CVE Vulnerability Advisory Database

[Affected Scope] Cisco Catalyst SD-WAN Controller (formerly vSmart), Manager (formerly vManage), and Validator (formerly vBond)

[Impact] Unauthenticated remote attackers can bypass authentication to obtain administrative privileges and manipulate the SD-WAN fabric configuration via NETCONF

[Mitigation] Apply official security patches immediately, and perform system checks on control connections as a temporary measure

[Affected Scope] Palo Alto Networks PAN-OS software with GlobalProtect portal or gateway enabled (Panorama and Cloud NGFW are not impacted).

[Impact] Unauthenticated attackers can bypass security restrictions to establish unauthorized VPN connections and gain access to internal network resources.

[Mitigation] Apply the official security patches immediately, and restrict access to GlobalProtect interfaces until fully patched.

[Affected Scope] 84 malicious versions across 42 @tanstack/* packages published between 19:20 and 19:26 UTC on 2026-05-11

[Impact] Attackers successfully published credential-stealing malware under trusted identities by hijacking legitimate OIDC tokens

[Mitigation] Immediately audit dependency trees, purge affected package versions, and rotate all potentially exposed credentials

[Affected Scope] LiteLLM proxy server environments running versions 1.74.2 to before 1.83.7

[Impact] Authenticated users with low-privilege API keys can execute arbitrary OS commands on the proxy host, potentially leading to full system compromise

[Mitigation] Immediately upgrade LiteLLM to the patched version 1.83.7 or later, and restrict access to the vulnerable endpoints in the interim

[Affected Scope] LiteLLM proxy server environments running versions from 1.81.16 to before 1.83.7

[Impact] Unauthenticated attackers can read or modify the proxy's database, leading to unauthorized access to the proxy and managed API credentials

[Mitigation] Immediately upgrade LiteLLM to version 1.83.7 or later, and apply WAF rules to block malicious Authorization headers in the interim

[Affected Scope] Ivanti EPMM versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1

[Impact] A remotely authenticated attacker with administrative privileges can exploit improper input validation to execute arbitrary code and fully compromise the system.

[Mitigation] Immediately upgrade to the patched versions (12.6.1.1, 12.7.0.1, 12.8.0.1, or higher) provided by the vendor.

[Affected Scope] Palo Alto Networks PAN-OS software running on PA-Series and VM-Series firewalls with the User-ID™ Authentication Portal (Captive Portal) service enabled.

[Impact] An unauthenticated remote attacker can execute arbitrary code with root privileges on the firewall by sending specially crafted packets.

[Mitigation] Apply the latest security patches immediately, and restrict access to the User-ID™ Authentication Portal to trusted internal IP addresses only.

[Affected Scope] cPanel and WHM versions after 11.40 (prior to the April 28, 2026 security update)

[Impact] Unauthenticated remote attackers can bypass the login flow to gain unauthorized administrative access to the control panel, leading to complete server compromise

[Mitigation] Immediately apply the latest security patches provided by the vendor, and restrict external access to management ports (2082, 2083, 2086, 2087) until patched

[Affected Scope] Systems running Linux kernel with the algif_aead crypto subsystem module enabled.

[Impact] A local attacker can exploit this vulnerability to cause kernel memory corruption, potentially leading to local privilege escalation (LPE) to root or system instability (Kernel Panic).

[Mitigation] Apply the latest stable kernel updates from your distribution or disable the algif_aead socket module if not required.

[Affected Scope] Windows systems with Microsoft Defender enabled and lacking the latest security updates.

[Impact] An authorized local attacker can exploit insufficient access control granularity to elevate privileges to SYSTEM, potentially disabling security controls.

[Mitigation] Immediately update the Microsoft Defender engine and definition files to the latest version, especially as this vulnerability is actively exploited in the wild.

[Affected Scope] Internet Key Exchange (IKE) Extension service running on Microsoft Windows and Windows Server operating systems

[Impact] An unauthenticated remote attacker can execute arbitrary code with system/kernel privileges over the network by sending specially crafted IKE packets

[Mitigation] Apply the official Microsoft security updates immediately, and restrict external access to IKE/IPsec ports (UDP 500/4500) as a temporary workaround

[Affected Scope] Microsoft Windows operating systems utilizing the Windows Shell component

[Impact] Unauthorized remote attackers can bypass security warnings to perform network-based spoofing, potentially leading to credential harvesting or malware delivery

[Mitigation] Apply the official Microsoft security updates immediately and restrict outbound SMB/WebDAV traffic

[Affected Scope] Microsoft SharePoint Server deployments

[Impact] An unauthenticated remote attacker can exploit improper input validation (CWE-20) over the network to perform spoofing, potentially leading to unauthorized data exposure and modification

[Mitigation] Immediately apply the official security updates provided by Microsoft, and implement WAF rules to monitor and block anomalous HTTP requests in the interim

[Affected Scope] Fortinet FortiSandbox versions 4.4.0 through 4.4.8

[Impact] Unauthenticated remote attackers can execute unauthorized OS commands or code with elevated privileges, potentially leading to full system compromise

[Mitigation] Immediately upgrade to FortiSandbox version 4.4.9 or higher, and restrict access to management interfaces

[Affected Scope] Major Fortinet solutions including FortiOS (6.4-7.6), FortiPAM (1.0-1.7), FortiProxy (7.0-7.6), and FortiSwitchManager (7.0-7.2).

[Impact] Authenticated attackers with administrative privileges can write or delete arbitrary system files via specific CLI commands, leading to system compromise or persistence.

[Mitigation] Immediately upgrade to the latest patched firmware versions and strictly enforce IP-based access control for administrative CLI access.

[Affected Scope] Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier

[Impact] Successful exploitation allows arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious PDF file

[Mitigation] Immediately apply the official Adobe security update (APSB26-43) and restrict opening untrusted PDF documents

[Affected Scope] Apache Tomcat versions 11.0.20, 10.1.53, and 9.0.116 utilizing clustering with EncryptInterceptor enabled

[Impact] Incomplete fix for CVE-2026-29146 allows attackers to bypass the EncryptInterceptor, leading to the transmission of sensitive session data in plaintext across the network

[Mitigation] Immediately upgrade to patched Apache Tomcat versions 11.0.21, 10.1.54, or 9.0.117

[Affected Scope] All versions of marimo open-source Python notebook prior to 0.23.0

[Impact] Unauthenticated remote attackers can establish a connection to the /terminal/ws endpoint, obtaining a full PTY shell and executing arbitrary system commands

[Mitigation] Immediately upgrade the marimo package to version 0.23.0 or higher

[Affected Scope] Apache ActiveMQ Classic versions prior to 5.19.4, and 6.0.0 through 6.2.3

[Impact] An authenticated attacker can execute arbitrary system commands within the broker's JVM by loading a malicious remote Spring XML configuration via the Jolokia JMX-HTTP bridge

[Mitigation] Immediately upgrade Apache ActiveMQ to a patched version (5.19.4 or 6.2.3) and restrict Jolokia access policies

[Affected Scope] Fortinet FortiClientEMS versions 7.4.5 through 7.4.6

[Impact] An unauthenticated remote attacker can execute unauthorized code or commands with system privileges via crafted network requests.

[Mitigation] Apply the official Fortinet security patch (version 7.4.7 or higher) immediately and restrict external network access to the EMS server.