CVE Vulnerability Advisory Database

[Affected Scope] MikroTik RouterOS versions 6.x and 7.x prior to specific patched releases.

[Impact] Unauthenticated attackers can exploit the bandwidth test (btest) feature to leak kernel memory or cause a Denial of Service (DoS) via kernel restart.

[Mitigation] Apply security patches (6.49.21, 7.23.4, 7.24.2 or later) and disable the bandwidth test server.

[Affected Scope] TrueConf Server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier

[Impact] Remote unauthorized attackers can execute arbitrary scripts and compromise the server by calling undocumented functions via TCP port 4307 without authentication

[Mitigation] Immediately upgrade TrueConf Server to the latest secure version and restrict external network access to TCP port 4307

[Affected Scope] Microsoft Office SharePoint Server environments

[Impact] Unauthenticated remote attackers can bypass authentication mechanisms over the network to elevate privileges to administrative levels

[Mitigation] Immediately apply the official Microsoft security patches and restrict external network access to SharePoint management endpoints

[Affected Scope] LiteLLM proxy server and AI Gateway environments running versions prior to 1.84.0

[Impact] Unauthenticated attackers can bypass API key validation using a fabricated Authorization header, gaining unauthorized access to internal MCP tools and LLM APIs.

[Mitigation] Immediately upgrade the LiteLLM package to version 1.84.0 or higher.

[Affected Scope] Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62

[Impact] Unauthenticated remote attackers can compromise and completely take over the PeopleSoft Enterprise PeopleTools system via HTTP network access

[Mitigation] Immediately apply the official Oracle Critical Patch Update (CPU) and restrict external HTTP access to the affected component

[Affected Scope] Splunk Enterprise versions 10.2.x below 10.2.4 and 10.0.x below 10.0.7 (versions 9.4 and earlier are unaffected)

[Impact] An unauthenticated remote attacker can access the PostgreSQL sidecar service endpoint to create or truncate arbitrary files, potentially leading to Remote Code Execution (RCE)

[Mitigation] Immediately upgrade to patched versions (10.2.4+, 10.0.7+) or disable the PostgreSQL sidecar service if an immediate upgrade is not feasible

[Affected Scope] Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15, specifically the Oracle Payments (File Transmission) component

[Impact] Unauthenticated remote attackers can bypass authentication via HTTP, leading to complete takeover of the Oracle Payments module

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) immediately, and restrict external HTTP access to the Payments module until patched

[Affected Scope] cPanel and WHM versions after 11.40 (prior to the April 28, 2026 security update)

[Impact] Unauthenticated remote attackers can bypass the login flow to gain unauthorized administrative access to the control panel, leading to complete server compromise

[Mitigation] Immediately apply the latest security patches provided by the vendor, and restrict external access to management ports (2082, 2083, 2086, 2087) until patched

[Affected Scope] All versions of marimo open-source Python notebook prior to 0.23.0

[Impact] Unauthenticated remote attackers can establish a connection to the /terminal/ws endpoint, obtaining a full PTY shell and executing arbitrary system commands

[Mitigation] Immediately upgrade the marimo package to version 0.23.0 or higher

[Affected Scope] Langflow versions prior to 1.9.0

[Impact] Unauthenticated remote attackers can execute arbitrary Python code and gain full control over the host system

[Mitigation] Immediately upgrade Langflow to version 1.9.0 or higher, and restrict external access to the vulnerable endpoint

[Affected Scope] Ivanti Endpoint Manager (EPM) versions prior to 2024 SU5

[Impact] A remote unauthenticated attacker can bypass authentication to leak specific stored credential data, potentially leading to full infrastructure compromise

[Mitigation] Immediately upgrade Ivanti EPM to version 2024 SU5 or later, and restrict external access to the management console

[Affected Scope] SmarterTools SmarterMail software versions prior to Build 9511

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands on the target system via a malicious HTTP server, leading to complete system compromise

[Mitigation] Immediately upgrade SmarterMail to the latest stable version (Build 9511 or higher) and restrict access to administrative endpoints

[Affected Scope] Multiple versions of Android OS and framework-based devices

[Impact] Local attackers can bypass background activity launch restrictions to achieve Local Privilege Escalation (LPE) without any user interaction or additional execution privileges

[Mitigation] Immediately apply the latest security patches (December 2025 or later) provided by Google and device OEMs, and restrict unauthorized app installations

[Affected Scope] Oracle Fusion Middleware Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 (REST WebServices component)

[Impact] Unauthenticated remote attackers can bypass authentication via HTTP network access to achieve complete takeover of the Identity Manager system

[Mitigation] Immediately apply the official Oracle Critical Patch Update (CPU) and restrict external access to REST API endpoints

[Affected Scope] Web management interface of Smartbedded Meteobridge weather station devices

[Impact] Adjacent unauthenticated attackers can execute arbitrary system commands with root privileges, leading to full device compromise

[Mitigation] Apply the latest firmware patches immediately and restrict network access to the web administration interface

[Affected Scope] Commvault Command Center Innovation Release versions 11.38.0 through 11.38.20.

[Impact] Unauthenticated remote attackers can upload malicious ZIP installation packages to execute arbitrary code (RCE) via path traversal and JSP web shell deployment.

[Mitigation] Immediately upgrade to patched versions: 11.38.20 with SP38-CU20-433/436 or 11.38.25 with SP38-CU25-434/438 or higher.

[Affected Scope] Erlang/OTP versions prior to OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20

[Impact] Unauthenticated remote attackers can exploit a flaw in SSH protocol message handling to execute arbitrary commands and gain full system control without valid credentials

[Mitigation] Immediately upgrade Erlang/OTP to patched versions (OTP-27.3.3, OTP-26.2.5.11, or OTP-25.3.2.20) or temporarily disable the SSH server and restrict access via firewall rules

[Affected Scope] Langflow versions prior to 1.3.0

[Impact] A remote, unauthenticated attacker can execute arbitrary Python code and fully compromise the host system by sending crafted HTTP requests.

[Mitigation] Immediately upgrade Langflow to version 1.3.0 or later, and restrict external access to the vulnerable endpoint.

[Affected Scope] Palo Alto Networks PAN-OS software management web interface (excluding Cloud NGFW and Prisma Access)

[Impact] Unauthenticated remote attackers with network access can bypass authentication on the management interface and invoke sensitive PHP scripts, severely compromising system integrity and confidentiality

[Mitigation] Immediately upgrade to the patched PAN-OS versions and restrict access to the management interface to trusted internal IP addresses only

[Affected Scope] ProjectSend file sharing platform versions prior to r1720

[Impact] Unauthenticated remote attackers can bypass authentication via options.php to modify application configurations, create unauthorized accounts, upload webshells, and execute arbitrary code

[Mitigation] Immediately upgrade ProjectSend to version r1720 or later, and restrict external access to options.php as a temporary workaround