SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the vulnerable application.
CVE-2025-11953 is a critical OS command injection vulnerability in the Metro Development Server version 4.8.0 used by the React Native Community CLI. The server binds to external interfaces by default and exposes an endpoint that allows unauthenticated network attackers to execute arbitrary commands. On Windows systems, this enables attackers to run shell commands with fully controlled arguments. The vulnerability has a CVSS score of 9.8, indicating critical severity. No patch or official remediation information is currently available.
GitLab Community and Enterprise Editions have a server-side request forgery (SSRF) vulnerability in the CI Lint API that allows unauthorized external users to perform SSRF attacks. This vulnerability has been exploited in the wild and is considered high severity. No specific affected versions or patch information is provided in the available data.
CVE-2019-19006 is an improper authentication vulnerability in Sangoma FreePBX that allows unauthorized users to bypass password authentication and access administrative services. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided.
FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions 17.0.2.36 and above before 17.0.3, the filestore module within the Administrative interface is vulnerable to a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to obtain remote access to the system as an asterisk user. This issue is fixed in version 17.0.3.
Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthenticated remote attacker with knowledge of the hardcoded credential could potentially exploit this vulnerability leading to unauthorized access to the underlying operating system and root-level persistence. Dell recommends that customers upgrade or apply one of the remediations as soon as possible.
BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability (CVE-2026-1731). An unauthenticated remote attacker can send specially crafted requests to execute operating system commands with site user privileges. This vulnerability has a very high CVSS score of 9.9 and is known to be exploited in the wild, including use in ransomware campaigns.
CVE-2026-21509 is a high-severity vulnerability in Microsoft 365 Apps for Enterprise where reliance on untrusted inputs in a security decision allows a local unauthorized attacker to bypass a security feature. The vulnerability has a CVSS score of 7.8 and is known to be exploited in the wild. An official fix is available from Microsoft.
CVE-2018-14634 is an integer overflow vulnerability in the Linux Kernel's create_elf_tables() function. This flaw allows an unprivileged local user with access to a SUID or otherwise privileged binary to escalate their privileges on the affected system. The vulnerability has been exploited in the wild. Red Hat issued an important security advisory providing patches for Red Hat Enterprise Linux 7.4 Extended Update Support to address this and related kernel vulnerabilities. Systems must be rebooted after applying the update for the fix to take effect.
SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. NOTE: SmarterMail system administrator privileges grant the ability to execute operating system commands via built-in management functionality, effectively providing administrative (SYSTEM or root) access on the underlying host.
Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.
SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functionality.
vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.
### Summary
The contents of arbitrary files can be returned to the browser.
### Impact
Only apps explicitly exposing the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host)) are affected.
### Details
- base64 encoded content of non-allowed files is exposed using `?inline&import` (originally reported as `?import&?inline=1.wasm?init`)
- content of non-allowed files is exposed using `?raw?import`
`/@fs/` isn't needed to reproduce the issue for files inside the project root.
### PoC
Original report (check details above for simplified cases):
The ?import&?inline=1.wasm?init ending allows attackers to read arbitrary files and returns the file content if it exists. Base64 decoding needs to be performed twice
```
$ npm create vite@latest
$ cd vite-project/
$ npm install
$ npm run dev
```
Example full URL `http://localhost:5173/@fs/C:/windows/win.ini?import&?inline=1.wasm?init`
CVE-2025-34026 is an improper authentication vulnerability in the Versa Concerto SD-WAN orchestration platform. It stems from the Traefik reverse proxy configuration, which allows attackers to access administrative endpoints without proper authentication. This includes access to the internal Actuator endpoint, which can expose sensitive information such as heap dumps and trace logs. The vulnerability has a high severity with a CVSS score of 9.2 and is known to be exploited in the wild.
A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFilter servlet. An unauthenticated remote attacker can craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory.
eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.
A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device.
This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending a sequence of crafted HTTP requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root.
Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root.
SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.