CVE Vulnerability Advisory Database

[Affected Scope] All Ubiquiti UniFi OS devices accessible via the network.

[Impact] Unauthenticated attackers can exploit a Path Traversal (CWE-22) vulnerability to access and manipulate underlying system files, leading to complete takeover of system accounts.

[Mitigation] Immediately apply the official security patches provided by Ubiquiti and restrict external network access to the UniFi OS management interface.

[Affected Scope] Ubiquiti UniFi OS devices accessible via the network

[Impact] Unauthenticated remote attackers can make unauthorized system changes, gain administrative control, and potentially enlist devices into botnets

[Mitigation] Apply the official vendor security patches immediately, restrict access to management interfaces, and monitor for unauthorized configuration changes

[Affected Scope] Drupal core versions 8.9.0 to < 10.4.10, 10.5.0 to < 10.5.10, 10.6.0 to < 10.6.9, 11.0.0 to < 11.1.10, 11.2.0 to < 11.2.12, and 11.3.0 to < 11.3.10

[Impact] Unauthenticated remote attackers can inject malicious SQL queries to extract sensitive database information, hijack administrator sessions, or potentially achieve Remote Code Execution (RCE).

[Mitigation] Immediately upgrade Drupal core to the respective patched versions (10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, 11.3.10, or later).

[Affected Scope] LiteLLM proxy server environments running versions 1.74.2 to before 1.83.7

[Impact] Authenticated users with low-privilege API keys can execute arbitrary OS commands on the proxy host, potentially leading to full system compromise

[Mitigation] Immediately upgrade LiteLLM to the patched version 1.83.7 or later, and restrict access to the vulnerable endpoints in the interim

[Affected Scope] Ivanti EPMM versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1

[Impact] A remotely authenticated attacker with administrative privileges can exploit improper input validation to execute arbitrary code and fully compromise the system.

[Mitigation] Immediately upgrade to the patched versions (12.6.1.1, 12.7.0.1, 12.8.0.1, or higher) provided by the vendor.

[Affected Scope] Palo Alto Networks PAN-OS software running on PA-Series and VM-Series firewalls with the User-ID™ Authentication Portal (Captive Portal) service enabled.

[Impact] An unauthenticated remote attacker can execute arbitrary code with root privileges on the firewall by sending specially crafted packets.

[Mitigation] Apply the latest security patches immediately, and restrict access to the User-ID™ Authentication Portal to trusted internal IP addresses only.

[Affected Scope] Fortinet FortiSandbox versions 4.4.0 through 4.4.8

[Impact] Unauthenticated remote attackers can execute unauthorized OS commands or code with elevated privileges, potentially leading to full system compromise

[Mitigation] Immediately upgrade to FortiSandbox version 4.4.9 or higher, and restrict access to management interfaces

[Affected Scope] All versions of marimo open-source Python notebook prior to 0.23.0

[Impact] Unauthenticated remote attackers can establish a connection to the /terminal/ws endpoint, obtaining a full PTY shell and executing arbitrary system commands

[Mitigation] Immediately upgrade the marimo package to version 0.23.0 or higher

[Affected Scope] Apache ActiveMQ Classic versions prior to 5.19.4, and 6.0.0 through 6.2.3

[Impact] An authenticated attacker can execute arbitrary system commands within the broker's JVM by loading a malicious remote Spring XML configuration via the Jolokia JMX-HTTP bridge

[Mitigation] Immediately upgrade Apache ActiveMQ to a patched version (5.19.4 or 6.2.3) and restrict Jolokia access policies

[Affected Scope] Fortinet FortiClientEMS versions 7.4.5 through 7.4.6

[Impact] An unauthenticated remote attacker can execute unauthorized code or commands with system privileges via crafted network requests.

[Mitigation] Apply the official Fortinet security patch (version 7.4.7 or higher) immediately and restrict external network access to the EMS server.

[Affected Scope] Google Chrome versions prior to 146.0.7680.178

[Impact] A remote attacker who has compromised the renderer process can execute arbitrary code via a crafted HTML page

[Mitigation] Immediately update Google Chrome to the latest stable version (146.0.7680.178 or higher)

[Affected Scope] Langflow versions prior to 1.9.0

[Impact] Unauthenticated remote attackers can execute arbitrary Python code and gain full control over the host system

[Mitigation] Immediately upgrade Langflow to version 1.9.0 or higher, and restrict external access to the vulnerable endpoint

[Affected Scope] Google Chrome and Chromium-based browsers prior to version 146.0.7680.75

[Impact] A remote attacker can execute arbitrary code inside the browser sandbox renderer process by enticing a user to visit a specially crafted HTML page

[Mitigation] Immediately update Google Chrome to the latest stable version (146.0.7680.75 or higher)

[Affected Scope] Lantronix EDS5000 device servers running firmware version 2.1.0.0R3

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with root privileges by sending crafted HTTP RPC requests

[Mitigation] Apply the official firmware patch immediately, and restrict external access to the HTTP/HTTPS management interfaces

[Affected Scope] Web-based management interface of Cisco Secure Firewall Management Center (FMC) Software.

[Impact] Unauthenticated, remote attackers can execute arbitrary Java code with root privileges by sending crafted serialized Java objects.

[Mitigation] Apply official Cisco security patches immediately and restrict public internet access to the FMC management interface.

[Affected Scope] Cisco Catalyst SD-WAN Controller (formerly vSmart), Cisco Catalyst SD-WAN Manager (formerly vManage), and Cisco Catalyst SD-WAN Validator (formerly vBond).

[Impact] Unauthenticated remote attackers can bypass peering authentication, gain high-privileged administrative access, and manipulate the entire SD-WAN fabric configuration via NETCONF.

[Mitigation] Apply official Cisco software patches immediately and restrict control plane access to trusted peer IPs using Access Control Lists (ACLs).

[Affected Scope] Soliton FileZen deployments with the Antivirus Check Option enabled

[Impact] An authenticated attacker can execute arbitrary OS commands with elevated privileges by sending a specially crafted HTTP request

[Mitigation] Immediately apply the official vendor security patches, or temporarily disable the Antivirus Check Option and restrict network access

[Affected Scope] BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA).

[Impact] Unauthenticated remote attackers can execute arbitrary operating system commands in the context of the 'site' user by sending specially crafted HTTP requests.

[Mitigation] Immediately apply the official security patches provided by the vendor and restrict access to the management interface using IP whitelisting and WAF rules.

[Affected Scope] Notepad++ versions prior to 8.8.9 utilizing the WinGUp updater component.

[Impact] Attackers capable of intercepting or redirecting update traffic can bypass verification to deliver and execute arbitrary malicious installers under the user's privilege context.

[Mitigation] Immediately upgrade Notepad++ to version 8.8.9 or higher, or block updater outbound traffic as a temporary workaround.

[Affected Scope] Ivanti Endpoint Manager Mobile (EPMM) affected versions

[Impact] Unauthenticated attackers can execute arbitrary code remotely, potentially leading to full system compromise

[Mitigation] Apply the official security patches immediately and restrict access to exposed management interfaces