CVE Vulnerability Advisory Database

[Affected Scope] Internet Key Exchange (IKE) Extension service running on Microsoft Windows and Windows Server operating systems

[Impact] An unauthenticated remote attacker can execute arbitrary code with system/kernel privileges over the network by sending specially crafted IKE packets

[Mitigation] Apply the official Microsoft security updates immediately, and restrict external access to IKE/IPsec ports (UDP 500/4500) as a temporary workaround

[Affected Scope] Citrix NetScaler ADC and NetScaler Gateway appliances configured to act as a SAML Identity Provider (IDP)

[Impact] Unauthenticated remote attackers can trigger an out-of-bounds memory read, potentially exposing highly sensitive session tokens, credentials, or SSL private keys, and facilitating remote code execution

[Mitigation] Immediately apply the official security updates provided by Citrix, or temporarily disable the SAML IDP configuration if patching cannot be performed immediately

[Affected Scope] Langflow versions prior to 1.9.0

[Impact] Unauthenticated remote attackers can execute arbitrary Python code and gain full control over the host system

[Mitigation] Immediately upgrade Langflow to version 1.9.0 or higher, and restrict external access to the vulnerable endpoint

[Affected Scope] Mobile and embedded devices powered by Qualcomm chipsets running affected Android kernel versions

[Impact] Local attackers can trigger an integer overflow (CWE-190) during memory alignment, leading to memory corruption and local privilege escalation (LPE) to kernel level

[Mitigation] Immediately apply the March 2026 security patches released by Qualcomm and Android OEMs

[Affected Scope] Windows operating systems running Windows Remote Desktop services

[Impact] An authorized local attacker can elevate privileges to SYSTEM level, gaining full control over the target system

[Mitigation] Apply the latest Microsoft cumulative security updates immediately and enforce Network Level Authentication (NLA)

[Affected Scope] BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA).

[Impact] Unauthenticated remote attackers can execute arbitrary operating system commands in the context of the 'site' user by sending specially crafted HTTP requests.

[Mitigation] Immediately apply the official security patches provided by the vendor and restrict access to the management interface using IP whitelisting and WAF rules.

[Affected Scope] Ivanti Endpoint Manager Mobile (EPMM) affected versions

[Impact] Unauthenticated attackers can execute arbitrary code remotely, potentially leading to full system compromise

[Mitigation] Apply the official security patches immediately and restrict access to exposed management interfaces

[Affected Scope] All Microsoft Office suites and local environments processing untrusted document inputs.

[Impact] Attackers can bypass local security decisions, leading to unauthorized macro execution and arbitrary code execution.

[Mitigation] Apply official Microsoft security patches immediately and enforce strict macro blocking policies for untrusted files.

[Affected Scope] SmarterTools SmarterMail software versions prior to Build 9511

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands on the target system via a malicious HTTP server, leading to complete system compromise

[Mitigation] Immediately upgrade SmarterMail to the latest stable version (Build 9511 or higher) and restrict access to administrative endpoints

[Affected Scope] Microsoft SharePoint Server deployments

[Impact] Unauthenticated remote attackers can execute arbitrary code over the network and gain full control of the target server.

[Mitigation] Apply the official Microsoft security patches immediately and restrict external access to SharePoint web interfaces until patched.

[Affected Scope] Systems running Microsoft Windows operating systems utilizing the Desktop Windows Manager (DWM) component

[Impact] An authorized local attacker can disclose sensitive information from kernel or process memory, potentially facilitating subsequent privilege escalation

[Mitigation] Immediately apply the latest Microsoft cumulative security updates and restrict unauthorized local access on unpatched systems

[Affected Scope] WatchGuard Firebox appliances running Fireware OS configured with IKEv2 mobile user VPN or branch office VPN using a dynamic gateway peer, or where these configurations were previously deleted but a static gateway peer VPN remains.

[Impact] A critical vulnerability (CVSS 9.8) allowing unauthenticated remote attackers to trigger an out-of-bounds write (CWE-787) in the iked process via crafted IKEv2 packets, leading to arbitrary code execution (RCE) with root privileges.

[Mitigation] Since this vulnerability is actively exploited and listed in the CISA KEV catalog, immediately upgrade to the patched Fireware OS version and restrict or disable IKEv2 services where possible.

[Affected Scope] Roundcube Webmail versions before 1.5.12 and 1.6.x versions before 1.6.12

[Impact] Remote attackers can execute arbitrary JavaScript code in the context of the victim's browser session via a malicious SVG attachment, leading to session hijacking and unauthorized email access

[Mitigation] Immediately upgrade Roundcube Webmail to the patched versions 1.5.12 or 1.6.12

[Affected Scope] HPE OneView management platform and associated appliance software

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges, leading to full infrastructure compromise

[Mitigation] Apply official HPE security patches immediately and restrict access to the management interface from untrusted networks

[Affected Scope] Multiple versions of Android OS and framework-based devices

[Impact] Local attackers can bypass background activity launch restrictions to achieve Local Privilege Escalation (LPE) without any user interaction or additional execution privileges

[Mitigation] Immediately apply the latest security patches (December 2025 or later) provided by Google and device OEMs, and restrict unauthorized app installations

[Affected Scope] All Array Networks ArrayOS AG appliances running versions prior to 9.4.5.9

[Impact] High-privileged attackers can execute arbitrary OS commands, leading to complete system compromise and webshell deployment

[Mitigation] Immediately upgrade ArrayOS AG to version 9.4.5.9 or higher and audit system logs for indicators of compromise

[Affected Scope] React versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 utilizing React Server Components (RSC), including react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack packages

[Impact] Unauthenticated remote attackers can execute arbitrary code on the server by sending malicious payloads to Server Function endpoints, leading to complete system compromise

[Mitigation] Immediately upgrade React and all associated react-server-dom packages to the latest patched versions, and apply WAF rules to restrict suspicious RSC requests

[Affected Scope] Fortinet FortiWeb versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.4, 7.4.0 through 7.4.9, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.11

[Impact] Unauthenticated remote attackers can execute arbitrary administrative commands on the system via crafted HTTP or HTTPS requests

[Mitigation] Immediately upgrade to the official patched versions (8.0.2, 7.6.5, 7.4.10, 7.2.12, 7.0.12 or higher)

[Affected Scope] Virtual servers configured with a BIG-IP APM (Access Policy Manager) access policy

[Impact] Unauthenticated remote attackers can execute arbitrary code (RCE) with high privileges by sending specially crafted malicious network traffic

[Mitigation] Immediately apply the latest security patches provided by F5, and restrict access to APM virtual servers until patched

[Affected Scope] All Windows Server environments running Windows Server Update Services (WSUS).

[Impact] Unauthenticated remote attackers can execute arbitrary code with SYSTEM privileges over the network by sending malicious serialized payloads.

[Mitigation] Apply the official Microsoft security patches immediately, and restrict network access to WSUS ports (8530, 8531) to trusted internal networks.