Actively exploited

AMI MegaRAC SPx — AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability

Microsoft SharePoint — Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

Microsoft Windows — Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability

Wazuh Wazuh Server — Wazuh Server Deserialization of Untrusted Data Vulnerability

Gogs Gogs — Gogs Path Traversal Vulnerability

Digiever DS-2105 Pro — Digiever DS-2105 Pro Missing Authorization Vulnerability

WatchGuard Firebox — WatchGuard Firebox Out of Bounds Write Vulnerability

SysAid SysAid On-Prem — SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability

—

CrushFTP CrushFTP — CrushFTP Unprotected Alternate Channel Vulnerability

Nx Nx Console — Nx Console Embedded Malicious Code Vulnerability

Debian chromium: security update

Langflow Unauth RCE

Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen

Gladinet Triofox — Gladinet Triofox Improper Access Control Vulnerability

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization

D-Link DIR-859 Router — D-Link DIR-859 Router Path Traversal Vulnerability

Craft CMS Allows Remote Code Execution

Synacor Zimbra Collaboration Suite (ZCS) — Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability

MongoDB MongoDB and MongoDB Server — MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability

ASUS Routers — ASUS Routers Improper Authentication Vulnerability

Trend Micro Apex One — Trend Micro Apex One OS Command Injection Vulnerability

Sangoma FreePBX — Sangoma FreePBX OS Command Injection Vulnerability

An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access …

Adobe Commerce and Magento — Adobe Commerce and Magento Improper Input Validation Vulnerability

Fortinet FortiWeb — Fortinet FortiWeb SQL Injection Vulnerability

CWP Control Web Panel — CWP Control Web Panel OS Command Injection Vulnerability

JetBrains TeamCity — JetBrains TeamCity Relative Path Traversal Vulnerability

Apache Tomcat: Mehrere Schwachstellen

Dassault Systèmes DELMIA Apriso — Dassault Systèmes DELMIA Apriso Missing Authorization Vulnerability

SAP NetWeaver — SAP NetWeaver Unrestricted File Upload Vulnerability

Yiiframework Yii — Yiiframework Yii Improper Protection of Alternate Path Vulnerability

Daemon Daemon Tools Lite — Daemon Tools Lite Embedded Malicious Code Vulnerability

CrushFTP CrushFTP — CrushFTP Authentication Bypass Vulnerability

Ivanti Connect Secure, Policy Secure, and ZTA Gateways — Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability

OpenPLC ScadaBR — OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability

Cisco Smart Licensing Utility — Cisco Smart Licensing Utility Static Credential Vulnerability

Broadcom VMware Aria Operations — Broadcom VMware Aria Operations Command Injection Vulnerability

Microsoft Windows — Microsoft Windows Out-of-Bounds Read Vulnerability

SolarWinds Web Help Desk — SolarWinds Web Help Desk Security Control Bypass Vulnerability

Sierra Wireless AirLink ALEOS — Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability

Sitecore CMS and Experience Platform (XP) — Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability

Gladinet CentreStack — Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability

Google Android: Mehrere Schwachstellen

Samsung Android: Mehrere Schwachstellen

Samsung Android: Mehrere Schwachstellen

Samsung MagicINFO 9 Server — Samsung MagicINFO 9 Server Path Traversal Vulnerability

Progress WhatsUp Gold — Progress WhatsUp Gold Path Traversal Vulnerability

Fortinet Multiple Products — Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability