CVE Vulnerability Advisory Database

[Affected Scope] All AhsayCBS installations running versions up to 9.15.2.69 and 10.3.4.44.

[Impact] Unauthenticated remote attackers can bypass the system password verification logic to gain full administrative access to the backup server.

[Mitigation] Immediately upgrade to version 9.15.2.70, 10.3.4.45, or later as per vendor instructions.

[Affected Scope] JFrog Artifactory Self-Managed instances running under default configurations

[Impact] Unauthenticated network-facing attackers can bypass authentication mechanisms to obtain full administrative privileges

[Mitigation] Immediately upgrade to the latest patched version recommended by JFrog and restrict network access to the instance

[Affected Scope] All JFrog Artifactory Self-Managed instances

[Impact] Unauthenticated attackers can obtain internal anonymous tokens even when anonymous access is disabled, leading to unauthorized access to sensitive artifacts

[Mitigation] Immediate upgrade to the latest patched version and verification of security configurations

[Affected Scope] macOS systems running versions prior to Sequoia 15.7.9, Sonoma 14.8.9, Tahoe 26.6.1/26.7, or Golden Gate 27 with Screen Sharing or VNC services enabled

[Impact] A remote attacker on the network can bypass authentication mechanisms to establish an unauthorized Screen Sharing session without valid credentials, gaining full GUI-level control over the target system

[Mitigation] Immediately apply the latest macOS security updates, or disable 'Screen Sharing' and 'Remote Management' services until patches can be deployed

[Affected Scope] Check Point Security Management Servers and SmartConsole instances exposed to the internet without Trusted Clients restrictions configured

[Impact] Unauthenticated remote attackers can obtain a valid application login token, granting them full administrative privileges to modify security policies and configurations

[Mitigation] Apply the official vendor patches immediately, restrict internet access to the Management Server, and configure Trusted Clients IP restrictions

[Affected Scope] LiteLLM proxy server and AI Gateway environments running versions prior to 1.84.0

[Impact] Unauthenticated attackers can bypass API key validation using a fabricated Authorization header, gaining unauthorized access to internal MCP tools and LLM APIs.

[Mitigation] Immediately upgrade the LiteLLM package to version 1.84.0 or higher.

[Affected Scope] Kestra open-source versions prior to 1.0.45 and 1.3.21

[Impact] Unauthenticated remote attackers can bypass authentication filters to create and execute arbitrary workflows, leading to Remote Code Execution (RCE) as root inside the worker container

[Mitigation] Immediately upgrade Kestra to version 1.0.45, 1.3.21, or higher

[Affected Scope] Check Point Remote Access and Mobile Access VPN gateways utilizing the deprecated IKEv1 key exchange protocol

[Impact] Unauthenticated remote attackers can bypass user authentication and establish unauthorized VPN connections without valid user credentials

[Mitigation] Apply the official vendor hotfixes immediately, or disable the deprecated IKEv1 protocol and transition to IKEv2

[Affected Scope] Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15, specifically the Oracle Payments (File Transmission) component

[Impact] Unauthenticated remote attackers can bypass authentication via HTTP, leading to complete takeover of the Oracle Payments module

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) immediately, and restrict external HTTP access to the Payments module until patched

[Affected Scope] Cisco Catalyst SD-WAN Controller (formerly vSmart), Manager (formerly vManage), and Validator (formerly vBond)

[Impact] Unauthenticated remote attackers can bypass authentication to obtain administrative privileges and manipulate the SD-WAN fabric configuration via NETCONF

[Mitigation] Apply official security patches immediately, and perform system checks on control connections as a temporary measure

[Affected Scope] Cisco Catalyst SD-WAN Controller (formerly vSmart), Cisco Catalyst SD-WAN Manager (formerly vManage), and Cisco Catalyst SD-WAN Validator (formerly vBond).

[Impact] Unauthenticated remote attackers can bypass peering authentication, gain high-privileged administrative access, and manipulate the entire SD-WAN fabric configuration via NETCONF.

[Mitigation] Apply official Cisco software patches immediately and restrict control plane access to trusted peer IPs using Access Control Lists (ACLs).

[Affected Scope] Oracle E-Business Suite versions 12.2.3 through 12.2.14, specifically the Oracle Configurator (Runtime UI) component.

[Impact] Unauthenticated remote attackers can exploit this vulnerability via HTTP to gain unauthorized access to critical data or compromise the entire Oracle Configurator data.

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) immediately and restrict external HTTP/HTTPS access to the affected endpoints.

[Affected Scope] Systems running unpatched versions impacted by CVE-2025-61882

[Impact] Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versi...

[Mitigation] Apply vendor security patches and restrict external network exposure.

[Affected Scope] On-premises deployments of Microsoft SharePoint Server

[Impact] Unauthenticated remote attackers can bypass authentication mechanisms to perform network-based spoofing, potentially accessing sensitive internal data

[Mitigation] Immediately apply the official Microsoft security updates and restrict external network access to SharePoint web ports

[Affected Scope] Quest KACE Systems Management Appliance (SMA) versions 13.0, 13.1, 13.2, 14.0, and 14.1

[Impact] Unauthenticated remote attackers can bypass SSO authentication to impersonate legitimate users and achieve complete administrative takeover

[Mitigation] Immediately upgrade to the patched versions (13.0.385, 13.1.81, 13.2.183, 14.0.341, or 14.1.101 and above)

[Affected Scope] Apple operating systems including iOS 15/16/17/18, iPadOS 15/16/17/18, macOS Ventura/Sonoma/Sequoia, visionOS, and watchOS

[Impact] A logic issue in processing maliciously crafted photos or videos shared via iCloud Links allows unauthorized data access and modification, with active exploitation observed in highly targeted attacks

[Mitigation] Immediately apply the official security updates released by Apple (e.g., iOS 18.3.1, macOS 15.3.1) and exercise caution when opening untrusted iCloud shared links

[Affected Scope] SonicWall SMA (Secure Mobile Access) appliances and firmware utilizing the SSLVPN authentication mechanism

[Impact] Remote unauthenticated attackers can completely bypass authentication, gain administrative access, and compromise the internal network

[Mitigation] Immediately apply the official firmware patches provided by SonicWall and restrict external access to the SSLVPN interface

[Affected Scope] All supported versions of Windows 10, Windows 11, and Windows Server

[Impact] A local attacker with low privileges can bypass security boundaries via RPC interfaces to execute arbitrary code with SYSTEM privileges

[Mitigation] Immediately apply the Microsoft November 2024 Security Update and restrict local user privileges

[Affected Scope] PTZOptics PT30X-SDI and PT30X-NDI camera devices running firmware versions prior to 6.3.40.

[Impact] Remote, unauthenticated attackers can bypass authentication by omitting the HTTP Authorization header, leading to the exposure of sensitive configuration data, password hashes, and unauthorized configuration modifications.

[Mitigation] Immediately upgrade the camera firmware to version 6.3.40 or higher and restrict external internet access to the device.

[Affected Scope] Systems running unpatched versions impacted by CVE-2024-7593

[Impact] Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated a...

[Mitigation] Apply vendor security patches and restrict external network exposure.