CVE Vulnerability Advisory Database

[Affected Scope] Sophos Firewall v18.5 MR3 and older versions with User Portal and Webadmin interfaces enabled.

[Impact] Remote attackers can bypass authentication to execute arbitrary code, potentially leading to full firewall compromise and internal network intrusion.

[Mitigation] Apply the official firmware patches immediately and disable WAN-side access to the Webadmin and User Portal interfaces.

[Affected Scope] Systems running macOS Monterey prior to 12.2.1, iOS prior to 15.3.1, iPadOS prior to 15.3.1, and Safari prior to 15.3

[Impact] Processing maliciously crafted web content may lead to arbitrary remote code execution (RCE) on the target system, with active exploitation reported in the wild

[Mitigation] Immediately apply official Apple security updates to upgrade macOS, iOS, iPadOS, and Safari to the patched versions

[Affected Scope] Veeam Backup & Replication versions 10.x and 11.x

[Impact] Unauthenticated remote attackers can execute arbitrary code with SYSTEM privileges, leading to backup data theft and infrastructure compromise

[Mitigation] Immediately apply the official vendor patch (KB4288) or restrict access to vulnerable ports and services

[Affected Scope] Veeam Backup & Replication versions 9.5U3, 9.5U4, 10.x, and 11.x

[Impact] Remote authenticated attackers can access internal API functions, upload arbitrary files, and execute malicious code with SYSTEM privileges

[Mitigation] Apply the official vendor patch (KB4288) immediately or restrict network access to vulnerable ports

[Affected Scope] Android devices powered by kernels utilizing the ARM Mali GPU driver

[Impact] Local attackers can achieve local privilege escalation (LPE) to kernel execution context without any user interaction

[Mitigation] Apply the March 2022 or later Android Security Patch Level (SPL) and update the kernel build

[Affected Scope] Mitel MiCollab versions prior to 9.4 SP1 FP1 and MiVoice Business Express through version 8.1.

[Impact] Unauthenticated remote attackers can access sensitive system information or abuse the system to launch high-volume DDoS amplification attacks (TP240PhoneHome) globally.

[Mitigation] Apply official vendor security patches immediately and restrict external access to the TP-240 driver port (UDP 10074) via firewalls.

[Affected Scope] Linux kernel versions 5.8 and outstanding up to versions prior to 5.16.11, 5.15.25, and 5.10.102

[Impact] An unprivileged local user can write arbitrary data to the page cache of read-only files, leading to full root privilege escalation

[Mitigation] Immediately upgrade the Linux kernel to the latest patched stable release and reboot the system

[Affected Scope] WatchGuard Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2 on Firebox and XTM appliances

[Impact] An unauthenticated remote attacker can execute arbitrary code with administrative privileges, leading to complete compromise of the firewall appliance

[Mitigation] Immediately upgrade Fireware OS to the patched versions (12.7.2_U2, 12.5.9_U2, 12.1.3_U8 or higher) and restrict external access to management interfaces

[Affected Scope] Spring Cloud Gateway versions prior to 3.1.1 and 3.0.7, where the Gateway Actuator endpoint is enabled, exposed, and unsecured

[Impact] Unauthenticated remote attackers can execute arbitrary system commands on the host by sending maliciously crafted HTTP requests

[Mitigation] Immediately upgrade Spring Cloud Gateway to version 3.1.1, 3.0.7, or higher, and disable or secure the Gateway Actuator endpoint

[Affected Scope] Container environments and host OS running Linux kernel versions prior to v5.17-rc3

[Impact] An attacker inside a container can bypass namespace isolation, escalate privileges to host root, and execute arbitrary code

[Mitigation] Update the Linux kernel to the patched version, and enforce container security profiles (AppArmor, Seccomp, non-root users)

[Affected Scope] Devices equipped with ARM Mali GPU Kernel Driver Midgard (r26p0 to r31p0), Bifrost (r0p0 to r35p0), and Valhall (r19p0 to r35p0) architectures

[Impact] A local non-privileged user can gain write access to read-only memory pages, leading to local privilege escalation (LPE) and arbitrary code execution

[Mitigation] Apply the official security patches and upgrade to the latest driver versions (Bifrost/Valhall r36p0+, Midgard r32p0+) provided by ARM and device OEMs

[Affected Scope] WatchGuard Firebox and XTM appliances running Fireware OS before 12.7.2_U1, 12.x before 12.1.3_U3, and 12.2.x through 12.5.x before 12.5.7_U3

[Impact] A remote attacker with low-privileged credentials can exploit exposed management access to elevate privileges and establish a fully privileged management session

[Mitigation] Immediately upgrade Fireware OS to the patched versions and restrict management interface access from the external internet

[Affected Scope] Redis server instances installed via package managers (apt) on Debian, Ubuntu, and derived Linux distributions

[Impact] Unauthenticated remote attackers can bypass the Lua scripting sandbox to execute arbitrary system commands with the privileges of the Redis process (CVSS 10.0, CISA KEV Listed)

[Mitigation] Apply official OS package updates immediately, or disable EVAL/EVALSHA commands and restrict network access to localhost

[Affected Scope] All hardware revisions of D-Link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges via the DDNS function, leading to full device compromise

[Mitigation] Since these devices have reached End of Life (EOL), no official patches will be released; immediate device replacement or strict access control is required

[Affected Scope] Major Linux distributions running polkit versions 0.113 through 0.118

[Impact] Unprivileged local attackers can bypass D-Bus credential checks to escalate privileges to root and create unauthorized administrator accounts

[Mitigation] Immediately update the polkit package to the patched version using the system package manager

[Affected Scope] Adobe Commerce and Magento Open Source versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier)

[Impact] Unauthenticated attackers can exploit improper input validation during the checkout process to execute arbitrary code (RCE) without user interaction, potentially leading to full system compromise

[Mitigation] Immediately apply the official Adobe security patches (APSB22-12) and update Web Application Firewall (WAF) rules

[Affected Scope] Linux kernel versions 5.1 and lateral, specifically environments utilizing filesystems that fallback to legacy handling and have unprivileged user namespaces enabled

[Impact] An unprivileged local attacker can trigger a heap-based buffer overflow in kernel memory, leading to local privilege escalation (LPE) to root

[Mitigation] Apply the official kernel security patches immediately, or disable unprivileged user namespaces as a temporary workaround

[Affected Scope] Apache APISIX versions 1.3 through 2.12.1 (including LTS versions prior to 2.10.4)

[Impact] Remote attackers can bypass IP restrictions on the Admin API and execute arbitrary code on the target server by exploiting default configurations

[Mitigation] Immediately upgrade Apache APISIX to version 2.12.1, 2.10.4 LTS, or later, and rotate default Admin Keys

[Affected Scope] Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers

[Impact] An authenticated, adjacent attacker can execute arbitrary code with root privileges or cause a denial of service (DoS) via stack-based buffer overflow and command injection

[Mitigation] Immediately apply the latest firmware patches provided by Cisco and restrict access to the web-based management interface

[Affected Scope] Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers

[Impact] Unauthenticated attackers can execute arbitrary code, elevate privileges, bypass authentication, and run unsigned software

[Mitigation] Apply the official Cisco firmware updates immediately and restrict access to the management interface