CVE Vulnerability Advisory Database

[Affected Scope] All Plex Media Server installations prior to version 1.43.3.10861

[Impact] Attackers can manipulate 'searchOne' parameters to invoke internal plugin functions and inject arbitrary parameters, potentially leading to server compromise or unauthorized data access

[Mitigation] Immediately update Plex Media Server to version 1.43.3.10861 or later

[Affected Scope] Google Chrome versions prior to 153.0.8010.36 and Chromium-based browsers

[Impact] Remote attackers can execute arbitrary code within the browser sandbox via a crafted HTML page

[Mitigation] Immediately update Google Chrome to version 153.0.8010.36 or later

[Affected Scope] MikroTik RouterOS versions 6.x and 7.x prior to specific patched releases.

[Impact] Unauthenticated attackers can exploit the bandwidth test (btest) feature to leak kernel memory or cause a Denial of Service (DoS) via kernel restart.

[Mitigation] Apply security patches (6.49.21, 7.23.4, 7.24.2 or later) and disable the bandwidth test server.

[Affected Scope] Microsoft SharePoint Server 2016, 2019, and Subscription Edition.

[Impact] Authorized attackers can execute arbitrary code over the network, leading to full server compromise.

[Mitigation] Apply official Microsoft security updates immediately and monitor for unauthorized web shell activity.

[Affected Scope] Sangoma Switchvox SMB Edition 8.3 (104997) and prior versions

[Impact] An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database, leading to full database compromise and remote code execution (RCE)

[Mitigation] Immediately upgrade to Switchvox version 8.4.0.2 or later, and restrict external access to the /pa endpoint

[Affected Scope] Joomla iCagenda extension versions prior to 3.9.15 and 4.0.8

[Impact] Unauthenticated remote attackers can bypass file upload restrictions to upload malicious PHP scripts, leading to complete system compromise via Remote Code Execution (RCE).

[Mitigation] Immediately upgrade the iCagenda extension to the patched versions (3.9.15 / 4.0.8 or higher) and disable script execution in upload directories.

[Affected Scope] Ivanti Sentry versions prior to R10.5.2, R10.6.2, and R10.7.1

[Impact] An unauthenticated remote attacker can execute arbitrary OS commands with root privileges, leading to complete system compromise

[Mitigation] Immediately upgrade to the patched versions (R10.5.2, R10.6.2, R10.7.1, or higher)

[Affected Scope] LiteSpeed User-End cPanel Plugin versions prior to 2.4.5

[Impact] Unauthenticated remote attackers can escalate privileges (potentially to root) by exploiting improper handling of Redis features, with active exploitation observed in the wild.

[Mitigation] Immediately upgrade the plugin to the recommended minimum version of 2.4.7 or higher and perform IoC scanning using the provided command.

[Affected Scope] All endpoint systems running TrueConf Client versions prior to 8.5

[Impact] Attackers manipulating the update delivery path can inject tampered payloads, leading to arbitrary code execution under the updater's privilege context

[Mitigation] Immediately upgrade TrueConf Client to version 8.5 or later to enforce proper update verification

[Affected Scope] Apple devices running iOS before 26.3, iPadOS before 26.3, macOS Tahoe before 26.3, tvOS before 26.3, visionOS before 26.3, and watchOS before 26.3

[Impact] An attacker with local memory write capabilities can exploit this vulnerability to execute arbitrary code with elevated privileges, potentially compromising the entire system

[Mitigation] Apply the official software updates immediately to upgrade systems to version 26.3 or later

[Affected Scope] FortiOS versions 6.4 through 7.6 and FortiSwitchManager versions 7.0 through 7.2.

[Impact] Unauthenticated remote attackers can execute arbitrary code or commands with system privileges by sending crafted packets, leading to full system compromise.

[Mitigation] Immediately apply the latest firmware updates provided by Fortinet and restrict exposure of management interfaces and VPN services to the public internet.

[Affected Scope] SmarterMail mail server software

[Impact] Unauthenticated remote attackers can upload arbitrary files to any location on the mail server, potentially leading to full Remote Code Execution (RCE)

[Mitigation] Immediately apply the latest official security patches and restrict external access to sensitive upload endpoints and admin interfaces

[Affected Scope] All Array Networks ArrayOS AG appliances running versions prior to 9.4.5.9

[Impact] High-privileged attackers can execute arbitrary OS commands, leading to complete system compromise and webshell deployment

[Mitigation] Immediately upgrade ArrayOS AG to version 9.4.5.9 or higher and audit system logs for indicators of compromise

[Affected Scope] Samsung Android mobile devices running security patch levels prior to SMR Apr-2025 Release 1

[Impact] Remote attackers can execute arbitrary code with high privileges and compromise the device without user interaction by triggering an out-of-bounds write during image decoding.

[Mitigation] Immediately apply the Samsung April 2025 Security Maintenance Release (SMR Apr-2025 Release 1) or later.

[Affected Scope] On-premises deployments of Microsoft SharePoint Server

[Impact] Unauthenticated remote attackers can bypass authentication mechanisms to perform network-based spoofing, potentially accessing sensitive internal data

[Mitigation] Immediately apply the official Microsoft security updates and restrict external network access to SharePoint web ports

[Affected Scope] Advantive VeraCore through version 2025.1.0 affecting the timeoutWarning.asp component

[Impact] Unauthenticated remote attackers can execute arbitrary SQL commands via the PmSess1 parameter, leading to unauthorized data exposure

[Mitigation] Apply the official vendor security patch immediately, or implement WAF rules to block malicious payloads targeting the affected parameter

[Affected Scope] Certain End-of-Life (EOL) GeoVision IP cameras, video servers, and LPR systems

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges, leading to complete device takeover and botnet recruitment

[Mitigation] Since these devices are EOL and no patches will be released, immediately isolate the affected devices from the internet or replace them with supported models

[Affected Scope] Ivanti CSA (Cloud Services Appliance) versions prior to 5.0.2

[Impact] A remote authenticated attacker with administrative privileges can execute arbitrary SQL statements, potentially leading to sensitive data exposure and further system compromise.

[Mitigation] Immediately upgrade Ivanti CSA to version 5.0.2 or higher, and restrict external access to the admin console.

[Affected Scope] Ivanti Cloud Services Appliance (CSA) versions prior to 4.6 Patch 519

[Impact] Unauthenticated remote attackers can bypass authentication via path traversal to access restricted administrative endpoints, potentially leading to Remote Code Execution (RCE) when chained with other vulnerabilities

[Mitigation] Organizations utilizing Ivanti CSA 4.6 must immediately apply Patch 519 or migrate to the actively supported CSA 5.0, as the 4.6 branch has reached End-of-Life (EOL)

[Affected Scope] Palo Alto Networks PAN-OS 10.2, 11.0, and 11.1 firewalls with GlobalProtect gateway or portal enabled

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with root privileges on the firewall via specially crafted requests

[Mitigation] Immediately apply the official PAN-OS hotfix, or implement temporary workarounds such as disabling Device Telemetry or applying Threat Prevention signatures