A critical remote code execution vulnerability (CVE-2025-59287) exists in Microsoft Windows Server Update Services (WSUS) affecting versions from Windows Server 2012 through 2025 with the WSUS role enabled. This flaw allows unauthenticated attackers to execute code with system privileges by targeting exposed WSUS instances on ports 8530 and 8531. Initial patching on October 14, 2025, was incomplete, necessitating an emergency update on October 23. Exploitation has been observed within hours of patch release, with attackers leveraging malicious PowerShell commands for reconnaissance and data exfiltration. Approximately 5,500 WSUS instances are exposed globally, representing a significant attack surface. The vulnerability facilitates initial access and lateral movement within networks. European organizations using WSUS for patch management are at risk of compromise, data theft, and broader network infiltration. Immediate patching and network exposure reduction are critical to mitigate this threat.
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
OpenPLC ScadaBR has a vulnerability that allows remote authenticated users to upload and execute arbitrary JSP files due to unrestricted file upload with dangerous types. This can lead to remote code execution on the affected system. The vulnerability is identified as CVE-2021-26828 and is considered high severity. Exploits have been observed in the wild. No specific affected versions or patches are provided in the available data.
CVE-2025-58360 is a high-severity XML External Entity (XXE) vulnerability affecting GeoServer, an open-source server for sharing geospatial data. This vulnerability allows attackers to exploit XML parsers to read arbitrary files, cause denial of service, or potentially execute remote code. Although no known exploits are currently active in the wild, the vulnerability poses significant risks to organizations relying on GeoServer for geospatial data services. European organizations using GeoServer in critical infrastructure, government, or environmental monitoring could face data breaches or service disruptions. Mitigation requires disabling external entity processing in XML parsers, applying patches once available, and restricting network access to GeoServer instances. Countries with high adoption of geospatial technologies and critical infrastructure reliance on GeoServer, such as Germany, France, the UK, and the Netherlands, are most at risk. Given the ease of exploitation without authentication and the potential impact on confidentiality and availability, this vulnerability is assessed as high severity. Defenders should prioritize vulnerability scanning, configuration audits, and network segmentation to reduce exposure.
OpenPLC ScadaBR contains a cross-site scripting (XSS) vulnerability in the system_settings.shtm component. This vulnerability allows attackers to inject malicious scripts that can be executed in the context of a user's browser session. The vulnerability is known to be exploited in the wild. No specific affected versions or patches are provided in the available data.
Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient guard against browser-based attacks, as the current defense uses the User-Agent header starting with the string "Mozilla" as a defense mechanism. This defense is insufficient as the fetch specification allows the User-Agent header to be modified. Combined with a DNS rebinding attack against the browser, and this vulnerability is exploitable against a developer running Ray who inadvertently visits a malicious website, or is served a malicious advertisement (malvertising). This issue has been patched in version 2.52.0.
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.
Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.
Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.
FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions 17.0.2.36 and above before 17.0.3, the filestore module within the Administrative interface is vulnerable to a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to obtain remote access to the system as an asterisk user. This issue is fixed in version 17.0.3.
A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6. Processing maliciously crafted web content may lead to memory corruption.
CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command Injection vulnerability that allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.
CVE-2025-11953 is a critical OS command injection vulnerability in the Metro Development Server version 4.8.0 used by the React Native Community CLI. The server binds to external interfaces by default and exposes an endpoint that allows unauthenticated network attackers to execute arbitrary commands. On Windows systems, this enables attackers to run shell commands with fully controlled arguments. The vulnerability has a CVSS score of 9.8, indicating critical severity. No patch or official remediation information is currently available.
Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
