CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Plex Media Server Arbitrary File Write and Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-96656)
[Affected Scope] Plex Media Server versions prior to 1.43.3.10861.
[Impact] An authenticated admin can exploit the TranscoderH264Options preference to write arbitrary files, leading to full system compromise via malicious library (.so) execution.
[Mitigation] Immediately update to version 1.43.3.10861 or later and enforce Multi-Factor Authentication (MFA) for all admin accounts.
Windows Internet Shortcut Files Path Control Remote Code Execution Vulnerability (CVE-2025-33053, CISA KEV Actively Exploited)
[Affected Scope] Microsoft Windows operating systems including Windows 10, Windows 11, and Windows Server supporting Internet Shortcut (.url) files.
[Impact] An unauthorized remote attacker can execute arbitrary code with the privileges of the logged-in user by tricking them into opening a crafted .url file that references a malicious WebDAV/SMB share.
[Mitigation] Apply the latest Microsoft cumulative security updates immediately, disable the WebClient service, and block outbound SMB and WebDAV traffic at the perimeter firewall.
Windows NTLM File Path Control Spoofing Vulnerability (CVE-2025-24054) Security Advisory
[Affected Scope] Active Directory environments and Windows operating systems utilizing the NTLM authentication protocol
[Impact] Unauthorized remote attackers can control file names or paths to perform network-based spoofing and credential relay attacks
[Mitigation] Apply the latest Microsoft cumulative security updates and restrict NTLM authentication traffic
Palo Alto Networks PAN-OS Management Web Interface Authenticated File Read Vulnerability (CVE-2025-0111) Analysis and Mitigation Guide
[Affected Scope] PAN-OS firewalls with the management web interface enabled and accessible via the network (excluding Cloud NGFW and Prisma Access)
[Impact] Authenticated attackers can read sensitive system files on the PAN-OS filesystem that are readable by the 'nobody' user, potentially exposing configuration details
[Mitigation] Apply the latest PAN-OS security patches immediately and restrict management interface access to trusted internal IP addresses
Microsoft Windows NTLM Hash Disclosure and Spoofing Vulnerability (CVE-2024-43451) Critical Security Advisory
[Affected Scope] All supported versions of Microsoft Windows and Windows Server operating systems
[Impact] Simple user interaction with a malicious file (such as right-clicking or selecting) triggers NTLM credential disclosure, enabling credential theft and NTLM Relay attacks
[Mitigation] Immediately apply the Microsoft November 2024 cumulative security updates and restrict outbound NTLM traffic via Group Policy and firewalls