CVE Vulnerability Advisory Database

[Affected Scope] All versions of Adobe Commerce and Magento Open Source (2.4.7 and earlier)

[Impact] Unauthenticated remote attackers can escalate privileges to gain administrative access and compromise sensitive data

[Mitigation] Apply Adobe security patch APSB26-92 immediately and implement IP whitelisting for the admin panel

[Affected Scope] Adobe Experience Manager (AEM) versions 6.5.23 and earlier (specifically with Forms module and Struts DevMode enabled)

[Impact] Unauthenticated remote attackers can bypass security controls and execute arbitrary system commands or code with system privileges

[Mitigation] Apply the official Adobe APSB25-82 security patch immediately and disable Struts DevMode in production environments

[Affected Scope] Apache OFBiz versions up to and including 18.12.14

[Impact] Unauthenticated remote attackers can execute arbitrary screen rendering code and system commands by sending specially crafted HTTP requests

[Mitigation] Immediately upgrade Apache OFBiz to the latest stable version 18.12.15 or higher

[Affected Scope] All self-hosted versions of Confluence Data Center and Server. (Atlassian Cloud sites are not affected)

[Impact] Unauthenticated remote attackers can reset Confluence setup states and create unauthorized administrator accounts, leading to a complete compromise of confidentiality, integrity, and availability.

[Mitigation] Immediately upgrade to the latest patched versions or restrict external access to the setup endpoints (/setup/*) via reverse proxy or WAF configurations.

[Affected Scope] Remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software.

[Impact] Improper AAA separation allows unauthenticated remote attackers to conduct brute-force attacks to identify valid credentials or establish unauthorized clientless SSL VPN sessions.

[Mitigation] Apply official software updates from Cisco, or implement workarounds by redirecting default connection profile authentication to a loopback address and enforcing MFA.

[Affected Scope] Ivanti MobileIron Sentry versions 9.18.0 and below with MICS (Mobile IT Connector System) Admin Portal enabled

[Impact] Unauthenticated attackers can bypass authentication controls on the administrative interface, leading to remote code execution (RCE) and full system compromise

[Mitigation] Immediately apply the official vendor patches and restrict external access to the MICS administrative port (default TCP 8443)

[Affected Scope] Cacti versions 1.2.x up to 1.2.22, and 1.3.x development branches

[Impact] Unauthenticated remote attackers can bypass authentication via HTTP header manipulation and execute arbitrary OS commands with the privileges of the web server

[Mitigation] Immediately upgrade Cacti to version 1.2.23 or later, and restrict access to the monitoring interface

[Affected Scope] QNAP Photo Station versions running on QTS operating system environments

[Impact] Unauthenticated remote attackers can bypass access control mechanisms to gain unauthorized system access, potentially leading to Remote Code Execution (RCE)

[Mitigation] Immediately update QNAP Photo Station and QTS to the latest official security-patched versions