CVE Vulnerability Advisory Database

[Affected Scope] SolarWinds Web Help Desk (WHD) versions prior to 2026.1

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with high privileges on the host machine by sending specially crafted serialized data

[Mitigation] Immediately upgrade SolarWinds Web Help Desk to version 2026.1 or higher, and restrict external network access to the service

[Affected Scope] SmarterTools SmarterMail software versions prior to Build 9511

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands on the target system via a malicious HTTP server, leading to complete system compromise

[Mitigation] Immediately upgrade SmarterMail to the latest stable version (Build 9511 or higher) and restrict access to administrative endpoints

[Affected Scope] Active deployments of Langflow utilizing the validate API endpoint.

[Impact] Unauthenticated remote attackers can execute arbitrary code with root privileges by exploiting untrusted resource inclusion.

[Mitigation] Immediately upgrade Langflow to the latest patched version and restrict external access to the validation endpoint.

[Affected Scope] Cisco Unified Communications Manager (Unified CM), Unified CM SME, Unified CM IM&P, Cisco Unity Connection, and Webex Calling Dedicated Instance

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands via the web management interface and escalate privileges to root

[Mitigation] Apply official Cisco security patches immediately and restrict network access to the web-based management interface

[Affected Scope] Oracle HTTP Server and WebLogic Server Proxy Plug-in (for Apache HTTP Server and IIS) versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 within Oracle Fusion Middleware.

[Impact] Unauthenticated remote attackers can exploit this vulnerability via HTTP to compromise the server, leading to unauthorized data modification, deletion, or complete system takeover with potential scope expansion to backend systems (CVSS 10.0).

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) immediately, restrict network access, and deploy WAF rules to filter malicious HTTP headers.

[Affected Scope] Microsoft SharePoint Server deployments

[Impact] Unauthenticated remote attackers can execute arbitrary code over the network and gain full control of the target server.

[Mitigation] Apply the official Microsoft security patches immediately and restrict external access to SharePoint web interfaces until patched.

[Affected Scope] FortiOS versions 6.4 through 7.6 and FortiSwitchManager versions 7.0 through 7.2.

[Impact] Unauthenticated remote attackers can execute arbitrary code or commands with system privileges by sending crafted packets, leading to full system compromise.

[Mitigation] Immediately apply the latest firmware updates provided by Fortinet and restrict exposure of management interfaces and VPN services to the public internet.

[Affected Scope] Zimbra Collaboration (ZCS) versions 10.0 and 10.1 utilizing the Webmail Classic UI

[Impact] Unauthenticated remote attackers can exploit the /h/rest endpoint to include and execute arbitrary files from the WebRoot directory, potentially leading to sensitive information disclosure and Remote Code Execution (RCE)

[Mitigation] Immediately apply the official security patches from Zimbra, or restrict external access to the vulnerable /h/rest endpoint as a temporary workaround

[Affected Scope] n8n versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.122.0

[Impact] Authenticated attackers can exploit an insufficiently isolated execution context during expression evaluation to execute arbitrary system commands with n8n process privileges, potentially leading to full instance compromise

[Mitigation] Immediately upgrade n8n to patched versions (1.120.4, 1.121.1, or 1.122.0 and above)

[Affected Scope] WatchGuard Firebox appliances running Fireware OS configured with IKEv2 mobile user VPN or branch office VPN using a dynamic gateway peer, or where these configurations were previously deleted but a static gateway peer VPN remains.

[Impact] A critical vulnerability (CVSS 9.8) allowing unauthenticated remote attackers to trigger an out-of-bounds write (CWE-787) in the iked process via crafted IKEv2 packets, leading to arbitrary code execution (RCE) with root privileges.

[Mitigation] Since this vulnerability is actively exploited and listed in the CISA KEV catalog, immediately upgrade to the patched Fireware OS version and restrict or disable IKEv2 services where possible.

[Affected Scope] Apple devices running iOS/iPadOS prior to 18.7.3 and 26.2, macOS Tahoe prior to 26.2, and Safari prior to 26.2

[Impact] Processing maliciously crafted web content may lead to arbitrary code execution (RCE), with active exploitation reported in highly targeted attacks

[Mitigation] Immediately apply the official security updates (version 26.2 / 18.7.3 or later) provided by Apple

[Affected Scope] Cisco Secure Email Gateway and Cisco Secure Email and Web Manager running Cisco AsyncOS Software with the Spam Quarantine feature enabled

[Impact] Unauthenticated, remote attackers can execute arbitrary system commands with root privileges on the underlying operating system

[Mitigation] Apply official Cisco security patches immediately, or restrict/disable external access to the Spam Quarantine feature as a temporary workaround

[Affected Scope] HPE OneView management platform and associated appliance software

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges, leading to full infrastructure compromise

[Mitigation] Apply official HPE security patches immediately and restrict access to the management interface from untrusted networks

[Affected Scope] Gladinet CentreStack and Triofox solutions prior to version 16.12.10420.56791

[Impact] Unauthenticated remote attackers can exploit hardcoded AES keys to read arbitrary local files and potentially achieve full system compromise

[Mitigation] Immediately upgrade to version 16.12.10420.56791 or later and restrict access to publicly exposed endpoints

[Affected Scope] All active deployments of Gogs Git service utilizing the vulnerable PutContents API.

[Impact] An authenticated attacker with low privileges can exploit improper symbolic link validation to overwrite arbitrary system files, leading to Remote Code Execution (RCE).

[Mitigation] Immediately upgrade Gogs to the latest patched version and restrict repository creation and write permissions for untrusted users.

[Affected Scope] React versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 utilizing React Server Components (RSC), including react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack packages

[Impact] Unauthenticated remote attackers can execute arbitrary code on the server by sending malicious payloads to Server Function endpoints, leading to complete system compromise

[Mitigation] Immediately upgrade React and all associated react-server-dom packages to the latest patched versions, and apply WAF rules to restrict suspicious RSC requests

[Affected Scope] Developers running Ray AI compute engine versions prior to 2.52.0 in local or development environments

[Impact] Remote Code Execution (RCE) on the developer's machine via DNS rebinding and browser-based request forgery when visiting malicious websites or viewing malvertisements

[Mitigation] Immediately upgrade the Ray package to version 2.52.0 or higher

[Affected Scope] Fortinet FortiWeb versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.5, 7.4.0 through 7.4.10, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.11

[Impact] An authenticated attacker can execute arbitrary OS commands with elevated privileges on the underlying system via crafted HTTP requests or CLI commands

[Mitigation] Immediately upgrade to the patched versions (8.0.2, 7.6.6, 7.4.11, 7.2.12, 7.0.12 or higher) as recommended by the vendor

[Affected Scope] Fortinet FortiWeb versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.4, 7.4.0 through 7.4.9, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.11

[Impact] Unauthenticated remote attackers can execute arbitrary administrative commands on the system via crafted HTTP or HTTPS requests

[Mitigation] Immediately upgrade to the official patched versions (8.0.2, 7.6.5, 7.4.10, 7.2.12, 7.0.12 or higher)

[Affected Scope] FreePBX Endpoint Manager and Filestore module versions 17.0.2.36 and above before 17.0.3

[Impact] An authenticated administrator can execute arbitrary OS commands via the SSH connection test function, gaining remote access as the asterisk user

[Mitigation] Immediately upgrade the FreePBX Filestore module to version 17.0.3 or higher