CVE Vulnerability Advisory Database

[Affected Scope] Ninja Forms WordPress plugin versions up to, and including, 3.15.5

[Impact] Authenticated attackers with subscriber-level access can execute arbitrary shortcodes and potentially access sensitive data by manipulating their profile display name

[Mitigation] Immediately update the Ninja Forms plugin to the latest version (3.15.6 or higher) and review default field configurations

[Affected Scope] Ninja Forms WordPress plugin versions up to, and including, 3.15.5

[Impact] Unauthenticated attackers can execute arbitrary WordPress shortcodes, potentially leading to sensitive information disclosure or further exploitation

[Mitigation] Immediately update the Ninja Forms plugin to the latest secure version (3.15.6 or higher)

[Affected Scope] Gitea versions prior to 1.27.1

[Impact] Unauthenticated remote attackers can install malicious Git hooks via the diffpatch API, leading to arbitrary system command execution with Gitea server privileges.

[Mitigation] Immediately upgrade Gitea instances to version 1.27.1 or later, and disable Git Hook functionality in the configuration.

[Affected Scope] TrueConf Server versions 5.3.0 to 5.3.9, 5.4.0 to 5.4.9, 5.5.0 to 5.5.5, and earlier

[Impact] An unauthenticated remote attacker can bypass sandbox isolation and execute arbitrary code on the host system by sending a crafted script via TCP port 4307.

[Mitigation] Immediately upgrade TrueConf Server to the latest patched version and restrict network access to TCP port 4307 using firewalls.

[Affected Scope] IBM Langflow OSS versions 1.0.0 through 1.10.0 in default deployments

[Impact] Unauthenticated attackers can obtain superuser tokens and execute arbitrary Python code, leading to full system compromise

[Mitigation] Immediately upgrade to the latest patched version, disable auto-login, and restrict network access to the application

[Affected Scope] SonicWall SMA1000 appliances utilizing the Appliance Management Console (AMC)

[Impact] An authenticated remote attacker with administrative privileges can execute arbitrary OS commands under specific conditions, potentially leading to full system compromise

[Mitigation] Immediately apply the latest firmware patches provided by SonicWall and restrict external access to the management console

[Affected Scope] Apache ActiveMQ Classic versions prior to 5.19.4, and 6.0.0 through 6.2.3

[Impact] An authenticated attacker can execute arbitrary system commands within the broker's JVM by loading a malicious remote Spring XML configuration via the Jolokia JMX-HTTP bridge

[Mitigation] Immediately upgrade Apache ActiveMQ to a patched version (5.19.4 or 6.2.3) and restrict Jolokia access policies

[Affected Scope] Systems running unpatched versions impacted by CVE-2026-33017

[Impact] Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp...

[Mitigation] Apply vendor security patches and restrict external network exposure.

[Affected Scope] Google Chrome and Chromium-based browsers prior to version 146.0.7680.75

[Impact] A remote attacker can execute arbitrary code inside the browser sandbox renderer process by enticing a user to visit a specially crafted HTML page

[Mitigation] Immediately update Google Chrome to the latest stable version (146.0.7680.75 or higher)

[Affected Scope] Ivanti Endpoint Manager Mobile (EPMM) affected versions

[Impact] Unauthenticated attackers can execute arbitrary code remotely, potentially leading to full system compromise

[Mitigation] Apply the official security patches immediately and restrict access to exposed management interfaces

[Affected Scope] Developers running Ray AI compute engine versions prior to 2.52.0 in local or development environments

[Impact] Remote Code Execution (RCE) on the developer's machine via DNS rebinding and browser-based request forgery when visiting malicious websites or viewing malvertisements

[Mitigation] Immediately upgrade the Ray package to version 2.52.0 or higher

[Affected Scope] Laravel Livewire versions v3.0.0 up to and including v3.6.3

[Impact] Unauthenticated remote attackers can exploit the component hydration process to execute arbitrary system commands on the host server

[Mitigation] Immediately upgrade the Livewire package to the patched version v3.6.4 or later

[Affected Scope] Craft CMS versions 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17

[Impact] Unauthenticated remote attackers can execute arbitrary PHP code on the target server via crafted HTTP requests, leading to complete system compromise.

[Mitigation] Immediately upgrade your Craft CMS installation to the patched versions (3.9.15, 4.14.15, or 5.6.17) depending on your major version branch.

[Affected Scope] Langflow versions prior to 1.3.0

[Impact] A remote, unauthenticated attacker can execute arbitrary Python code and fully compromise the host system by sending crafted HTTP requests.

[Mitigation] Immediately upgrade Langflow to version 1.3.0 or later, and restrict external access to the vulnerable endpoint.

[Affected Scope] Craft CMS installations running versions prior to 4.4.15

[Impact] Unauthenticated remote attackers can execute arbitrary PHP code and fully compromise the underlying server by sending crafted HTTP requests

[Mitigation] Immediately upgrade Craft CMS to version 4.4.15 or later to resolve the vulnerability

[Affected Scope] Microsoft Office Excel 2000 through 2007, Excel Viewer, Office for Mac 2004/2008, and Compatibility Pack.

[Impact] Opening a specially crafted Excel document can trigger an access attempt on an invalid object, allowing remote attackers to execute arbitrary code.

[Mitigation] Apply the official Microsoft security patches immediately and restrict opening untrusted Excel attachments.

[Affected Scope] Microsoft Windows 2000, XP, Server 2003, Vista, Server 2008, and Windows 7 Pre-Beta

[Impact] Unauthenticated remote attackers can execute arbitrary code with SYSTEM privileges and gain full control of the target system via crafted RPC requests

[Mitigation] Apply the official Microsoft security patch (MS08-067) immediately and restrict external access to SMB ports (TCP 139/445)