected Scope] Check Point Security Management Servers and SmartConsole instances exposed to the internet without Trusted Clients restrictions configured

[Impact] Unauthenticated remote attackers can obtain a valid application login token, granting them full administrative privileges to modify security policies and configurations

[Mitigation] Apply the official vendor patches immediately, restrict internet access to the Management Server, and configure Trusted Clients IP restrictions