CVE-2026-35616 is a critical improper access control vulnerability in Fortinet FortiClientEMS versions 7.4.5 through 7.4.6. It allows an unauthenticated attacker to execute unauthorized code or commands via crafted requests. This vulnerability has a high CVSS score of 9.1 and is known to be exploited in the wild. An official fix is available to remediate this issue.
Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquasecurity/trivy-action` to credential-stealing malware, and replace all 7 tags in `aquasecurity/setup-trivy` with malicious commits. This incident is a continuation of the supply chain attack that began in late February 2026. Following the initial disclosure on March 1, credential rotation was performed but was not atomic (not all credentials were revoked simultaneously). The attacker could have use a valid token to exfiltrate newly rotated secrets during the rotation window (which lasted a few days). This could have allowed the attacker to retain access and execute the March 19 attack. Affected components include the `aquasecurity/trivy` Go / Container image version 0.69.4, the `aquasecurity/trivy-action` GitHub Action versions 0.0.1 – 0.34.2 (76/77), and the`aquasecurity/setup-trivy` GitHub Action versions 0.2.0 – 0.2.6, prior to the recreation of 0.2.6 with a safe commit. Known safe versions include versions 0.69.2 and 0.69.3 of the Trivy binary, version 0.35.0 of trivy-action, and version 0.2.6 of setup-trivy. Additionally, take other mitigations to ensure the safety of secrets. If there is any possibility that a compromised version ran in one's environment, all secrets accessible to affected pipelines must be treated as exposed and rotated immediately. Check whether one's organization pulled or executed Trivy v0.69.4 from any source. Remove any affected artifacts immediately. Review all workflows using `aquasecurity/trivy-action` or `aquasecurity/setup-trivy`. Those who referenced a version tag rather than a full commit SHA should check workflow run logs from March 19–20, 2026 for signs of compromise. Look for repositories named `tpcp-docs` in one's GitHub organization. The presence of such a repository may indicate that the fallback exfiltration mechanism was triggered and secrets were successfully stolen. Pin GitHub Actions to full, immutable commit SHA hashes, don't use mutable version tags.
CVE-2026-33017 is a critical unauthenticated remote code execution vulnerability in langflow versions prior to 1.9.0. The vulnerability exists in the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint, which allows building public flows without authentication. When the optional data parameter is supplied, attacker-controlled flow data containing arbitrary Python code is executed via exec() without sandboxing. This flaw enables attackers to execute arbitrary code remotely without any privileges. The issue was fixed in langflow version 1.9.0.
Craft CMS has a critical code injection vulnerability (CVE-2025-32432) that allows remote attackers to execute arbitrary code without authentication. This vulnerability has a CVSS score of 10.0, indicating maximum severity, and is known to be exploited in the wild. No specific affected versions or patches have been provided in the available data.
Laravel Livewire contains a code injection vulnerability that can allow unauthenticated attackers to execute remote commands under specific conditions. This vulnerability is identified as CVE-2025-54068 and has been exploited in the wild. No specific affected versions or patches are currently provided. The severity is assessed as high due to the potential for remote code execution.
A memory corruption issue was addressed with improved lock state checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious application may cause unexpected changes in memory shared between processes.
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious application may be able to cause unexpected system termination or write kernel memory.
The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption.
CVE-2025-66376 is a high-severity stored cross-site scripting (XSS) vulnerability in Zimbra Collaboration (ZCS) versions 10.0 before 10.0.18 and 10.1 before 10.1.13. It allows an attacker to inject malicious CSS @import directives via HTML email messages in the Classic UI, leading to improper input neutralization during web page generation. This vulnerability can be exploited remotely without authentication and does not require user interaction. It impacts confidentiality and integrity but not availability. Known exploits exist in the wild.
When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE).
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2025-47813 is a medium severity vulnerability in Wing FTP Server versions before 7.4.4 where the loginok.html page discloses the full local installation path when a long UID cookie value is used. This information disclosure stems from improper error message handling (CWE-209), potentially aiding attackers in reconnaissance. The vulnerability requires network access and low privileges but no user interaction. Exploitation does not impact integrity or availability but leaks sensitive path information that could facilitate further attacks. No known exploits are reported in the wild yet. Organizations using affected Wing FTP Server versions should prioritize patching or mitigating this issue. Countries with significant Wing FTP Server deployments and critical infrastructure relying on FTP services are at higher risk.
Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
Multiple Hikvision products have an improper authentication vulnerability that allows malicious users to escalate privileges and access sensitive information. This vulnerability is known to be exploited in the wild. No specific affected versions or patch information is provided.
Multiple Rockwell products have a vulnerability involving insufficiently protected credentials. Specifically, Studio 5000 Logix Designer software may expose a key used to verify communication with Logix controllers. Exploiting this vulnerability could allow unauthorized applications to connect to Logix controllers if the attacker has network access. This vulnerability has been exploited in the wild.
An integer overflow or wraparound vulnerability exists in multiple Apple products including tvOS, macOS, Safari, iPadOS, and watchOS. This flaw arises from the processing of maliciously crafted web content and may allow an attacker to execute arbitrary code. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6. Processing maliciously crafted web content may lead to memory corruption.
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 17 and iPadOS 17. An app may be able to execute arbitrary code with kernel privileges.