Threat database

A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.

CVE-2026-82078 is a critical vulnerability in PaperCut MF and NG involving unsafe dynamic class loading in database connection utilities. The application loads database driver classes based on configurable names without validating them against an allowlist, allowing attackers who can manipulate configuration parameters to execute arbitrary Java bytecode with the PaperCut server's privileges. This vulnerability has a CVSS 4.0 score of 9.4 and is known to be exploited in the wild, with public exploit code available via Metasploit. Fixed versions are 24.1.10, 25.0.13, and 26.0.5.

An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.

RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)

RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel. This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)

Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.

CVE-2026-20079 is a critical authentication bypass vulnerability in Cisco Secure Firewall Management Center (FMC) web interface. It allows an unauthenticated remote attacker to bypass authentication and execute scripts on the device, gaining root access to the underlying operating system. The flaw arises from an improper system process created at boot time. Exploitation requires sending crafted HTTP requests to the affected device. This vulnerability affects multiple specific versions of Cisco FMC. It has a CVSS score of 10.0 and is known to be exploited in the wild.

CVE-2025-25249 is a heap-based buffer overflow vulnerability affecting multiple versions of Fortinet FortiSwitchManager and FortiOS. This flaw allows an attacker to execute unauthorized code or commands by sending specially crafted packets. The vulnerability impacts FortiSwitchManager versions 7.2.0 through 7.2.6 and FortiOS versions 6.4 (all versions), 7.0.0 through 7.0.17, 7.2.0 through 7.2.11, 7.4.0 through 7.4.8, and 7.6.0 through 7.6.3. The CVSS v3.1 base score is 7.4, indicating a high severity. Known exploits exist in the wild. Currently, only workarounds are available as remediation, with no official patch released yet.

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.

An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.

CVE-2015-3246 is a race condition vulnerability in Red Hat libuser that allows authenticated local users to corrupt the /etc/passwd file, potentially causing denial of service or privilege escalation. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

CVE-2015-5287 is a privilege escalation vulnerability in Red Hat's Automatic Bug Reporting Tool (ABRT). It allows local users with certain permissions to gain elevated privileges via a symlink attack on a file with a predictable name. The affected product versions may be end-of-life or end-of-service, and users are advised to discontinue use or upgrade to supported versions.

Ajax.NET Professional (AjaxPro) suffers from a deserialization of untrusted data vulnerability that can lead to remote code execution by processing arbitrary .NET classes. The affected product may be end-of-life or end-of-service, and users are advised to discontinue its use or migrate to supported alternatives. Exploitation in the wild has been observed.