Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authentication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.
CVE-2021-22054 is a server-side request forgery (SSRF) vulnerability in Omnissa Workspace One UEM (formerly VMware Workspace One UEM). It allows a malicious actor with network access to the UEM to send unauthorized requests and potentially access sensitive information. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided.
Multiple Hikvision products have an improper authentication vulnerability that allows malicious users to escalate privileges and access sensitive information. This vulnerability is known to be exploited in the wild. No specific affected versions or patch information is provided.
Multiple Rockwell products have a vulnerability involving insufficiently protected credentials. Specifically, Studio 5000 Logix Designer software may expose a key used to verify communication with Logix controllers. Exploiting this vulnerability could allow unauthorized applications to connect to Logix controllers if the attacker has network access. This vulnerability has been exploited in the wild.
An integer overflow or wraparound vulnerability exists in multiple Apple products including tvOS, macOS, Safari, iPadOS, and watchOS. This flaw arises from the processing of maliciously crafted web content and may allow an attacker to execute arbitrary code. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device.
This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root.
Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.
This vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device.
A race condition vulnerability in the Linux kernel's POSIX CPU timers subsystem (CVE-2025-38352) has been fixed. The flaw involves a race between handle_posix_cpu_timers() and posix_cpu_timer_del() functions, which can cause failures in timer deletion and task handling under certain exit conditions. This issue affects multiple Linux distributions including Red Hat Enterprise Linux 10 and SUSE Linux Enterprise. A security update is available and requires a system reboot to apply.
VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress.
To remediate CVE-2026-22719, apply the patches listed in the 'Fixed Version' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001
Workarounds for CVE-2026-22719 are documented in the 'Workarounds' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001
CVE-2026-20122 is a medium severity vulnerability in Cisco Catalyst SD-WAN Manager's API that allows an authenticated remote attacker with valid read-only API credentials to overwrite arbitrary files on the local file system. This occurs due to improper file handling in the API interface. Successful exploitation can lead to the attacker gaining elevated vmanage user privileges.
A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.
This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.
CVE-2026-20128 is a high-severity vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager. It allows an unauthenticated, remote attacker to gain DCA user privileges by exploiting a credential file containing the DCA password accessible via a crafted HTTP request. This vulnerability affects multiple versions prior to 20.18, which is not vulnerable. Successful exploitation could enable an attacker to access other affected systems with elevated privileges.
A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system.
This vulnerability is due to insufficient file system restrictions. An authenticated attacker with netadmin privileges could exploit this vulnerability by accessing the vshell of an affected system. A successful exploit could allow the attacker to read sensitive information on the underlying operating system.
CVE-2022-20775 is a path traversal vulnerability in the Cisco SD-WAN CLI that allows an authenticated local attacker to bypass access controls and gain elevated privileges. Exploitation can lead to arbitrary command execution as the root user. This vulnerability has been observed exploited in the wild.
The KRVTZ-NET IDS alerts dated 2026-02-23 report reconnaissance activity targeting Fortigate VPN devices, specifically repeated GET requests to the /remote/logincheck endpoint associated with CVE-2023-27997. This vulnerability allows unauthenticated attackers to bypass authentication and potentially execute arbitrary commands. The alerts also include scanning attempts to access hidden environment files and PHP info pages, common techniques to gather sensitive configuration data. No active exploitation or ransomware campaigns are currently linked to these activities, and no patches are available at the time of reporting. The threat is categorized as low severity and primarily represents scanning and reconnaissance efforts. The presence of IPv4 and IPv6 addresses from diverse global sources indicates a broad scanning campaign. Organizations using Fortigate VPNs should monitor for these indicators and apply mitigation strategies to prevent potential exploitation. The threat affects countries with significant Fortigate VPN deployments and critical infrastructure reliance on these devices.
The KRVTZ-NET IDS alerts from February 19, 2026, indicate reconnaissance activity targeting web applications using React Server Components and vulnerable JavaScript code. The alerts highlight attempts to exploit CVE-2025-55182, a React2Shell vulnerability allowing unsafe property access, and JavaScript prototype pollution attacks via the __proto__ property in HTTP request bodies. These reconnaissance attempts are preliminary probing activities without known active exploitation or patches available. The vulnerabilities could lead to remote code execution, privilege escalation, data manipulation, or denial of service if exploited. Multiple suspicious IP addresses are involved, suggesting coordinated scanning. The threat is currently classified as low severity but poses significant risk if unaddressed. European organizations with web infrastructure using these technologies are particularly at risk. Early detection, input validation, and network monitoring are critical to mitigate potential exploitation.
