CVE Vulnerability Advisory Database

[Affected Scope] Ubiquiti UniFi OS devices accessible via the network

[Impact] Unauthenticated remote attackers can make unauthorized system changes, gain administrative control, and potentially enlist devices into botnets

[Mitigation] Apply the official vendor security patches immediately, restrict access to management interfaces, and monitor for unauthorized configuration changes

[Affected Scope] LiteSpeed User-End cPanel Plugin versions prior to 2.4.5

[Impact] Unauthenticated remote attackers can escalate privileges (potentially to root) by exploiting improper handling of Redis features, with active exploitation observed in the wild.

[Mitigation] Immediately upgrade the plugin to the recommended minimum version of 2.4.7 or higher and perform IoC scanning using the provided command.

[Affected Scope] Drupal core versions 8.9.0 to < 10.4.10, 10.5.0 to < 10.5.10, 10.6.0 to < 10.6.9, 11.0.0 to < 11.1.10, 11.2.0 to < 11.2.12, and 11.3.0 to < 11.3.10

[Impact] Unauthenticated remote attackers can inject malicious SQL queries to extract sensitive database information, hijack administrator sessions, or potentially achieve Remote Code Execution (RCE).

[Mitigation] Immediately upgrade Drupal core to the respective patched versions (10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, 11.3.10, or later).

[Affected Scope] DAEMON Tools Lite Windows versions 12.5.0.2421 through 12.5.0.2434 distributed between April 8, 2026, and May 5, 2026

[Impact] Attackers compromised the vendor's infrastructure to distribute trojanized binaries signed with a legitimate certificate, bypassing security controls to establish backdoor access

[Mitigation] Immediately uninstall the compromised versions, perform a full system malware scan, and reinstall the clean, patched version from the official vendor

[Affected Scope] Cisco Catalyst SD-WAN Controller (formerly vSmart), Manager (formerly vManage), and Validator (formerly vBond)

[Impact] Unauthenticated remote attackers can bypass authentication to obtain administrative privileges and manipulate the SD-WAN fabric configuration via NETCONF

[Mitigation] Apply official security patches immediately, and perform system checks on control connections as a temporary measure

[Affected Scope] Palo Alto Networks PAN-OS software with GlobalProtect portal or gateway enabled (Panorama and Cloud NGFW are not impacted).

[Impact] Unauthenticated attackers can bypass security restrictions to establish unauthorized VPN connections and gain access to internal network resources.

[Mitigation] Apply the official security patches immediately, and restrict access to GlobalProtect interfaces until fully patched.

[Affected Scope] 84 malicious versions across 42 @tanstack/* packages published between 19:20 and 19:26 UTC on 2026-05-11

[Impact] Attackers successfully published credential-stealing malware under trusted identities by hijacking legitimate OIDC tokens

[Mitigation] Immediately audit dependency trees, purge affected package versions, and rotate all potentially exposed credentials

[Affected Scope] LiteLLM proxy server environments running versions from 1.81.16 to before 1.83.7

[Impact] Unauthenticated attackers can read or modify the proxy's database, leading to unauthorized access to the proxy and managed API credentials

[Mitigation] Immediately upgrade LiteLLM to version 1.83.7 or later, and apply WAF rules to block malicious Authorization headers in the interim

[Affected Scope] Palo Alto Networks PAN-OS software running on PA-Series and VM-Series firewalls with the User-ID™ Authentication Portal (Captive Portal) service enabled.

[Impact] An unauthenticated remote attacker can execute arbitrary code with root privileges on the firewall by sending specially crafted packets.

[Mitigation] Apply the latest security patches immediately, and restrict access to the User-ID™ Authentication Portal to trusted internal IP addresses only.

[Affected Scope] cPanel and WHM versions after 11.40 (prior to the April 28, 2026 security update)

[Impact] Unauthenticated remote attackers can bypass the login flow to gain unauthorized administrative access to the control panel, leading to complete server compromise

[Mitigation] Immediately apply the latest security patches provided by the vendor, and restrict external access to management ports (2082, 2083, 2086, 2087) until patched

[Affected Scope] Internet Key Exchange (IKE) Extension service running on Microsoft Windows and Windows Server operating systems

[Impact] An unauthenticated remote attacker can execute arbitrary code with system/kernel privileges over the network by sending specially crafted IKE packets

[Mitigation] Apply the official Microsoft security updates immediately, and restrict external access to IKE/IPsec ports (UDP 500/4500) as a temporary workaround

[Affected Scope] Fortinet FortiSandbox versions 4.4.0 through 4.4.8

[Impact] Unauthenticated remote attackers can execute unauthorized OS commands or code with elevated privileges, potentially leading to full system compromise

[Mitigation] Immediately upgrade to FortiSandbox version 4.4.9 or higher, and restrict access to management interfaces

[Affected Scope] All versions of marimo open-source Python notebook prior to 0.23.0

[Impact] Unauthenticated remote attackers can establish a connection to the /terminal/ws endpoint, obtaining a full PTY shell and executing arbitrary system commands

[Mitigation] Immediately upgrade the marimo package to version 0.23.0 or higher

[Affected Scope] Fortinet FortiClientEMS versions 7.4.5 through 7.4.6

[Impact] An unauthenticated remote attacker can execute unauthorized code or commands with system privileges via crafted network requests.

[Mitigation] Apply the official Fortinet security patch (version 7.4.7 or higher) immediately and restrict external network access to the EMS server.

[Affected Scope] Citrix NetScaler ADC and NetScaler Gateway appliances configured to act as a SAML Identity Provider (IDP)

[Impact] Unauthenticated remote attackers can trigger an out-of-bounds memory read, potentially exposing highly sensitive session tokens, credentials, or SSL private keys, and facilitating remote code execution

[Mitigation] Immediately apply the official security updates provided by Citrix, or temporarily disable the SAML IDP configuration if patching cannot be performed immediately

[Affected Scope] Langflow versions prior to 1.9.0

[Impact] Unauthenticated remote attackers can execute arbitrary Python code and gain full control over the host system

[Mitigation] Immediately upgrade Langflow to version 1.9.0 or higher, and restrict external access to the vulnerable endpoint

[Affected Scope] Lantronix EDS5000 device servers running firmware version 2.1.0.0R3

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with root privileges by sending crafted HTTP RPC requests

[Mitigation] Apply the official firmware patch immediately, and restrict external access to the HTTP/HTTPS management interfaces

[Affected Scope] Web-based management interface of Cisco Secure Firewall Management Center (FMC) Software.

[Impact] Unauthenticated, remote attackers can execute arbitrary Java code with root privileges by sending crafted serialized Java objects.

[Mitigation] Apply official Cisco security patches immediately and restrict public internet access to the FMC management interface.

[Affected Scope] Web-based management interface of Cisco Secure Firewall Management Center (FMC) Software

[Impact] Unauthenticated remote attackers can bypass authentication and execute scripts to obtain full root access to the underlying operating system

[Mitigation] Immediate application of official security patches and restriction of management interface access via ACLs

[Affected Scope] Cisco Catalyst SD-WAN Controller (formerly vSmart), Cisco Catalyst SD-WAN Manager (formerly vManage), and Cisco Catalyst SD-WAN Validator (formerly vBond).

[Impact] Unauthenticated remote attackers can bypass peering authentication, gain high-privileged administrative access, and manipulate the entire SD-WAN fabric configuration via NETCONF.

[Mitigation] Apply official Cisco software patches immediately and restrict control plane access to trusted peer IPs using Access Control Lists (ACLs).