CVE Vulnerability Advisory Database

[Affected Scope] GitLab CE/EE versions 19.2 (< 19.2.8), 19.3 (< 19.3.5), and 19.4 (< 19.4.2)

[Impact] Unauthenticated attackers can execute arbitrary code on the GitLab server via crafted CI/CD configurations, leading to full system compromise

[Mitigation] Immediate upgrade to patched versions 19.2.8, 19.3.5, or 19.4.2 is mandatory

[Affected Scope] Wide range of Atlassian Data Center products including Bitbucket, Confluence, Jira, Bamboo, and Crowd.

[Impact] Unauthenticated remote attackers can access sensitive files within the web application root directory, leading to information disclosure.

[Mitigation] Immediately upgrade to the fixed versions provided by Atlassian and restrict access to sensitive web root files.

[Affected Scope] Citrix NetScaler ADC and Gateway versions prior to 14.1-73.37 and 13.1-64.23, including FIPS/NDcPP variants.

[Impact] Unauthenticated remote attackers can execute arbitrary commands with system privileges, leading to full appliance compromise and potential lateral movement.

[Mitigation] Immediately apply the vendor-supplied security patches and restrict access to management interfaces (NSIP).

[Affected Scope] GitLab CE/EE versions from 18.7 through 19.3.1.

[Impact] Unauthenticated remote attackers can read arbitrary files from the server, potentially leading to full system compromise and credential theft.

[Mitigation] Immediate upgrade to patched versions: 18.11.12, 19.0.9, 19.1.8, 19.2.6, or 19.3.2.

[Affected Scope] Web management interface of PaperCut MF and PaperCut NG.

[Impact] Unauthenticated remote attackers can trigger backend actions and modify system configurations before access validation checks complete, potentially leading to Remote Code Execution (RCE).

[Mitigation] Apply the official vendor security patches immediately and restrict external access to the web management ports (default 9191, 9192).

[Affected Scope] MLflow versions from 3.3.0 prior to 3.15.0

[Impact] Unauthenticated attackers can bypass URL validation to access internal network resources or cloud metadata services, potentially retrieving sensitive credentials and response data.

[Mitigation] Immediately upgrade MLflow to version 3.15.0 or later, and restrict access to the webhook test endpoint in the interim.

[Affected Scope] SonicWall SMA1000 Series Appliance Work Place interface

[Impact] Remote unauthenticated attackers can force the appliance to make requests to unintended internal or external locations, potentially leading to internal network compromise or RCE

[Mitigation] Apply the official firmware updates immediately and restrict external access to the management interface

[Affected Scope] Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62

[Impact] Unauthenticated remote attackers can compromise and completely take over the PeopleSoft Enterprise PeopleTools system via HTTP network access

[Mitigation] Immediately apply the official Oracle Critical Patch Update (CPU) and restrict external HTTP access to the affected component

[Affected Scope] Splunk Enterprise versions 10.2.x below 10.2.4 and 10.0.x below 10.0.7 (versions 9.4 and earlier are unaffected)

[Impact] An unauthenticated remote attacker can access the PostgreSQL sidecar service endpoint to create or truncate arbitrary files, potentially leading to Remote Code Execution (RCE)

[Mitigation] Immediately upgrade to patched versions (10.2.4+, 10.0.7+) or disable the PostgreSQL sidecar service if an immediate upgrade is not feasible

[Affected Scope] Fortinet FortiSandbox (5.0.0 to 5.0.5, 4.4.0 to 4.4.8, 4.2 all versions), FortiSandbox Cloud and PaaS (5.0.4 to 5.0.5)

[Impact] An unauthenticated remote attacker can execute unauthorized OS commands with root privileges via specially crafted HTTP requests

[Mitigation] Immediately upgrade to the patched versions (5.0.6, 4.4.9 or higher) and restrict external access to the management interface

[Affected Scope] SolarWinds Serv-U file transfer server versions prior to 15.5.4 Hotfix 1

[Impact] Unauthenticated remote attackers can crash the Serv-U service instantly by sending specially crafted HTTP POST requests utilizing 'Content-Encoding: deflate'

[Mitigation] Immediately apply the official security patch (15.5.4 Hotfix 1 or later) or implement WAF rules to block specific compression headers

[Affected Scope] All Windows and Windows Server systems utilizing the Microsoft Defender Antimalware Engine.

[Impact] Unauthenticated remote attackers can crash the real-time protection engine, disabling endpoint security defenses and leaving the system exposed to subsequent attacks.

[Mitigation] Immediately update the Microsoft Defender engine to the latest version (1.1.24000.0 or higher) and verify automatic update configurations.

[Affected Scope] Langflow versions prior to 1.9.0

[Impact] Unauthenticated remote attackers can execute arbitrary Python code and gain full control over the host system

[Mitigation] Immediately upgrade Langflow to version 1.9.0 or higher, and restrict external access to the vulnerable endpoint

[Affected Scope] SmarterTools SmarterMail software versions prior to Build 9511

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands on the target system via a malicious HTTP server, leading to complete system compromise

[Mitigation] Immediately upgrade SmarterMail to the latest stable version (Build 9511 or higher) and restrict access to administrative endpoints

[Affected Scope] Active deployments of Langflow utilizing the validate API endpoint.

[Impact] Unauthenticated remote attackers can execute arbitrary code with root privileges by exploiting untrusted resource inclusion.

[Mitigation] Immediately upgrade Langflow to the latest patched version and restrict external access to the validation endpoint.

[Affected Scope] All versions of Gladinet CentreStack and Triofox prior to and including 16.7.10368.56560

[Impact] Unauthenticated remote attackers can exploit this flaw to read sensitive system and configuration files, leading to critical information disclosure

[Mitigation] Immediately upgrade to the patched version (16.7.10368.56561 or higher) and restrict external access to the management console

[Affected Scope] Laravel Livewire versions v3.0.0 up to and including v3.6.3

[Impact] Unauthenticated remote attackers can exploit the component hydration process to execute arbitrary system commands on the host server

[Mitigation] Immediately upgrade the Livewire package to the patched version v3.6.4 or later

[Affected Scope] Specific API endpoints of Cisco Identity Services Engine (ISE) and Cisco ISE-PIC

[Impact] An unauthenticated, remote attacker can execute arbitrary code with root privileges on the underlying operating system

[Mitigation] Immediately apply the official security patches provided by Cisco and restrict access to the API ports from untrusted networks

[Affected Scope] Specific API endpoints of Cisco Identity Services Engine (ISE) and Cisco ISE-PIC

[Impact] An unauthenticated, remote attacker can execute arbitrary code with root privileges on the underlying operating system by sending a crafted API request

[Mitigation] Immediately apply the official security patches provided by Cisco and restrict access to the management API ports

[Affected Scope] Web management interface of Smartbedded Meteobridge weather station devices

[Impact] Adjacent unauthenticated attackers can execute arbitrary system commands with root privileges, leading to full device compromise

[Mitigation] Apply the latest firmware patches immediately and restrict network access to the web administration interface