CVE Vulnerability Advisory Database

[Affected Scope] JetBrains TeamCity versions prior to 2026.1.3 and 2025.11.7

[Impact] Unauthenticated remote attackers can execute arbitrary code on the server via the agent polling protocol, leading to full system compromise

[Mitigation] Immediately upgrade TeamCity server to version 2026.1.3, 2025.11.7, or later

[Affected Scope] Microsoft SharePoint Server deployments

[Impact] Unauthorized remote attackers can execute arbitrary code over the network and fully compromise the system

[Mitigation] Apply the official Microsoft security updates immediately and restrict external network exposure

[Affected Scope] Microsoft SharePoint Server deployments

[Impact] Unauthenticated remote attackers can execute arbitrary code over the network and fully compromise the host server

[Mitigation] Apply the official Microsoft security updates immediately, and restrict network access to SharePoint endpoints until patched

[Affected Scope] All versions of PTC Windchill PDMlink and FlexPLM prior to 11.0 M030, including all CPS releases.

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with elevated privileges by deserializing untrusted data.

[Mitigation] Apply the official vendor security patches (CPS) immediately, restrict external network exposure, and enable WAF deserialization detection rules.

[Affected Scope] Microsoft SharePoint Server deployments

[Impact] An authorized attacker can exploit a deserialization of untrusted data vulnerability over the network to execute arbitrary code with server privileges.

[Mitigation] Immediately apply the official security patches provided by Microsoft and restrict network access to SharePoint servers.

[Affected Scope] SolarWinds Web Help Desk (WHD) versions prior to 2026.1

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with high privileges on the host machine by sending specially crafted serialized data

[Mitigation] Immediately upgrade SolarWinds Web Help Desk to version 2026.1 or higher, and restrict external network access to the service

[Affected Scope] Microsoft SharePoint Server deployments

[Impact] Unauthenticated remote attackers can execute arbitrary code over the network and gain full control of the target server.

[Mitigation] Apply the official Microsoft security patches immediately and restrict external access to SharePoint web interfaces until patched.

[Affected Scope] React versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 utilizing React Server Components (RSC), including react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack packages

[Impact] Unauthenticated remote attackers can execute arbitrary code on the server by sending malicious payloads to Server Function endpoints, leading to complete system compromise

[Mitigation] Immediately upgrade React and all associated react-server-dom packages to the latest patched versions, and apply WAF rules to restrict suspicious RSC requests

[Affected Scope] All Windows Server environments running Windows Server Update Services (WSUS).

[Impact] Unauthenticated remote attackers can execute arbitrary code with SYSTEM privileges over the network by sending malicious serialized payloads.

[Mitigation] Apply the official Microsoft security patches immediately, and restrict network access to WSUS ports (8530, 8531) to trusted internal networks.

[Affected Scope] SolarWinds Web Help Desk (WHD) versions 12.8.3 Hotfix 3 and prior

[Impact] Unauthenticated remote attackers can execute arbitrary commands with system privileges on the host machine by sending specially crafted serialized data

[Mitigation] Immediately upgrade to SolarWinds Web Help Desk 12.8.7 Hotfix 1 or later as recommended by the vendor advisory

[Affected Scope] License Servlet component of Fortra GoAnywhere MFT

[Impact] Unauthenticated attackers with a validly forged license response signature can deserialize arbitrary objects, potentially leading to remote command injection and full system compromise

[Mitigation] Immediately apply the official security patches provided by Fortra and restrict external access to the license servlet interfaces

[Affected Scope] Sitecore Experience Manager (XM) and Experience Platform (XP) versions up to and including 9.0

[Impact] Unauthenticated remote attackers can execute arbitrary code and fully compromise the host system via deserialization of untrusted data

[Mitigation] Immediately apply the official security patches from the vendor, or implement temporary workarounds such as enforcing ViewState encryption and restricting access

[Affected Scope] N-able N-central versions prior to 2025.3.1

[Impact] Local attackers can execute arbitrary code and potentially compromise the entire management server

[Mitigation] Immediately upgrade N-able N-central to version 2025.3.1 or later

[Affected Scope] Dassault Systèmes DELMIA Apriso from Release 2020 through Release 2025.

[Impact] Successful exploitation allows unauthenticated remote attackers to execute arbitrary code with system privileges via specially crafted serialized payloads.

[Mitigation] Immediately apply the official vendor security patches, restrict external network exposure, and perform compromise assessment using IoC logs.

[Affected Scope] Roundcube Webmail versions before 1.5.10 and 1.6.x versions before 1.6.11

[Impact] Authenticated remote attackers can trigger PHP Object Deserialization via the manipulated _from parameter, leading to arbitrary Remote Code Execution (RCE) on the host server

[Mitigation] Immediately upgrade Roundcube Webmail to the patched versions (1.5.10, 1.6.11, or later)

[Affected Scope] Systems utilizing the SAP NetWeaver Visual Composer Metadata Uploader module

[Impact] A privileged attacker can upload untrusted or malicious content, triggering deserialization of untrusted data (CWE-502) and potentially compromising the confidentiality, integrity, and availability of the host system

[Mitigation] Immediately apply the official security patch (SAP Note 3604119) and restrict access to unauthorized metadata upload endpoints

[Affected Scope] ConnectWise ScreenConnect versions 25.2.3 and earlier

[Impact] If machine keys are compromised by an attacker with privileged system-level access, they can inject a malicious ViewState to execute arbitrary code on the server

[Mitigation] Immediately upgrade to ScreenConnect 2025.4, which completely disables ViewState and removes its dependency

[Affected Scope] Gladinet CentreStack versions through 16.1.10296.56315

[Impact] Unauthenticated remote code execution (RCE) via deserialization of malicious payloads using the hardcoded machineKey, actively exploited in the wild

[Mitigation] Immediately upgrade to version 16.4.10315.56368 or later, or manually delete/rotate the hardcoded machineKey in the portal web.config file

[Affected Scope] Wazuh server and cluster environments running versions 4.4.0 through 4.9.0

[Impact] Attackers with API access or compromised agents can execute arbitrary Python code on the Wazuh server by manipulating Distributed API (DAPI) parameters, leading to full system compromise

[Mitigation] Immediately upgrade Wazuh manager and cluster nodes to the patched version (v4.9.1 or higher) and restrict API access

[Affected Scope] Trimble Cityworks versions prior to 15.8.9 and Cityworks with Office Companion versions prior to 23.10

[Impact] Authenticated attackers can exploit a deserialization vulnerability (CWE-502) to execute arbitrary code with system privileges on the Microsoft IIS web server

[Mitigation] Immediately upgrade to patched versions (Cityworks 15.8.9+ or Office Companion 23.10+) and restrict IIS access controls