CVE Vulnerability Advisory Database

[Affected Scope] FortiOS versions 7.0.0 through 7.0.16, and FortiProxy versions 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12

[Impact] Remote unauthenticated attackers can bypass authentication via crafted requests to the Node.js websocket module, gaining full super-admin privileges

[Mitigation] Immediately upgrade to the patched firmware versions and restrict external access to the management interface

[Affected Scope] SonicWall SMA (Secure Mobile Access) appliances and firmware utilizing the SSLVPN authentication mechanism

[Impact] Remote unauthenticated attackers can completely bypass authentication, gain administrative access, and compromise the internal network

[Mitigation] Immediately apply the official firmware patches provided by SonicWall and restrict external access to the SSLVPN interface

[Affected Scope] Systems running unpatched versions impacted by CVE-2025-0282

[Impact] A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neu...

[Mitigation] Apply vendor security patches and restrict external network exposure.

[Affected Scope] Aviatrix Controller versions prior to 7.1.4191 and 7.2.x versions prior to 7.2.4996

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with root privileges by injecting shell metacharacters, leading to complete system compromise

[Mitigation] Immediately upgrade Aviatrix Controller to patched versions (7.1.4191, 7.2.4996 or higher) and restrict access to the management interface

[Affected Scope] DrayTek Vigor2960 and Vigor300B gateway devices running firmware version 1.5.1.4 or prior

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with root privileges via the Web Management Interface, leading to full system compromise

[Mitigation] Immediately upgrade to firmware version 1.5.1.5 or higher and disable WAN-side web management access

[Affected Scope] Linux kernel environments utilizing specific USB audio devices such as Creative Extigy and Digidesign Mbox

[Impact] Connecting a maliciously crafted USB device can trigger an out-of-bounds memory access in the kernel, potentially leading to a Denial of Service (Kernel Panic) or Local Privilege Escalation (LPE)

[Mitigation] Apply the latest stable kernel patches from your distribution or blacklist the unused ALSA USB audio kernel module

[Affected Scope] Palo Alto Networks PAN-OS software versions with the DNS Security feature enabled

[Impact] An unauthenticated remote attacker can send malicious packets through the data plane, causing the firewall to reboot. Repeated exploitation forces the device into maintenance mode, leading to a complete network outage

[Mitigation] Immediately upgrade PAN-OS to the patched versions recommended by the vendor, and review DNS Security profile configurations as a temporary measure

[Affected Scope] Systems running the Linux kernel with the ALSA (Advanced Linux Sound Architecture) USB-Audio driver enabled.

[Impact] A local attacker can trigger an out-of-bounds read by connecting a malicious USB audio device, potentially leading to kernel memory disclosure or system crash (DoS).

[Mitigation] Apply the latest Linux kernel security patches and restrict unauthorized USB device connections and driver loading.

[Affected Scope] Craft CMS versions 3.x, 4.x, and 5.x running on environments where 'register_argc_argv' is enabled in php.ini

[Impact] Unauthenticated remote attackers can execute arbitrary PHP code and gain full system control by sending specially crafted HTTP requests

[Mitigation] Immediately upgrade Craft CMS to patched versions (3.9.14, 4.13.2, or 5.5.2 or higher) and disable 'register_argc_argv' in php.ini

[Affected Scope] BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS)

[Impact] An attacker with administrative privileges can inject arbitrary OS commands and execute them with site user privileges

[Mitigation] Immediately apply the official security patches provided by BeyondTrust (Advisory BT24-11)

[Affected Scope] BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) affected versions

[Impact] Unauthenticated remote attackers can inject and execute arbitrary system commands with the privileges of the 'site user'.

[Mitigation] Immediately apply the official security patches provided by BeyondTrust (BT24-10) and restrict access to management interfaces.

[Affected Scope] Cleo Harmony, VLTrader, and LexiCom versions prior to 5.8.0.24

[Impact] Unauthenticated remote attackers can leverage default settings of the Autorun directory to import and execute arbitrary Bash or PowerShell commands on the host system, leading to full system compromise.

[Mitigation] Immediately upgrade to the patched version (5.8.0.24 or higher) and restrict access to exposed management interfaces.

[Affected Scope] Windows 10, 11, and Windows Server systems utilizing the Common Log File System (CLFS) driver

[Impact] Local attackers can exploit this vulnerability to execute arbitrary code in kernel mode, escalating privileges to SYSTEM

[Mitigation] Apply the latest Microsoft cumulative security updates immediately and restrict unauthorized creation of CLFS log (.blf) files

[Affected Scope] Mitel MiCollab through 9.8 SP2

[Impact] An authenticated attacker with administrative privileges can exploit insufficient input sanitization to read arbitrary non-sensitive local system files

[Mitigation] Apply the official security patches or upgrade to the latest supported version immediately

[Affected Scope] Systems running the Linux kernel with the UVC (USB Video Class) driver enabled

[Impact] A local attacker can trigger an out-of-bounds write in kernel memory via a malicious USB device, leading to Local Privilege Escalation (LPE) or Kernel Panic (DoS)

[Mitigation] Apply the latest stable Linux kernel security patches or blacklist the uvcvideo kernel module if not required

[Affected Scope] Zyxel ATP, USG FLEX, USG FLEX 50(W), and USG20(W)-VPN series running firmware versions V5.00 through V5.38

[Impact] Unauthenticated remote attackers can download or upload arbitrary files via crafted URLs, potentially leading to full system compromise and remote code execution

[Mitigation] Immediately upgrade to firmware version V5.39 or later, and restrict external access to the web management interface

[Affected Scope] Microsoft Partner Center Portal (Partner.Microsoft.com) services and associated API endpoints

[Impact] An unauthenticated remote attacker can elevate privileges over the network, potentially gaining administrative control over partner accounts and sensitive tenant data

[Mitigation] As this is a cloud-hosted service, Microsoft has applied server-side mitigations; however, organizations must immediately audit Partner Center API integrations, permissions, and admin logs

[Affected Scope] ProjectSend file sharing platform versions prior to r1720

[Impact] Unauthenticated remote attackers can bypass authentication via options.php to modify application configurations, create unauthorized accounts, upload webshells, and execute arbitrary code

[Mitigation] Immediately upgrade ProjectSend to version r1720 or later, and restrict external access to options.php as a temporary workaround

[Affected Scope] Systems running macOS Sequoia prior to 15.1.1, iOS/iPadOS prior to 18.1.1 and 17.7.2, and Safari prior to 18.1.1

[Impact] Processing maliciously crafted web content can trigger a Cross-Site Scripting (XSS) attack due to state management flaws, with active exploitation reported on Intel-based Mac systems

[Mitigation] Immediately apply the official software updates provided by Apple for macOS, iOS, iPadOS, and Safari

[Affected Scope] Apple devices running Safari prior to 18.1.1, iOS/iPadOS 17/18, macOS Sequoia, and visionOS

[Impact] Processing maliciously crafted web content may lead to arbitrary code execution and complete device compromise

[Mitigation] Immediately apply the official security updates released by Apple (iOS 18.1.1, macOS 15.1.1, etc.)