Threat database

Red Hat has released updated RHEL-8 based Middleware Containers container images to address multiple security vulnerabilities, including critical issues in Git that allow arbitrary code execution and arbitrary file writes. The updates include backported patches fixing several security flaws such as credential exfiltration, buffer overflows, and file creation flaws. These vulnerabilities affect Red Hat OpenShift Container Platform versions 4.10 through 4.12 for RHEL 8 x86_64. Users are advised to upgrade to the updated container images and rebuild any dependent images to mitigate these vulnerabilities.

Privilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authenticated user in the same Windows Active Directory domain as the session recording server domain

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS 15.8.5, iOS 16.7.12 and iPadOS 16.7.12, iOS 18.6.2 and iPadOS 18.6.2, iPadOS 17.7.10, macOS Sequoia 15.6.1, macOS Sonoma 14.7.8, macOS Ventura 13.7.8. Processing a malicious image file may result in memory corruption. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.

CVE-2025-54948 is a critical OS command injection vulnerability in the on-premise management console of Trend Micro Apex One version 2019 (14.0). It allows a remote attacker to upload malicious code and execute commands without authentication. The vulnerability has a high CVSS score of 9.4, indicating severe potential impact on confidentiality, integrity, and availability. No official patch or remediation information is currently provided by the vendor. There are no known exploits in the wild at this time.

Microsoft Internet Explorer has a memory corruption vulnerability (CVE-2013-3893) that enables remote code execution. The affected versions may be end-of-life or end-of-service, and users are advised to discontinue use. This vulnerability has been exploited in the wild.

Microsoft Office Excel contains a remote code execution vulnerability identified as CVE-2007-0671. This vulnerability can be exploited by opening a specially crafted Excel file, which may be delivered via email attachment or hosted on a malicious website. Successful exploitation allows an attacker to execute arbitrary code on the affected system. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the input data.

CVE-2025-8088 is a path traversal vulnerability in the Windows version of WinRAR that allows attackers to execute arbitrary code via crafted malicious archive files. It has been exploited in the wild and is associated with known ransomware campaigns. The vulnerability was discovered by researchers from ESET and carries a high severity rating with a CVSS 4.0 score of 8.4.

Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server (OR) NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with IPv6 services or servicegroups bound with IPv6 servers (OR) NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with DBS IPv6 services or servicegroups bound with IPv6 DBS servers (OR) CR virtual server with type HDX

CVE-2022-40799 is a high-severity vulnerability in the D-Link DNR-322L device that allows an authenticated attacker to execute operating system level commands by exploiting a code download process lacking integrity checks. The affected product may be end-of-life or end-of-service, and users are advised to discontinue its use. Exploits have been observed in the wild.

D-Link DCS-2530L and DCS-2670L devices have a command injection vulnerability in the cgi-bin/ddns_enc.cgi component. This vulnerability allows attackers to execute arbitrary commands on affected devices. The impacted products may be end-of-life or end-of-service, and users are advised to discontinue use. Exploitation of this vulnerability has been observed in the wild.

D-Link DCS-2530L and DCS-2670L devices have an unspecified vulnerability that can lead to remote disclosure of the administrator password. These devices may be end-of-life or end-of-service, and users are advised to discontinue their use. The vulnerability has been exploited in the wild.

Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025.3.1.

Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1.

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.