ASUS Lyra Mini and ASUS GT-AC2900 routers have an improper authentication vulnerability (CVE-2021-32030) that allows attackers to gain unauthorized administrative access. The vulnerability is critical with a CVSS score of 9.8 and has been exploited in the wild. Affected products may be end-of-life or end-of-service, and users are advised to discontinue use.
Craft CMS versions prior to 5.7.5 and 4.15.3 contain a vulnerability where an unauthenticated attacker can externally control a web parameter assumed to be immutable. This flaw allows injection of arbitrary values, including PHP code, into a known local file on the server. The vulnerability has been exploited in the wild and can be chained with another vulnerability (CVE-2024-58136) for potentially greater impact. A fix is available in versions 5.7.5 and 4.15.3.
ConnectWise ScreenConnect has an improper authentication vulnerability (CVE-2025-3935) that could enable a ViewState code injection attack. If machine keys are compromised, this vulnerability may lead to remote code execution. The vulnerability has a high severity score of 8.1 and is known to be exploited in the wild. No specific affected versions or patches are currently provided.
ASUS RT-AX55 routers have an OS command injection vulnerability (CVE-2023-39780) that allows a remote, authenticated attacker to execute arbitrary commands on the device. This vulnerability has a high severity score of 8.8 and has been exploited in the wild. It requires authentication but no user interaction. The vulnerability impacts confidentiality, integrity, and availability of affected devices.
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has `register_argc_argv` enabled. For these users an unspecified remote code execution vector is present. Users are advised to update to version 3.9.14, 4.13.2, or 5.5.2. Users unable to upgrade should disable `register_argc_argv` to mitigate the issue.
A threat actor exploited a path traversal vulnerability (CVE-2025-4632) in Samsung MagicINFO 9 Server to gain unauthorized access to endpoints. They deployed a rogue AnyDesk remote access tool, created a local administrator account, and disabled Microsoft Defender protections. Instead of deploying a pre-compiled cryptominer, the actor compiled a Monero cryptominer directly on the compromised endpoint using multiple compilers and utilities. The miner connected to the C3Pool mining service and ran under explorer.exe with suspicious arguments. This on-endpoint compilation generated significant endpoint detection and response (EDR) telemetry, increasing detectability despite attempts at stealth.
A cross-site scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra Collaboration Suite (ZCS) webmail classic user interface. This flaw allows an attacker to execute arbitrary JavaScript code by sending a crafted email with a malicious calendar header. The vulnerability has been confirmed as exploited in the wild and is tracked as CVE-2024-27443 with a medium severity rating.
ZKTeco BioTime contains a path traversal vulnerability in its iclock API that allows unauthenticated attackers to read arbitrary files by supplying a crafted payload. This vulnerability has a high severity score and is known to be exploited in the wild. No specific affected versions or patches are currently documented.
Srimax Output Messenger has a directory traversal vulnerability (CVE-2025-27920) that enables attackers to access files outside the intended directories. This can lead to leakage of sensitive configuration files or arbitrary file access. The vulnerability has a high severity with a CVSS score of 7.2 and is known to be exploited in the wild. No specific affected versions or patches are currently provided.
MDaemon Email Server versions up to 24.5.0 contain a cross-site scripting (XSS) vulnerability that allows remote attackers to execute arbitrary JavaScript via crafted HTML email messages. This vulnerability has been exploited in the wild and is listed in the CISA KEV catalog. The issue has a medium severity rating with a CVSS score of 5.3.
Ivanti Endpoint Manager Mobile (EPMM) has a code injection vulnerability in its API component that allows authenticated attackers to execute arbitrary code remotely. This flaw stems from an insecure use of the Hibernate Validator library. The vulnerability has a high severity score of 7.2 and has been exploited in the wild.
CVE-2025-4427 is an authentication bypass vulnerability in Ivanti Endpoint Manager Mobile (EPMM) affecting its API component. The flaw arises from an insecure use of the Spring Framework library, allowing attackers to access protected resources without valid credentials via crafted API requests. The vulnerability has a medium severity with a CVSS score of 5.3 and is known to be exploited in the wild. Public exploit code is available through Metasploit and Exploit-DB. No specific affected versions or patch information is provided.
CVE-2025-42999 is a critical deserialization vulnerability in SAP NetWeaver Visual Composer Metadata Uploader. It allows a privileged attacker to execute deserialization of untrusted or malicious content, potentially compromising the confidentiality, integrity, and availability of the host system. The vulnerability has a high CVSS score of 9.1 and is known to be exploited in the wild, including use in ransomware campaigns. No specific affected versions or patch information is provided in the available data.
CVE-2024-12987 is an OS command injection vulnerability in DrayTek Vigor2960, Vigor300B, and Vigor3900 routers. It arises from an unknown function in the /cgi-bin/mainfunction.cgi/apmcfgupload component of the web management interface. The vulnerability allows unauthenticated remote attackers to execute OS commands. It has a CVSS 4.0 base score of 6.9, indicating medium severity. Exploitation in the wild has been confirmed. The affected version explicitly identified is 1.5.1.4. No patch or official remediation has been documented yet.
A critical stack-based buffer overflow vulnerability exists in multiple Fortinet products including FortiFone, FortiVoice, FortiNDR, and FortiMail. This flaw allows remote unauthenticated attackers to execute arbitrary code or commands via specially crafted HTTP requests. The vulnerability has a high CVSS score of 9.6 and is known to be exploited in the wild. No specific affected versions or patch information is provided in the available data.
CVE-2025-30400 is a use-after-free vulnerability in the Microsoft Windows DWM Core Library that allows a local authorized attacker to elevate privileges. The vulnerability has a high severity score of 7.8 and has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
CVE-2025-30397 is a high-severity type confusion vulnerability in the Microsoft Windows Scripting Engine. It allows an unauthorized attacker to execute arbitrary code remotely via a specially crafted URL. The vulnerability has been exploited in the wild, increasing its risk profile. No specific affected versions or patch information is provided in the available data.