CVE Vulnerability Advisory Database

[Affected Scope] Craft CMS versions 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17

[Impact] Unauthenticated remote attackers can execute arbitrary PHP code on the target server via crafted HTTP requests, leading to complete system compromise.

[Mitigation] Immediately upgrade your Craft CMS installation to the patched versions (3.9.15, 4.14.15, or 5.6.17) depending on your major version branch.

[Affected Scope] Commvault Command Center Innovation Release versions 11.38.0 through 11.38.20.

[Impact] Unauthenticated remote attackers can upload malicious ZIP installation packages to execute arbitrary code (RCE) via path traversal and JSP web shell deployment.

[Mitigation] Immediately upgrade to patched versions: 11.38.20 with SP38-CU20-433/436 or 11.38.25 with SP38-CU25-434/438 or higher.

[Affected Scope] Erlang/OTP versions prior to OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20

[Impact] Unauthenticated remote attackers can exploit a flaw in SSH protocol message handling to execute arbitrary commands and gain full system control without valid credentials

[Mitigation] Immediately upgrade Erlang/OTP to patched versions (OTP-27.3.3, OTP-26.2.5.11, or OTP-25.3.2.20) or temporarily disable the SSH server and restrict access via firewall rules

[Affected Scope] Yii 2 framework versions prior to 2.0.52

[Impact] Remote attackers can execute arbitrary PHP code on the server and fully compromise the system via specially crafted requests.

[Mitigation] Immediately upgrade the Yii2 framework to the patched version 2.0.52 or higher.

[Affected Scope] Langflow versions prior to 1.3.0

[Impact] A remote, unauthenticated attacker can execute arbitrary Python code and fully compromise the host system by sending crafted HTTP requests.

[Mitigation] Immediately upgrade Langflow to version 1.3.0 or later, and restrict external access to the vulnerable endpoint.

[Affected Scope] CrushFTP 10 before 10.8.4 and CrushFTP 11 before 11.3.1

[Impact] Unauthenticated attackers can bypass authentication via HTTP(S) ports to take over the 'crushadmin' account and fully compromise the system

[Mitigation] Immediately upgrade CrushFTP to version 10.8.4 / 11.3.1 or later, and enforce DMZ proxy configurations

[Affected Scope] Gladinet CentreStack versions through 16.1.10296.56315

[Impact] Unauthenticated remote code execution (RCE) via deserialization of malicious payloads using the hardcoded machineKey, actively exploited in the wild

[Mitigation] Immediately upgrade to version 16.4.10315.56368 or later, or manually delete/rotate the hardcoded machineKey in the portal web.config file

[Affected Scope] Ivanti Connect Secure (before 22.7R2.6), Policy Secure (before 22.7R1.4), and ZTA Gateways (before 22.8R2.2)

[Impact] Unauthenticated remote attackers can trigger a stack-based buffer overflow to execute arbitrary code with root privileges on the target gateway

[Mitigation] Immediately apply the official security patches provided by the vendor and restrict access to external-facing management interfaces

[Affected Scope] D-Link DIR-823X router firmware versions 240126 and 240802.

[Impact] An authorized attacker can execute arbitrary system commands with root privileges and fully compromise the device by sending a crafted HTTP POST request to the /goform/set_prohibiting endpoint.

[Mitigation] Apply the official firmware patch immediately, disable remote WAN management, and enforce strong administrator credentials.

[Affected Scope] Kentico Xperience through version 13.0.178

[Impact] Authenticated attackers can exploit the Staging Sync Server to upload arbitrary files to relative paths, leading to server-side execution and full Remote Code Execution (RCE)

[Mitigation] Apply the official Kentico hotfix immediately and restrict access to the Staging Sync Server endpoints

[Affected Scope] Kentico Xperience through version 13.0.178 with Staging Sync Server enabled

[Impact] Unauthenticated attackers can bypass authentication to control administrative objects, leading to full Remote Code Execution (RCE)

[Mitigation] Apply the official Kentico hotfix immediately and restrict external access to the Staging Sync Server endpoint

[Affected Scope] Kentico Xperience versions up to and including 13.0.172

[Impact] Attackers can bypass authentication to gain administrative control, potentially leading to full system compromise and Remote Code Execution (RCE)

[Mitigation] Apply the official hotfix immediately, or restrict access to the Staging Sync Server endpoint via IP whitelisting

[Affected Scope] Devices running iOS 15/16/17/18, iPadOS, macOS Sequoia, visionOS, watchOS, and Safari browser

[Impact] Processing maliciously crafted web content may allow an attacker to break out of the Web Content sandbox and execute arbitrary code, with active exploitation reported in targeted attacks

[Mitigation] Immediately apply the official security updates released by Apple, including iOS 18.3.2 and macOS 15.3.2

[Affected Scope] FreeType versions 2.13.0 and below

[Impact] Heap buffer overflow during TrueType GX and variable font parsing, potentially leading to arbitrary code execution (RCE) with active in-the-wild exploitation detected

[Mitigation] Immediately upgrade FreeType to a non-vulnerable version (2.13.1 or newer)

[Affected Scope] Apache Tomcat versions 11.0.0-M1 through 11.0.2, 10.1.0-M1 through 10.1.34, 9.0.0.M1 through 9.0.98, and EOL 8.5.0 through 8.5.100.

[Impact] Attackers can bypass path validation via internal dot path equivalence, allowing them to inject malicious content into sensitive files or trigger remote code execution (RCE) via session deserialization.

[Mitigation] Immediately upgrade to patched versions (11.0.3, 10.1.35, or 9.0.99) and ensure the Default Servlet's 'readonly' parameter is set to 'true'.

[Affected Scope] Edimax IC-7100 IP camera devices

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges and fully compromise the device by sending specially crafted HTTP requests

[Mitigation] Apply official vendor patches immediately, or restrict management interface access from the public internet and isolate the affected devices

[Affected Scope] NAKIVO Backup & Replication versions prior to 11.0.0.88174

[Impact] Unauthenticated remote attackers can exploit absolute path traversal to read arbitrary system files, potentially leading to enterprise-wide Remote Code Execution (RCE) due to cleartext credentials stored in PhysicalDiscovery.

[Mitigation] Immediately upgrade NAKIVO Backup & Replication to version 11.0.0.88174 or later and restrict external access.

[Affected Scope] XWiki Platform versions prior to 15.10.11, 16.4.1, and 16.5.0RC1

[Impact] Unauthenticated remote attackers can execute arbitrary Groovy code via the SolrSearch API, leading to complete compromise of the host system.

[Mitigation] Immediately upgrade to patched versions (15.10.11, 16.4.1, 16.5.0RC1 or later) or apply the recommended XML macro workaround.

[Affected Scope] Trimble Cityworks versions prior to 15.8.9 and Cityworks with Office Companion versions prior to 23.10

[Impact] Authenticated attackers can exploit a deserialization vulnerability (CWE-502) to execute arbitrary code with system privileges on the Microsoft IIS web server

[Mitigation] Immediately upgrade to patched versions (Cityworks 15.8.9+ or Office Companion 23.10+) and restrict IIS access controls

[Affected Scope] All unpatched installations of 7-Zip software

[Impact] When extracting files from a crafted archive, the Mark-of-the-Web (MotW) is not propagated, allowing arbitrary code execution under the current user context without security warnings

[Mitigation] Immediately upgrade 7-Zip to the latest patched version and monitor unpatched endpoint assets