CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Plex Media Server Arbitrary File Write and Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-96656)
[Affected Scope] Plex Media Server versions prior to 1.43.3.10861.
[Impact] An authenticated admin can exploit the TranscoderH264Options preference to write arbitrary files, leading to full system compromise via malicious library (.so) execution.
[Mitigation] Immediately update to version 1.43.3.10861 or later and enforce Multi-Factor Authentication (MFA) for all admin accounts.
Windows Internet Shortcut Files Path Control Remote Code Execution Vulnerability (CVE-2025-33053, CISA KEV Actively Exploited)
[Affected Scope] Microsoft Windows operating systems including Windows 10, Windows 11, and Windows Server supporting Internet Shortcut (.url) files.
[Impact] An unauthorized remote attacker can execute arbitrary code with the privileges of the logged-in user by tricking them into opening a crafted .url file that references a malicious WebDAV/SMB share.
[Mitigation] Apply the latest Microsoft cumulative security updates immediately, disable the WebClient service, and block outbound SMB and WebDAV traffic at the perimeter firewall.
Windows NTLM File Path Control Spoofing Vulnerability (CVE-2025-24054) Security Advisory
[Affected Scope] Active Directory environments and Windows operating systems utilizing the NTLM authentication protocol
[Impact] Unauthorized remote attackers can control file names or paths to perform network-based spoofing and credential relay attacks
[Mitigation] Apply the latest Microsoft cumulative security updates and restrict NTLM authentication traffic
Palo Alto Networks PAN-OS Management Web Interface Authenticated File Read Vulnerability (CVE-2025-0111) Analysis and Mitigation Guide
[Affected Scope] PAN-OS firewalls with the management web interface enabled and accessible via the network (excluding Cloud NGFW and Prisma Access)
[Impact] Authenticated attackers can read sensitive system files on the PAN-OS filesystem that are readable by the 'nobody' user, potentially exposing configuration details
[Mitigation] Apply the latest PAN-OS security patches immediately and restrict management interface access to trusted internal IP addresses
Microsoft Windows NTLM Hash Disclosure and Spoofing Vulnerability (CVE-2024-43451) Critical Security Advisory
[Affected Scope] All supported versions of Microsoft Windows and Windows Server operating systems
[Impact] Simple user interaction with a malicious file (such as right-clicking or selecting) triggers NTLM credential disclosure, enabling credential theft and NTLM Relay attacks
[Mitigation] Immediately apply the Microsoft November 2024 cumulative security updates and restrict outbound NTLM traffic via Group Policy and firewalls
Laravel Ignition Debug Mode Remote Code Execution (RCE) Vulnerability Analysis and Mitigation Guide (CVE-2021-3129)
[Affected Scope] Laravel applications running versions prior to 8.4.2 and utilizing facade/ignition versions prior to 2.5.2 with debug mode (APP_DEBUG=true) enabled
[Impact] Unauthenticated remote attackers can execute arbitrary PHP code on the target server, leading to complete system compromise and data exfiltration
[Mitigation] Upgrade the facade/ignition package to version 2.5.2 or higher, and ensure that Laravel debug mode (APP_DEBUG) is set to 'false' in production environments
Juniper Networks Junos OS J-Web Local File Inclusion (LFI) and Remote Code Execution Vulnerability (CVE-2020-1631) Analysis and Mitigation Guide
[Affected Scope] Juniper Networks Junos OS devices with HTTP/HTTPS services (J-Web, Web Authentication, Dynamic-VPN, etc.) enabled
[Impact] Unauthenticated attackers can read arbitrary system files, hijack active administrator session tokens, or inject commands into web logs to execute limited commands
[Mitigation] Upgrade Junos OS to the recommended patched release, or disable HTTP/HTTPS and J-Web services if they are not business-critical