CVE Vulnerability Advisory Database

[Affected Scope] TrueConf Server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier

[Impact] Remote unauthorized attackers can execute arbitrary scripts and compromise the server by calling undocumented functions via TCP port 4307 without authentication

[Mitigation] Immediately upgrade TrueConf Server to the latest secure version and restrict external network access to TCP port 4307

[Affected Scope] NetScaler ADC and Gateway versions 14.1 (prior to 73.32) and 13.1 (prior to 63.21)

[Impact] Potential for administrative privilege gain and Remote Code Execution (RCE) via authentication bypass

[Mitigation] Apply official Citrix patches and restrict Management Interface (NSIP) access

[Affected Scope] MLflow versions from 3.3.0 prior to 3.15.0

[Impact] Unauthenticated attackers can bypass URL validation to access internal network resources or cloud metadata services, potentially retrieving sensitive credentials and response data.

[Mitigation] Immediately upgrade MLflow to version 3.15.0 or later, and restrict access to the webhook test endpoint in the interim.

[Affected Scope] Zimbra Collaboration (ZCS) versions prior to 10.1.20, specifically when the optional zimbra-snmp package is installed and SNMP notifications are enabled.

[Impact] An unauthenticated remote attacker can execute arbitrary operating system commands as the Zimbra user by sending specially crafted SMTP requests.

[Mitigation] Immediately upgrade Zimbra Collaboration to version 10.1.20 or later, or temporarily disable the zimbra-snmp service.

[Affected Scope] All JFrog Artifactory Self-Managed instances

[Impact] Unauthenticated attackers can obtain internal anonymous tokens even when anonymous access is disabled, leading to unauthorized access to sensitive artifacts

[Mitigation] Immediate upgrade to the latest patched version and verification of security configurations

[Affected Scope] JFrog Artifactory Self-Managed instances under specific remote-repository conditions

[Impact] An authenticated attacker can write data outside the intended Docker cache path, potentially compromising system integrity

[Mitigation] Immediately upgrade JFrog Artifactory to the latest patched version and restrict untrusted remote repository configurations

[Affected Scope] All versions of Adobe Commerce and Magento Open Source (2.4.7 and earlier)

[Impact] Unauthenticated remote attackers can escalate privileges to gain administrative access and compromise sensitive data

[Mitigation] Apply Adobe security patch APSB26-92 immediately and implement IP whitelisting for the admin panel

[Affected Scope] Systems running Microsoft Windows operating systems utilizing the Ancillary Function Driver for WinSock (afd.sys)

[Impact] An authorized local attacker can exploit kernel memory corruption to execute arbitrary code with SYSTEM privileges, leading to complete system compromise

[Mitigation] Immediately apply the latest cumulative security updates provided by Microsoft and restrict unauthorized local access

[Affected Scope] Microsoft SharePoint Server 2016, 2019, and Subscription Edition.

[Impact] Authorized attackers can execute arbitrary code over the network, leading to full server compromise.

[Mitigation] Apply official Microsoft security updates immediately and monitor for unauthorized web shell activity.

[Affected Scope] Cisco Secure Firewall ASA and FTD Software with Remote Access SSL VPN service enabled

[Impact] Unauthenticated, remote attackers can cause an unexpected device reload, leading to a complete Denial of Service (DoS) condition

[Mitigation] Immediately upgrade to the patched software versions recommended in the Cisco Security Advisory

[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions

[Impact] Remote, unauthenticated attackers can inject arbitrary SQL queries, manipulate the database, and gain full administrator access to the Metabase instance

[Mitigation] Apply the official vendor security patches immediately, or restrict access to the vulnerable endpoint using a WAF or reverse proxy

[Affected Scope] macOS systems running versions prior to Sequoia 15.7.9, Sonoma 14.8.9, Tahoe 26.6.1/26.7, or Golden Gate 27 with Screen Sharing or VNC services enabled

[Impact] A remote attacker on the network can bypass authentication mechanisms to establish an unauthorized Screen Sharing session without valid credentials, gaining full GUI-level control over the target system

[Mitigation] Immediately apply the latest macOS security updates, or disable 'Screen Sharing' and 'Remote Management' services until patches can be deployed

[Affected Scope] WSO2 Identity Server, API Manager, and products utilizing WSO2 JWT authentication modules.

[Impact] Attackers can bypass authentication using crafted JWTs, leading to full administrative account takeover.

[Mitigation] Apply official vendor patches immediately and enforce strict JWT algorithm validation policies.

[Affected Scope] N-able N-central versions up to and including 2026.3.1

[Impact] Attackers can bypass authentication and achieve full account takeover by exploiting an incomplete patch for CVE-2026-18556

[Mitigation] Immediately upgrade to N-central 2026.3 Hotfix 1 or later, and restrict external access to the management interface until patched

[Affected Scope] All on-premises and cloud instances of N-able N-central running version 2026.1 and prior

[Impact] Unauthenticated attackers can bypass authentication mechanisms to gain administrative privileges, potentially leading to full compromise of managed client environments

[Mitigation] Apply the official security patches immediately and restrict external internet access to the N-central management console

[Affected Scope] VMware ESX hypervisor environments.

[Impact] High-privileged attackers can perform unauthorized operations without generating audit logs, hindering incident response and forensic analysis.

[Mitigation] Apply the latest security patches from Broadcom and strengthen external Syslog integration.

[Affected Scope] Systems running VMware vCenter Server with the built-in Syslog server service enabled.

[Impact] A remote, unauthenticated attacker with network access can exploit this directory traversal vulnerability to execute arbitrary code and fully compromise the vCenter Server.

[Mitigation] Immediately apply the official security patches provided by Broadcom and restrict network access to Syslog ports (UDP/TCP 514).

[Affected Scope] Web interface of Cisco Secure Firewall Management Center (FMC) Software

[Impact] Unauthenticated remote attackers can log in using hardcoded low-privileged credentials to access sensitive data, which can be chained with other flaws to escalate privileges

[Mitigation] Apply the official Cisco security updates immediately and restrict public internet access to the FMC management interface

[Affected Scope] JFrog Artifactory Self-Hosted versions prior to 7.133.11

[Impact] Low-privileged users can escalate to administrative privileges by exploiting insufficient token scope validation, leading to full system compromise

[Mitigation] Immediately upgrade to version 7.133.11 or later and conduct a comprehensive audit of all existing access tokens

[Affected Scope] JetBrains TeamCity versions prior to 2026.1.3 and 2025.11.7

[Impact] Unauthenticated remote attackers can execute arbitrary code on the server via the agent polling protocol, leading to full system compromise

[Mitigation] Immediately upgrade TeamCity server to version 2026.1.3, 2025.11.7, or later