CVE Vulnerability Advisory Database

[Affected Scope] SolarWinds Web Help Desk (WHD) versions prior to 2026.1

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with high privileges on the host machine by sending specially crafted serialized data

[Mitigation] Immediately upgrade SolarWinds Web Help Desk to version 2026.1 or higher, and restrict external network access to the service

[Affected Scope] SmarterTools SmarterMail software versions prior to Build 9511

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands on the target system via a malicious HTTP server, leading to complete system compromise

[Mitigation] Immediately upgrade SmarterMail to the latest stable version (Build 9511 or higher) and restrict access to administrative endpoints

[Affected Scope] docling-core versions from v2.21.0 prior to v2.48.4, specifically when paired with pyyaml versions prior to v5.4

[Impact] Remote attackers can execute arbitrary Python code on the target server by supplying malicious YAML data to the load_from_yaml() method

[Mitigation] Upgrade docling-core to version v2.48.4 or later, or ensure the installed PyYAML version is v5.4 or greater

[Affected Scope] Sangfor Operation and Maintenance Management System up to version 3.0.12

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with elevated privileges by sending specially crafted requests

[Mitigation] Restrict external access to the vulnerable endpoint, apply firewall/WAF rules, and monitor for official vendor patches

[Affected Scope] Self-managed Grist deployments running versions prior to 1.7.9 with the GRIST_SANDBOX_FLAVOR environment variable configured to pyodide

[Impact] A remote attacker can execute arbitrary system processes on the hosting server by tricking a user into opening a maliciously crafted spreadsheet

[Mitigation] Upgrade Grist to version 1.7.9 or higher, or immediately change the sandbox flavor configuration to gvisor to enforce kernel-level isolation

[Affected Scope] Oracle HTTP Server and WebLogic Server Proxy Plug-in (for Apache HTTP Server and IIS) versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 within Oracle Fusion Middleware.

[Impact] Unauthenticated remote attackers can exploit this vulnerability via HTTP to compromise the server, leading to unauthorized data modification, deletion, or complete system takeover with potential scope expansion to backend systems (CVSS 10.0).

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) immediately, restrict network access, and deploy WAF rules to filter malicious HTTP headers.

[Affected Scope] All client environments running FreeRDP versions prior to 3.21.0

[Impact] A malicious RDP server can trigger a client-side heap buffer overflow, leading to Denial of Service (DoS) or potential Remote Code Execution (RCE)

[Mitigation] Immediately upgrade FreeRDP to the patched version 3.21.0 or higher

[Affected Scope] All systems and CI/CD pipelines running GuardDog versions prior to 2.7.1

[Impact] Malicious PyPI packages can exploit path traversal to write arbitrary files outside the extraction directory, leading to Arbitrary File Overwrite and Remote Code Execution (RCE)

[Mitigation] Immediately upgrade GuardDog to version 2.7.1 or higher

[Affected Scope] Microsoft SharePoint Server deployments

[Impact] Unauthenticated remote attackers can execute arbitrary code over the network and gain full control of the target server.

[Mitigation] Apply the official Microsoft security patches immediately and restrict external access to SharePoint web interfaces until patched.

[Affected Scope] FortiOS versions 6.4 through 7.6 and FortiSwitchManager versions 7.0 through 7.2.

[Impact] Unauthenticated remote attackers can execute arbitrary code or commands with system privileges by sending crafted packets, leading to full system compromise.

[Mitigation] Immediately apply the latest firmware updates provided by Fortinet and restrict exposure of management interfaces and VPN services to the public internet.

[Affected Scope] WatchGuard Firebox appliances running Fireware OS configured with IKEv2 mobile user VPN or branch office VPN using a dynamic gateway peer, or where these configurations were previously deleted but a static gateway peer VPN remains.

[Impact] A critical vulnerability (CVSS 9.8) allowing unauthenticated remote attackers to trigger an out-of-bounds write (CWE-787) in the iked process via crafted IKEv2 packets, leading to arbitrary code execution (RCE) with root privileges.

[Mitigation] Since this vulnerability is actively exploited and listed in the CISA KEV catalog, immediately upgrade to the patched Fireware OS version and restrict or disable IKEv2 services where possible.

[Affected Scope] Cisco Secure Email Gateway and Cisco Secure Email and Web Manager running Cisco AsyncOS Software with the Spam Quarantine feature enabled

[Impact] Unauthenticated, remote attackers can execute arbitrary system commands with root privileges on the underlying operating system

[Mitigation] Apply official Cisco security patches immediately, or restrict/disable external access to the Spam Quarantine feature as a temporary workaround

[Affected Scope] HPE OneView management platform and associated appliance software

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges, leading to full infrastructure compromise

[Mitigation] Apply official HPE security patches immediately and restrict access to the management interface from untrusted networks

[Affected Scope] Gladinet CentreStack and Triofox solutions prior to version 16.12.10420.56791

[Impact] Unauthenticated remote attackers can exploit hardcoded AES keys to read arbitrary local files and potentially achieve full system compromise

[Mitigation] Immediately upgrade to version 16.12.10420.56791 or later and restrict access to publicly exposed endpoints

[Affected Scope] Nextcloud deployments utilizing the Collabora Online - Built-in CODE Server (richdocumentscode) app prior to version 25.04.702

[Impact] Unauthenticated attackers can exploit a configuration-dependent OS Command Injection vulnerability via proxy.php and an intermediate reverse proxy to achieve Remote Code Execution (RCE)

[Mitigation] Immediately upgrade the richdocumentscode application to version 25.04.702 or later, and restrict external access to the proxy endpoint in the interim

[Affected Scope] React versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 utilizing React Server Components (RSC), including react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack packages

[Impact] Unauthenticated remote attackers can execute arbitrary code on the server by sending malicious payloads to Server Function endpoints, leading to complete system compromise

[Mitigation] Immediately upgrade React and all associated react-server-dom packages to the latest patched versions, and apply WAF rules to restrict suspicious RSC requests

[Affected Scope] Fortinet FortiWeb versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.4, 7.4.0 through 7.4.9, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.11

[Impact] Unauthenticated remote attackers can execute arbitrary administrative commands on the system via crafted HTTP or HTTPS requests

[Mitigation] Immediately upgrade to the official patched versions (8.0.2, 7.6.5, 7.4.10, 7.2.12, 7.0.12 or higher)

[Affected Scope] Metro Development Server started by React Native Community CLI (binding to external interfaces by default)

[Impact] Unauthenticated network attackers can send a POST request to execute arbitrary executables, and run arbitrary shell commands with controlled arguments on Windows

[Mitigation] Upgrade React Native CLI to the patched version, restrict Metro server binding to localhost (127.0.0.1), and block external access via firewalls

[Affected Scope] Lanscope Endpoint Manager (On-Premises) Client program (MR) and Detection agent (DA)

[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by sending specially crafted packets to the agent

[Mitigation] Immediately apply the official security patches provided by Motex and restrict network access to the agent communication ports

[Affected Scope] Virtual servers configured with a BIG-IP APM (Access Policy Manager) access policy

[Impact] Unauthenticated remote attackers can execute arbitrary code (RCE) with high privileges by sending specially crafted malicious network traffic

[Mitigation] Immediately apply the latest security patches provided by F5, and restrict access to APM virtual servers until patched