CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Gladinet CentreStack Remote Code Execution (RCE) Vulnerability via Hardcoded machineKey (CVE-2025-30406) Critical Security Advisory
[Affected Scope] Gladinet CentreStack versions through 16.1.10296.56315
[Impact] Unauthenticated remote code execution (RCE) via deserialization of malicious payloads using the hardcoded machineKey, actively exploited in the wild
[Mitigation] Immediately upgrade to version 16.4.10315.56368 or later, or manually delete/rotate the hardcoded machineKey in the portal web.config file
Apache Shiro RememberMe Default Cipher Key Remote Code Execution Vulnerability (CVE-2016-4437)
[Affected Scope] All Java applications utilizing Apache Shiro versions prior to 1.2.5
[Impact] Remote attackers can leverage the hardcoded default AES encryption key to send malicious serialized objects, leading to arbitrary code execution (RCE) or access control bypass
[Mitigation] Immediately upgrade Apache Shiro to version 1.2.5 or higher, and explicitly configure a unique, secure random cipher key for the RememberMe service