GitLab contains a server-side request forgery (SSRF) vulnerability that affects the handling of requests to the internal network when webhooks are enabled. This vulnerability has been exploited in the wild and is considered high severity. No specific affected versions or patch information are provided in the available data.
The KRVTZ-NET IDS alerts from February 18, 2026, report reconnaissance activity targeting Fortigate VPN devices via repeated GET requests to the /remote/logincheck endpoint, consistent with attempts to exploit CVE-2023-27997. This vulnerability allows unauthenticated attackers to bypass authentication and potentially execute arbitrary commands. Although no confirmed exploitation is reported, the scanning activity indicates active probing by threat actors. Additionally, network traffic linked to SysJoker malware was detected, identified by its unique User-Agent string, suggesting potential malware deployment following initial access. The alert is categorized as low severity due to its reconnaissance nature and absence of confirmed exploitation. Organizations, especially in Europe, should monitor for such activity, ensure Fortigate VPNs are patched, and strengthen defenses to prevent escalation. The threat highlights the importance of vigilance against early-stage intrusion attempts targeting VPN infrastructure.
Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthenticated remote attacker with knowledge of the hardcoded credential could potentially exploit this vulnerability leading to unauthorized access to the underlying operating system and root-level persistence. Dell recommends that customers upgrade or apply one of the remediations as soon as possible.
CVE-2020-7796 is a server-side request forgery (SSRF) vulnerability in Synacor Zimbra Collaboration Suite (ZCS) that occurs if the WebEx zimlet is installed and the zimlet JSP is enabled. This vulnerability has been exploited in the wild and is considered high severity.
CVE-2008-0015 is a remote code execution vulnerability in the Microsoft Windows Video ActiveX Control. An attacker can exploit this by crafting a malicious web page that, when viewed by a user, allows the attacker to execute code with the same privileges as the logged-on user. This vulnerability has been exploited in the wild.
Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
FileZen contains an OS command injection vulnerability. When FileZen Antivirus Check Option is enabled, a logged-in user may send a specially crafted HTTP request to execute an arbitrary OS command.
Notepad++ contains a vulnerability in its WinGUp updater where code is downloaded without an integrity check. This flaw allows attackers to intercept or redirect update traffic to deliver and execute malicious installers with the user's privileges. The vulnerability has been exploited in the wild and is considered high severity.
A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, watchOS 26.3. An attacker with memory write capability may be able to execute arbitrary code. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 and CVE-2025-43529 were also issued in response to this report.
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.
An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.
