Threat database

FileZen contains an OS command injection vulnerability. When FileZen Antivirus Check Option is enabled, a logged-in user may send a specially crafted HTTP request to execute an arbitrary OS command.

Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

SolarWinds Web Help Desk versions up to and including 12.8.7 are vulnerable to an unauthenticated remote code execution vulnerability via deserialization of untrusted data in the AjaxProxy component. This vulnerability is a patch bypass of previous CVEs (2024-28988 and 2024-28986) and allows attackers to execute arbitrary commands on the host system without authentication. It has a critical CVSS score of 9.8 and is known to be exploited in the wild, including use in ransomware campaigns.

GitLab contains a server-side request forgery (SSRF) vulnerability that affects the handling of requests to the internal network when webhooks are enabled. This vulnerability has been exploited in the wild and is considered high severity. No specific affected versions or patch information are provided in the available data.

CVE-2020-7796 is a server-side request forgery (SSRF) vulnerability in Synacor Zimbra Collaboration Suite (ZCS) that occurs if the WebEx zimlet is installed and the zimlet JSP is enabled. This vulnerability has been exploited in the wild and is considered high severity.

CVE-2008-0015 is a remote code execution vulnerability in the Microsoft Windows Video ActiveX Control. An attacker can exploit this by crafting a malicious web page that, when viewed by a user, allows the attacker to execute code with the same privileges as the logged-on user. This vulnerability has been exploited in the wild.

Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

ThreatSonar Anti-Ransomware from TeamT5 does not properly validate the content of uploaded files. Remote attackers with administrator privileges on the product platform can upload malicious files, which can be used to execute arbitrary system command on the server.

Notepad++ contains a vulnerability in its WinGUp updater where code is downloaded without an integrity check. This flaw allows attackers to intercept or redirect update traffic to deliver and execute malicious installers with the user's privileges. The vulnerability has been exploited in the wild and is considered high severity.

A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, watchOS 26.3. An attacker with memory write capability may be able to execute arbitrary code. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 and CVE-2025-43529 were also issued in response to this report.

Microsoft Configuration Manager Remote Code Execution Vulnerability

Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally.

Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.

Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.

Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network.

Improper privilege management in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.

Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

CVE-2026-20127 is a critical vulnerability in Cisco Catalyst SD-WAN Manager and related components that allows unauthenticated remote attackers to bypass authentication and gain administrative privileges. The flaw is due to improper functioning of the peering authentication mechanism. Exploitation enables attackers to log in as a high-privileged internal user and access NETCONF to manipulate network configurations of the SD-WAN fabric.

CVE-2022-20775 is a path traversal vulnerability in the Cisco SD-WAN CLI that allows an authenticated local attacker to bypass access controls and gain elevated privileges. Exploitation can lead to arbitrary command execution as the root user. This vulnerability has been observed exploited in the wild.