CVE Vulnerability Advisory Database

[Affected Scope] Google Chrome versions prior to 146.0.7680.178

[Impact] A remote attacker who has compromised the renderer process can execute arbitrary code via a crafted HTML page

[Mitigation] Immediately update Google Chrome to the latest stable version (146.0.7680.178 or higher)

[Affected Scope] All endpoint systems running TrueConf Client versions prior to 8.5

[Impact] Attackers manipulating the update delivery path can inject tampered payloads, leading to arbitrary code execution under the updater's privilege context

[Mitigation] Immediately upgrade TrueConf Client to version 8.5 or later to enforce proper update verification

[Affected Scope] Trivy Go/Container image v0.69.4, trivy-action v0.0.1 to v0.34.2 (76 tags), setup-trivy v0.2.0 to v0.2.6

[Impact] A threat actor used compromised credentials to force-push malicious commits to version tags, enabling credential exfiltration from CI/CD pipelines

[Mitigation] Upgrade to safe versions (Trivy v0.69.2/v0.69.3, trivy-action v0.35.0, setup-trivy v0.2.6 recreated) and pin actions to immutable commit SHAs

[Affected Scope] Citrix NetScaler ADC and NetScaler Gateway appliances configured to act as a SAML Identity Provider (IDP)

[Impact] Unauthenticated remote attackers can trigger an out-of-bounds memory read, potentially exposing highly sensitive session tokens, credentials, or SSL private keys, and facilitating remote code execution

[Mitigation] Immediately apply the official security updates provided by Citrix, or temporarily disable the SAML IDP configuration if patching cannot be performed immediately

[Affected Scope] Langflow versions prior to 1.9.0

[Impact] Unauthenticated remote attackers can execute arbitrary Python code and gain full control over the host system

[Mitigation] Immediately upgrade Langflow to version 1.9.0 or higher, and restrict external access to the vulnerable endpoint

[Affected Scope] Google Chrome and Chromium-based browsers prior to version 146.0.7680.75

[Impact] A remote attacker can execute arbitrary code inside the browser sandbox renderer process by enticing a user to visit a specially crafted HTML page

[Mitigation] Immediately update Google Chrome to the latest stable version (146.0.7680.75 or higher)

[Affected Scope] Google Chrome and Chromium-based browsers prior to version 146.0.7680.75

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (system crash) via a crafted HTML page

[Mitigation] Immediately update Google Chrome to the latest stable version (146.0.7680.75 or higher)

[Affected Scope] Lantronix EDS5000 device servers running firmware version 2.1.0.0R3

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with root privileges by sending crafted HTTP RPC requests

[Mitigation] Apply the official firmware patch immediately, and restrict external access to the HTTP/HTTPS management interfaces

[Affected Scope] Web-based management interface of Cisco Secure Firewall Management Center (FMC) Software.

[Impact] Unauthenticated, remote attackers can execute arbitrary Java code with root privileges by sending crafted serialized Java objects.

[Mitigation] Apply official Cisco security patches immediately and restrict public internet access to the FMC management interface.

[Affected Scope] Web-based management interface of Cisco Secure Firewall Management Center (FMC) Software

[Impact] Unauthenticated remote attackers can bypass authentication and execute scripts to obtain full root access to the underlying operating system

[Mitigation] Immediate application of official security patches and restriction of management interface access via ACLs

[Affected Scope] Mobile and embedded devices powered by Qualcomm chipsets running affected Android kernel versions

[Impact] Local attackers can trigger an integer overflow (CWE-190) during memory alignment, leading to memory corruption and local privilege escalation (LPE) to kernel level

[Mitigation] Immediately apply the March 2026 security patches released by Qualcomm and Android OEMs

[Affected Scope] VMware Aria Operations instances with support-assisted product migration in progress

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands, potentially leading to full system compromise and remote code execution

[Mitigation] Apply official security patches listed in Broadcom VMSA-2026-0001 immediately, or restrict access to migration services

[Affected Scope] Network devices and virtual appliances running Cisco Catalyst SD-WAN Software

[Impact] Attackers can bypass file system restrictions via vshell access to read sensitive underlying operating system information

[Mitigation] Apply the official Cisco security patches immediately and restrict vshell/CLI access privileges

[Affected Scope] Cisco Catalyst SD-WAN Manager releases prior to 20.18

[Impact] Unauthenticated, remote attackers can retrieve the DCA password file via crafted HTTP requests and gain unauthorized DCA user privileges

[Mitigation] Immediately upgrade Cisco Catalyst SD-WAN Manager to release 20.18 or later

[Affected Scope] Cisco Catalyst SD-WAN Controller (formerly vSmart), Cisco Catalyst SD-WAN Manager (formerly vManage), and Cisco Catalyst SD-WAN Validator (formerly vBond).

[Impact] Unauthenticated remote attackers can bypass peering authentication, gain high-privileged administrative access, and manipulate the entire SD-WAN fabric configuration via NETCONF.

[Mitigation] Apply official Cisco software patches immediately and restrict control plane access to trusted peer IPs using Access Control Lists (ACLs).

[Affected Scope] Cisco Catalyst SD-WAN Manager (formerly vManage) API interface

[Impact] Authenticated remote attackers with read-only API credentials can overwrite arbitrary files on the local file system and gain vmanage user privileges

[Mitigation] Apply official Cisco security patches immediately, restrict API access, and audit API permissions for low-privileged accounts

[Affected Scope] Dell RecoverPoint for Virtual Machines versions prior to 6.0.3.1 HF1

[Impact] Unauthenticated remote attackers can leverage hardcoded credentials to gain unauthorized root-level access and establish persistence on the underlying operating system

[Mitigation] Immediately upgrade to version 6.0.3.1 HF1 or later, or apply strict network access controls

[Affected Scope] Google Chrome browser versions prior to 145.0.7632.75

[Impact] Remote attackers can execute arbitrary code inside the browser sandbox via a crafted HTML page

[Mitigation] Immediately update Google Chrome to the latest stable version (145.0.7632.75 or higher)

[Affected Scope] Soliton FileZen deployments with the Antivirus Check Option enabled

[Impact] An authenticated attacker can execute arbitrary OS commands with elevated privileges by sending a specially crafted HTTP request

[Mitigation] Immediately apply the official vendor security patches, or temporarily disable the Antivirus Check Option and restrict network access

[Affected Scope] Apple devices running iOS before 26.3, iPadOS before 26.3, macOS Tahoe before 26.3, tvOS before 26.3, visionOS before 26.3, and watchOS before 26.3

[Impact] An attacker with local memory write capabilities can exploit this vulnerability to execute arbitrary code with elevated privileges, potentially compromising the entire system

[Mitigation] Apply the official software updates immediately to upgrade systems to version 26.3 or later