CVE Vulnerability Advisory Database

[Affected Scope] Collabora Online Built-in CODE Server (richdocumentscode) for Nextcloud before version 26.4.303.

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands, leading to full system compromise.

[Mitigation] Update the richdocumentscode app to version 26.4.303 or later immediately.

[Affected Scope] All WordPress installations running vulnerable core versions and specific themes.

[Impact] Unauthenticated attackers can include and execute arbitrary local PHP files, leading to full server compromise.

[Mitigation] Immediate update to the latest WordPress security release and deployment of WAF filtering rules.

[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.

[Impact] Unauthenticated attackers can execute arbitrary code with server privileges, leading to full system compromise and sensitive data theft.

[Mitigation] Immediately apply Adobe security patches (APSB26-146) and implement WAF rules to block malicious template patterns.

[Affected Scope] Apache Struts versions 2.3.19 through 2.3.28 with Dynamic Method Invocation (DMI) enabled.

[Impact] Remote attackers can execute arbitrary code (RCE) with server privileges via specially crafted HTTP requests, leading to full system compromise.

[Mitigation] Immediately upgrade to Struts 2.3.20.3, 2.3.24.3, or 2.3.28.1 and set 'struts.enable.DynamicMethodInvocation' to 'false'.

[Affected Scope] Adobe Flash Player on Windows, OS X, and Linux within specific version ranges prior to January 2015 patches

[Impact] Attackers can bypass the Address Space Layout Randomization (ASLR) protection mechanism, significantly increasing the success rate of subsequent Remote Code Execution (RCE) attacks

[Mitigation] Immediately uninstall Adobe Flash Player or upgrade to the patched versions, and disable Flash execution in all web browsers