CVE Vulnerability Advisory Database

[Affected Scope] WordPress Core versions 4.7 through 7.1.3

[Impact] Unauthenticated attackers can execute arbitrary code on the server by exploiting predictable staging paths during the core upgrade process

[Mitigation] Immediately upgrade to WordPress 7.1.4 or later and restrict web access to the upgrade staging directories

[Affected Scope] All web servers, browsers, Node.js environments, and backend applications using Google Brotli library versions 1.0.3 through 1.2.0

[Impact] Remote unauthenticated attackers can corrupt decoder state memory via crafted compressed streams, leading to sensitive data disclosure, DoS, or Remote Code Execution (RCE)

[Mitigation] Immediately update Brotli libraries and dependent packages to the latest secure versions (1.0.10, 1.1.1, 1.2.1 or higher)

[Affected Scope] PHP 8.1, 8.2, and 8.3 environments without the latest security patches.

[Impact] Remote attackers can achieve arbitrary code execution (RCE) by exploiting memory corruption in the PHP global state.

[Mitigation] Immediately update PHP to the latest security release and restart PHP-FPM/Web server processes.

[Affected Scope] All web applications and server environments running on the PHP engine.

[Impact] Unauthenticated remote attackers can trigger Out-of-Memory (OOM) conditions to execute arbitrary code (RCE) with system privileges.

[Mitigation] Immediately apply official PHP security patches and restrict abnormal memory allocation via php.ini configurations.

[Affected Scope] Management interfaces of PA-Series, VM-Series firewalls, and Panorama (Virtual and M-Series) running PAN-OS

[Impact] An authenticated attacker with network access can execute arbitrary code with root privileges, leading to full system compromise

[Mitigation] Apply the latest security patches immediately and restrict management interface access to trusted internal IP addresses only

[Affected Scope] All versions of Cisco Secure Email Gateway with Advanced Malware Protection (AMP) and File Reputation service enabled.

[Impact] An unauthenticated remote attacker can overwrite system files and execute arbitrary commands with root privileges by sending a crafted email attachment.

[Mitigation] Immediately apply the official AsyncOS security patches provided by Cisco. If patching is not possible, disable the AMP File Reputation feature as a temporary workaround.

[Affected Scope] Collabora Online Built-in CODE Server (richdocumentscode) for Nextcloud before version 26.4.303.

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands, leading to full system compromise.

[Mitigation] Update the richdocumentscode app to version 26.4.303 or later immediately.

[Affected Scope] All supported versions of Windows OS including Windows 10, 11, and Windows Server.

[Impact] Unauthorized attackers can bypass security features and execute arbitrary commands, leading to full system compromise.

[Mitigation] Apply the latest Microsoft security updates immediately and restrict execution of untrusted URI handlers.

[Affected Scope] Ivanti Connect Secure (ICS) versions prior to 25.1.3.0 (excluding 22.7R2.14 and earlier)

[Impact] Remote unauthenticated attackers can bypass authentication via identity spoofing and execute arbitrary commands with system privileges

[Mitigation] Immediately upgrade to version 25.1.3.0 or later and perform a comprehensive compromise assessment using official IoCs

[Affected Scope] GitLab CE/EE versions 19.2 (< 19.2.8), 19.3 (< 19.3.5), and 19.4 (< 19.4.2)

[Impact] Unauthenticated attackers can execute arbitrary code on the GitLab server via crafted CI/CD configurations, leading to full system compromise

[Mitigation] Immediate upgrade to patched versions 19.2.8, 19.3.5, or 19.4.2 is mandatory

[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands by manipulating API arguments, leading to full system compromise

[Mitigation] Immediately upgrade to version 9.15.2.70 or 10.3.4.45 or later

[Affected Scope] FortiMail versions 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, 7.2.0-7.2.9, and all 7.0 versions.

[Impact] Unauthenticated remote attackers can write arbitrary files via crafted HTTP/HTTPS requests, leading to full system compromise and Remote Code Execution (RCE).

[Mitigation] Immediately upgrade to patched firmware versions (8.0.2, 7.6.7, etc.) and restrict access to administrative interfaces.

[Affected Scope] Zammad versions 6.3.0 to 6.5.4 (7.0.0 to 7.1.2 are vulnerable but currently non-exploitable)

[Impact] Unauthenticated attackers can hijack user sessions and execute arbitrary code with 'zammad' user privileges.

[Mitigation] Immediately update to the latest patched versions (6.5.5+ or 7.1.3+).

[Affected Scope] All Apple devices running versions prior to iOS 18.7.11/26.7.1 and macOS Sequoia 15.8.1/Tahoe 26.7.1.

[Impact] Processing a maliciously crafted file can lead to arbitrary code execution with system privileges, resulting in full device compromise.

[Mitigation] Immediately apply the latest security patches provided by Apple (e.g., iOS 18.7.11, macOS 15.8.1) and restart the device.

[Affected Scope] Citrix NetScaler ADC and Gateway versions prior to 14.1-73.37 and 13.1-64.23, including FIPS/NDcPP editions.

[Impact] Unauthenticated remote attackers can exploit memory buffer vulnerabilities (CWE-119) to achieve Remote Code Execution (RCE) or trigger a Denial of Service (DoS).

[Mitigation] This vulnerability is listed in CISA KEV and is actively exploited; immediately update to the latest patched firmware versions.

[Affected Scope] Citrix NetScaler ADC and Gateway versions prior to 14.1-73.37 and 13.1-64.23, including FIPS/NDcPP variants.

[Impact] Unauthenticated remote attackers can execute arbitrary commands with system privileges, leading to full appliance compromise and potential lateral movement.

[Mitigation] Immediately apply the vendor-supplied security patches and restrict access to management interfaces (NSIP).

[Affected Scope] Plex Media Server versions prior to 1.43.3.10861.

[Impact] An authenticated admin can exploit the TranscoderH264Options preference to write arbitrary files, leading to full system compromise via malicious library (.so) execution.

[Mitigation] Immediately update to version 1.43.3.10861 or later and enforce Multi-Factor Authentication (MFA) for all admin accounts.

[Affected Scope] All WordPress installations running vulnerable core versions and specific themes.

[Impact] Unauthenticated attackers can include and execute arbitrary local PHP files, leading to full server compromise.

[Mitigation] Immediate update to the latest WordPress security release and deployment of WAF filtering rules.

[Affected Scope] F5 BIG-IP APM virtual servers configured with an OAuth Authorization Server profile.

[Impact] Unauthenticated attackers can execute arbitrary code with system privileges via specially crafted traffic, leading to full system compromise.

[Mitigation] Immediately apply the latest security patches or Hotfixes provided by F5, and consider disabling the OAuth Authorization Server profile until patched.

[Affected Scope] Check Point Management Server (R80.x, R81.x series)

[Impact] Unauthenticated attackers can upload and execute arbitrary scripts via directory traversal, leading to full system compromise.

[Mitigation] Apply the vendor-provided emergency hotfix and restrict management interface access from the public internet.