CVE Vulnerability Advisory Database

[Affected Scope] ConnectWise ScreenConnect client software (Servers are not impacted)

[Impact] Attackers can exploit active remote sessions to transfer and execute malicious files without host confirmation, leading to full system compromise.

[Mitigation] Immediately update all ScreenConnect clients to the latest patched version and enforce session consent policies.

[Affected Scope] SonicWall SMA1000 appliances utilizing the Appliance Management Console (AMC)

[Impact] High-privileged attackers can exploit insufficient authorization to escalate privileges to root, leading to complete system compromise

[Mitigation] Apply the official security patches immediately and restrict network access to the management console

[Affected Scope] Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software with Remote Access VPN enabled

[Impact] Unauthenticated remote attackers can bypass authentication to access restricted VPN-related URL endpoints, and active exploit variants can trigger unexpected device reloads, causing a complete Denial of Service (DoS)

[Mitigation] Immediately upgrade to the fixed software releases recommended in the official Cisco Security Advisory

[Affected Scope] DELMIA Apriso from Release 2020 through Release 2025

[Impact] Unauthenticated remote attackers can bypass authorization checks to gain privileged access to the application

[Mitigation] Apply official security patches immediately, restrict external access, and enforce IP-based access control lists

[Affected Scope] Digiever DS-2105 Pro devices running firmware version 3.1.0.71-11 and prior (including End-of-Life products)

[Impact] Authenticated attackers can execute arbitrary OS commands with root privileges via the vulnerable CGI script

[Mitigation] Immediately isolate affected devices from the public internet and restrict access using firewalls or WAF rules

[Affected Scope] SimpleHelp remote support software v5.5.7 and earlier versions

[Impact] Low-privilege technician accounts can generate API keys with excessive permissions, leading to full server administrator privilege escalation

[Mitigation] Immediately upgrade to SimpleHelp v5.5.8 or later, and audit all existing API keys for unauthorized creation

[Affected Scope] Container environments and host OS running Linux kernel versions prior to v5.17-rc3

[Impact] An attacker inside a container can bypass namespace isolation, escalate privileges to host root, and execute arbitrary code

[Mitigation] Update the Linux kernel to the patched version, and enforce container security profiles (AppArmor, Seccomp, non-root users)

[Affected Scope] Redis server instances installed via package managers (apt) on Debian, Ubuntu, and derived Linux distributions

[Impact] Unauthenticated remote attackers can bypass the Lua scripting sandbox to execute arbitrary system commands with the privileges of the Redis process (CVSS 10.0, CISA KEV Listed)

[Mitigation] Apply official OS package updates immediately, or disable EVAL/EVALSHA commands and restrict network access to localhost

[Affected Scope] Google Chrome prior to version 94.0.4606.71

[Impact] A remote attacker can retrieve potentially sensitive information from process memory via a crafted HTML page

[Mitigation] Immediately update Google Chrome to the latest stable version (94.0.4606.71 or higher)

[Affected Scope] Grafana versions prior to 8.1.6 and 7.5.11

[Impact] Unauthenticated attackers can view or delete the snapshot with the lowest database key via specific API paths, potentially leading to complete snapshot data harvesting and loss.

[Mitigation] Immediately upgrade Grafana to patched versions (8.1.6, 7.5.11, or higher) or block access to the vulnerable API paths using a reverse proxy.

[Affected Scope] All Mac systems running macOS Big Sur versions prior to 11.4

[Impact] A local malicious application can bypass the Transparency, Consent, and Control (TCC) framework to access sensitive user data and hardware (camera, microphone, screen recording) without consent

[Mitigation] Immediately update macOS to Big Sur 11.4 or later to apply the official security patch

[Affected Scope] macOS Big Sur versions prior to 11.3, and macOS Catalina (without Security Update 2021-002)

[Impact] A malicious, unsigned, and unnotarized application can completely bypass Gatekeeper, File Quarantine, and Notarization checks, leading to arbitrary code execution without user warnings

[Mitigation] Immediately upgrade to macOS Big Sur 11.3 or later, or apply Security Update 2021-002 for macOS Catalina

[Affected Scope] NETGEAR JGS516PE devices running firmware versions prior to 2.6.0.43

[Impact] Unauthenticated remote attackers can bypass authentication to access sensitive management functions, potentially leading to arbitrary command execution and full device compromise

[Mitigation] Immediately upgrade the JGS516PE firmware to version 2.6.0.43 or later and restrict access to the management interface