Threat database

Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.

Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

CVE-2019-6693 is a vulnerability in Fortinet FortiOS involving the use of hard-coded credentials. This flaw allows an attacker who knows the hard-coded key to decipher sensitive data contained in FortiOS configuration backup files. The vulnerability has been exploited in the wild and is associated with known ransomware campaigns. No specific affected versions or patch information is provided in the available data.

AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-859 1.06B01. It has been rated as critical. Affected by this issue is some unknown functionality of the file /hedwig.cgi of the component HTTP POST Request Handler. The manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-251666 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.

CVE-2025-5777 is a critical out-of-bounds read vulnerability in Citrix NetScaler ADC when configured as a Gateway or AAA virtual server. It results from insufficient input validation, allowing memory overread. The flaw affects versions 13.1 up to but not including 58.32 and 14.1 up to but not including 43.56. Exploitation requires no privileges or user interaction and has been observed in the wild, including use in ransomware campaigns.

A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.

An unspecified vulnerability exists in multiple Apple products including iOS, iPadOS, macOS, watchOS, and visionOS when processing maliciously crafted photos or videos shared via iCloud Link. This vulnerability has been exploited in the wild. Apple has released fixes in versions 18.3.1, 16.7.11, 15.8.4, 17.7.5, 15.3.1, 14.7.4, 13.7.4, 2.3.1, and 11.3.1 to address this issue. The vulnerability has a medium severity with a CVSS score of 4.2, indicating limited confidentiality and integrity impact without availability impact.

TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm .

External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network.

Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI parameters are a serialized as JSON and deserialized using `as_wazuh_object` (in `framework/wazuh/core/cluster/common.py`). If an attacker manages to inject an unsanitized dictionary in DAPI request/response, they can forge an unhandled exception (`__unhandled_exc__`) to evaluate arbitrary python code. The vulnerability can be triggered by anybody with API access (compromised dashboard or Wazuh servers in the cluster) or, in certain configurations, even by a compromised agent. Version 4.9.1 contains a fix.

CVE-2025-32433 is a critical vulnerability in the Erlang/OTP SSH server involving missing authentication for a critical function. This flaw allows attackers to execute arbitrary commands remotely without valid credentials, leading to unauthenticated remote code execution. The vulnerability arises from improper handling of SSH protocol messages. It affects multiple products implementing Erlang/OTP SSH server, including Cisco, NetApp, and SUSE. The vulnerability has a CVSS score of 10.0 and is known to be exploited in the wild.

CVE-2024-42009 is a critical cross-site scripting (XSS) vulnerability in RoundCube Webmail. It allows a remote attacker to exploit a desanitization issue in the message_body() function, enabling theft and unauthorized sending of emails via crafted messages. This vulnerability has been exploited in the wild.

Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.

Memory corruption while rendering graphics using Adreno GPU drivers in Chrome.

Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.

ASUS Lyra Mini and ASUS GT-AC2900 routers have an improper authentication vulnerability (CVE-2021-32030) that allows attackers to gain unauthorized administrative access. The vulnerability is critical with a CVSS score of 9.8 and has been exploited in the wild. Affected products may be end-of-life or end-of-service, and users are advised to discontinue use.