CVE Vulnerability Advisory Database

[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.

[Impact] Unauthenticated attackers can execute arbitrary code with server privileges, leading to full system compromise and sensitive data theft.

[Mitigation] Immediately apply Adobe security patches (APSB26-146) and implement WAF rules to block malicious template patterns.

[Affected Scope] All versions of CrushFTP prior to 10.7.1 and 11.1.0 across all operating system platforms

[Impact] Unauthenticated remote attackers can bypass the VFS Sandbox, read arbitrary files from the filesystem, bypass authentication to gain administrative access, and execute arbitrary code on the server.

[Mitigation] Immediately upgrade CrushFTP to the patched versions (10.7.1 or 11.1.0 or higher) and apply WAF rules to block template injection payloads.

[Affected Scope] Older versions of Atlassian Confluence Data Center and Server (8.0.x, 8.1.x, 8.2.x, 8.3.x, 8.4.x, 8.5.0-8.5.3)

[Impact] Unauthenticated remote attackers can execute arbitrary system commands (RCE) on the affected instance by sending specially crafted HTTP requests.

[Mitigation] Immediately upgrade to the latest patched versions (8.5.4+ or newer LTS releases) provided by Atlassian.

[Affected Scope] Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x

[Impact] Unauthenticated attackers can bypass security restrictions to gain administrative access and chain it with Server-Side Template Injection (SSTI) to execute arbitrary code

[Mitigation] Immediately upgrade to patched versions (9.4.0.1, 9.3.0.2 or later) and restrict external access to the Pentaho management interface

[Affected Scope] Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x

[Impact] Remote attackers can inject malicious Spring templates via specific web services, leading to Server-Side Template Injection (SSTI) and arbitrary code execution.

[Mitigation] Immediately upgrade affected Pentaho instances to patched versions (9.4.0.1, 9.3.0.2 or higher) and restrict external access.

[Affected Scope] Specific versions of VMware Workspace ONE Access and Identity Manager

[Impact] Unauthenticated remote attackers with network access can execute arbitrary system commands on the target server, posing a critical risk (CVSS 9.8)

[Mitigation] Immediately apply the official security patches (VMSA-2022-0011) or implement temporary workarounds to restrict external access

[Affected Scope] All PlaySMS installations running versions prior to 1.4.3

[Impact] Unauthenticated remote attackers can inject malicious template payloads to execute arbitrary operating system commands, leading to full system compromise

[Mitigation] Immediately upgrade to PlaySMS version 1.4.3 or higher, restrict external access, and deploy Web Application Firewall (WAF) rules

[Affected Scope] Jira Server and Data Center versions from 4.4.0 before 7.6.14, 7.7.0 before 7.13.5, 8.0.0 before 8.0.3, 8.1.0 before 8.1.2, and 8.2.0 before 8.2.3

[Impact] Unauthenticated remote attackers can exploit the email template rendering logic to execute arbitrary system commands, leading to full system compromise

[Mitigation] Immediately upgrade Jira Server and Data Center to the patched versions (7.6.14, 7.13.5, 8.0.3, 8.1.2, 8.2.3 or later)

[Affected Scope] Atlassian Confluence Server and Data Center before 6.6.12, 6.7.0 to before 6.12.3, 6.13.0 to before 6.13.3, and 6.14.0 to before 6.14.2

[Impact] Unauthenticated remote attackers can achieve path traversal and execute arbitrary code (RCE) on the host server via Server-Side Template Injection (SSTI)

[Mitigation] Immediately upgrade Confluence to the patched versions (6.6.12, 6.12.3, 6.13.3, 6.14.2 or later) or disable the Widget Connector macro