Threat database

Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally.

Gogs contains a path traversal vulnerability in the PutContents API due to improper symbolic link handling. This vulnerability could allow an attacker with limited privileges to execute code remotely. The vulnerability has a high severity score of 8.7 and is known to be exploited in the wild.

A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiNAC-F 7.6.3 through 7.6.5, FortiOS 7.6.0 through 7.6.5, FortiOS 7.4.0 through 7.4.10, FortiOS 7.2.0 through 7.2.12, FortiOS 7.0.0 through 7.0.18, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.12, FortiProxy 7.2.0 through 7.2.15, FortiProxy 7.0.0 through 7.0.22, FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.

Microsoft Office PowerPoint contains a code injection vulnerability (CVE-2009-0556) that allows remote attackers to execute arbitrary code via a specially crafted PowerPoint file. The vulnerability is triggered by an OutlineTextRefAtom with an invalid index value causing memory corruption. This vulnerability has been exploited in the wild.

A remote code execution issue exists in HPE OneView.

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.

CVE-2023-52163 is a high-severity command injection vulnerability affecting Digiever DS-2105 Pro devices running firmware version 3.1.0.71-11. The flaw exists in the time_tzsetup.cgi endpoint, allowing an authenticated attacker with low privileges to execute arbitrary commands remotely without user interaction. This vulnerability impacts confidentiality, integrity, and availability, potentially enabling full system compromise. The affected products are no longer supported by the vendor, and no patches are available. Although no known exploits are currently observed in the wild, the ease of exploitation and critical impact make this a significant risk. European organizations using these legacy devices should prioritize mitigation to prevent potential attacks.

"UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. Only devices that met these conditions and installed the compromised versions were affected. The Live Update client has already reached End-of-Support (EOS) in October 2021, and no currently supported devices or products are affected by this issue.

CVE-2025-43529 is a use-after-free vulnerability in Safari and related Apple operating systems that could allow arbitrary code execution when processing maliciously crafted web content. The issue is fixed in Safari 26.2 and corresponding OS versions including iOS 18.7.3, iPadOS 18.7.3, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, and watchOS 26.2. Apple is aware of exploitation in the wild targeting specific individuals on iOS versions prior to 26. The vulnerability has a high severity score of 8.8 and is related to CWE-416 (use-after-free).

Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. This degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication. This opens the door for future exploitation and can be leveraged with previous vulnerabilities to gain a full system compromise.

Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

CVE-2018-4063 is a vulnerability in Sierra Wireless AirLink ALEOS that allows an authenticated attacker to upload files with dangerous types via a specially crafted HTTP request. This can lead to executable code being uploaded and accessible on the webserver. The affected product may be end-of-life or end-of-service, and users are advised to discontinue its use.

OSGeo GeoServer has a high-severity vulnerability (CVE-2025-58360) involving improper restriction of XML external entity (XXE) references. This flaw occurs when the application processes XML input via the /geoserver/wms GetMap operation, allowing attackers to define external entities within the XML request. The vulnerability has been exploited in the wild and can lead to high confidentiality impact and limited availability impact.

Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

CVE-2025-6218 is a high-severity path traversal vulnerability in RARLAB WinRAR version 7.11 (64-bit) that allows remote attackers to execute arbitrary code. The flaw exists in the handling of file paths within archive files, enabling crafted paths to traverse directories improperly. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page. The vulnerability permits code execution with the privileges of the current user.

A buffer overflow vulnerability (CWE-120) exists in D-Link routers, impacting confidentiality, integrity, and availability. The affected products may be end-of-life or end-of-service, and exploitation is known to occur in the wild. Users are advised to discontinue use of the affected devices.

Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025.