CVE Vulnerability Advisory Database

[Affected Scope] All websites and e-commerce stores running Vvveb CMS versions prior to 1.0.8.7

[Impact] Remote attackers can bypass authentication to reset any user's password, leading to full account takeover including administrative privileges.

[Mitigation] Immediately upgrade Vvveb CMS to version 1.0.8.7 or later.

[Affected Scope] All web applications and server environments running on the PHP engine.

[Impact] Unauthenticated remote attackers can trigger Out-of-Memory (OOM) conditions to execute arbitrary code (RCE) with system privileges.

[Mitigation] Immediately apply official PHP security patches and restrict abnormal memory allocation via php.ini configurations.

[Affected Scope] Internal messaging components of BeyondTrust Remote Support appliances.

[Impact] Unauthenticated remote attackers can bypass authentication via origin spoofing to perform arbitrary file operations, leading to full system compromise.

[Mitigation] Immediately apply the vendor-provided security patch (KB0024066) and restrict access to the management interface.

[Affected Scope] Collabora Online Built-in CODE Server (richdocumentscode) for Nextcloud before version 26.4.303.

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands, leading to full system compromise.

[Mitigation] Update the richdocumentscode app to version 26.4.303 or later immediately.

[Affected Scope] GitLab CE/EE versions 19.2 (< 19.2.8), 19.3 (< 19.3.5), and 19.4 (< 19.4.2)

[Impact] Unauthenticated attackers can execute arbitrary code on the GitLab server via crafted CI/CD configurations, leading to full system compromise

[Mitigation] Immediate upgrade to patched versions 19.2.8, 19.3.5, or 19.4.2 is mandatory

[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands by manipulating API arguments, leading to full system compromise

[Mitigation] Immediately upgrade to version 9.15.2.70 or 10.3.4.45 or later

[Affected Scope] FortiMail versions 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, 7.2.0-7.2.9, and all 7.0 versions.

[Impact] Unauthenticated remote attackers can write arbitrary files via crafted HTTP/HTTPS requests, leading to full system compromise and Remote Code Execution (RCE).

[Mitigation] Immediately upgrade to patched firmware versions (8.0.2, 7.6.7, etc.) and restrict access to administrative interfaces.

[Affected Scope] Zammad versions 6.3.0 to 6.5.4 (7.0.0 to 7.1.2 are vulnerable but currently non-exploitable)

[Impact] Unauthenticated attackers can hijack user sessions and execute arbitrary code with 'zammad' user privileges.

[Mitigation] Immediately update to the latest patched versions (6.5.5+ or 7.1.3+).

[Affected Scope] Citrix NetScaler ADC and Gateway versions prior to 14.1-73.37 and 13.1-64.23, including FIPS/NDcPP variants.

[Impact] Unauthenticated remote attackers can execute arbitrary commands with system privileges, leading to full appliance compromise and potential lateral movement.

[Mitigation] Immediately apply the vendor-supplied security patches and restrict access to management interfaces (NSIP).

[Affected Scope] F5 BIG-IP APM virtual servers configured with an OAuth Authorization Server profile.

[Impact] Unauthenticated attackers can execute arbitrary code with system privileges via specially crafted traffic, leading to full system compromise.

[Mitigation] Immediately apply the latest security patches or Hotfixes provided by F5, and consider disabling the OAuth Authorization Server profile until patched.

[Affected Scope] Check Point Management Server (R80.x, R81.x series)

[Impact] Unauthenticated attackers can upload and execute arbitrary scripts via directory traversal, leading to full system compromise.

[Mitigation] Apply the vendor-provided emergency hotfix and restrict management interface access from the public internet.

[Affected Scope] Arista VeloCloud Orchestrator (VCO) On-premise deployments.

[Impact] Unauthenticated remote attackers can access privileged internal functions, leading to full compromise of the orchestrator and managed SD-WAN infrastructure.

[Mitigation] Immediately apply the latest security patches from Arista and restrict access to management interfaces via VPN/ACLs.

[Affected Scope] Cisco Identity Services Engine (ISE) web-based management interface and API endpoints.

[Impact] Unauthenticated remote attackers can gain full administrative access to the device by bypassing authentication controls.

[Mitigation] Apply the latest security patches from Cisco immediately and restrict access to management interfaces via ACLs.

[Affected Scope] All Cisco Secure Email Gateway appliances running vulnerable versions of Cisco AsyncOS Software.

[Impact] An unauthenticated remote attacker can execute arbitrary commands with root privileges by sending a crafted email, leading to full system compromise.

[Mitigation] Immediately apply the official security patches provided by Cisco and monitor for signs of exploitation.

[Affected Scope] GitLab CE/EE versions from 18.7 through 19.3.1.

[Impact] Unauthenticated remote attackers can read arbitrary files from the server, potentially leading to full system compromise and credential theft.

[Mitigation] Immediate upgrade to patched versions: 18.11.12, 19.0.9, 19.1.8, 19.2.6, or 19.3.2.

[Affected Scope] All Check Point Quantum Security Gateway versions with VPN Blade enabled.

[Impact] Unauthenticated remote attackers can execute arbitrary code with root privileges, leading to full gateway compromise.

[Mitigation] Immediately apply the latest Jumbo Hotfix and enforce strict certificate validation policies.

[Affected Scope] ConnectWise ScreenConnect client software (Servers are not impacted)

[Impact] Attackers can exploit active remote sessions to transfer and execute malicious files without host confirmation, leading to full system compromise.

[Mitigation] Immediately update all ScreenConnect clients to the latest patched version and enforce session consent policies.

[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.

[Impact] Unauthenticated attackers can execute arbitrary code with server privileges, leading to full system compromise and sensitive data theft.

[Mitigation] Immediately apply Adobe security patches (APSB26-146) and implement WAF rules to block malicious template patterns.

[Affected Scope] NetScaler ADC and Gateway versions 14.1 (prior to 73.32) and 13.1 (prior to 63.21)

[Impact] Potential for administrative privilege gain and Remote Code Execution (RCE) via authentication bypass

[Mitigation] Apply official Citrix patches and restrict Management Interface (NSIP) access

[Affected Scope] All versions of Adobe Commerce and Magento Open Source (2.4.7 and earlier)

[Impact] Unauthenticated remote attackers can escalate privileges to gain administrative access and compromise sensitive data

[Mitigation] Apply Adobe security patch APSB26-92 immediately and implement IP whitelisting for the admin panel

[Affected Scope] WSO2 Identity Server, API Manager, and products utilizing WSO2 JWT authentication modules.

[Impact] Attackers can bypass authentication using crafted JWTs, leading to full administrative account takeover.

[Mitigation] Apply official vendor patches immediately and enforce strict JWT algorithm validation policies.

[Affected Scope] All versions of Adobe Commerce and Magento Open Source prior to APSB26-73.

[Impact] Remote Code Execution (RCE) via malicious file upload, leading to full server compromise and potential data exfiltration.

[Mitigation] Apply official Adobe security patches (APSB26-73) immediately and restrict execution permissions in upload directories.

[Affected Scope] Systems running unpatched versions impacted by CVE-2026-33017

[Impact] Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp...

[Mitigation] Apply vendor security patches and restrict external network exposure.

[Affected Scope] Web-based management interface of Cisco Secure Firewall Management Center (FMC) Software

[Impact] Unauthenticated remote attackers can bypass authentication and execute scripts to obtain full root access to the underlying operating system

[Mitigation] Immediate application of official security patches and restriction of management interface access via ACLs

[Affected Scope] FortiOS versions 6.4 through 7.6 and FortiSwitchManager versions 7.0 through 7.2.

[Impact] Unauthenticated remote attackers can execute arbitrary code or commands with system privileges by sending crafted packets, leading to full system compromise.

[Mitigation] Immediately apply the latest firmware updates provided by Fortinet and restrict exposure of management interfaces and VPN services to the public internet.

[Affected Scope] Craft CMS versions 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17

[Impact] Unauthenticated remote attackers can execute arbitrary PHP code on the target server via crafted HTTP requests, leading to complete system compromise.

[Mitigation] Immediately upgrade your Craft CMS installation to the patched versions (3.9.15, 4.14.15, or 5.6.17) depending on your major version branch.

[Affected Scope] Systems running unpatched versions impacted by CVE-2024-1709

[Impact] ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, whic...

[Mitigation] Apply vendor security patches and restrict external network exposure.