CISA Known Exploited Vulnerabilities

Splunk Enterprise versions 10.2 prior to 10.2.4 and 10.0 prior to 10.0.7 contain a critical vulnerability where the PostgreSQL sidecar service endpoint does not require authentication. This allows unauthenticated network users to create or truncate arbitrary files. Versions 9.4 and earlier are not affected. Disabling the PostgreSQL sidecar service can mitigate the issue if immediate upgrading is not possible.

A critical vulnerability (CVE-2026-48907) in the Joomla Content Editor (JCE) extension for Joomla allows unauthenticated users to create new editor profiles. This flaw leads to the upload and execution of arbitrary PHP code, posing a severe risk to affected systems. The vulnerability affects versions from 1.0.0 up to and including 2.9.99.4. Exploitation requires no privileges or user interaction and has been observed in the wild. The vulnerability is classified under CWE-284 (Improper Access Control) and has a CVSS 4.0 base score of 10.0, indicating maximum severity.

SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the update

LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS, as exploited in the wild in May 2026.

CVE-2026-35273 is a critical vulnerability in Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62, specifically in the Updates Environment Management component. It allows an unauthenticated attacker to remotely exploit the system via HTTP without any user interaction, potentially leading to full takeover of the PeopleSoft Enterprise PeopleTools environment. The vulnerability has a CVSS 3.1 base score of 9.8, indicating high impact on confidentiality, integrity, and availability. Oracle has released a security alert recommending immediate application of mitigations and patches for supported versions.

An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution

CVE-2026-50751 is a critical vulnerability in Check Point Quantum Security Gateway involving improper authentication due to a logic flow weakness in Remote Access and Mobile Access certificate validation within the deprecated IKEv1 key exchange. This flaw allows an unauthenticated remote attacker to bypass user authentication and establish a remote VPN connection without a valid password. The vulnerability has a high CVSS score of 9.3 and is known to be exploited in the wild, including use in ransomware campaigns.

Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Marketplace. For OpenVSX, the problem was detected later, and the compromised version was available from 12:33 UTC to 13:09 UTC (~36 minutes). Version 18.100.0 of Nx Console is not compromised and users may remediate by upgrading to that version.

On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.

Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. Attackers can exploit the unrestricted call to PHP's native unserialize() function combined with gadget chains available in Magento and its dependencies to execute arbitrary code on the server.

CVE-2022-0492 is an improper authentication vulnerability in the Linux Kernel's cgroups v1 release_agent feature that can lead to privilege escalation. This vulnerability has been exploited in the wild and is considered high severity. No specific affected versions or patch information are provided in the available data.

CVE-2025-48595 is a high-severity elevation of privilege vulnerability in Google Android versions 14 through 16-qpr2. It arises from an integer overflow in multiple locations that can lead to code execution locally without requiring user interaction or additional privileges.

CVE-2026-34926 is a directory traversal vulnerability in the on-premise version of Trend Micro's TrendAI Apex One server. It allows a pre-authenticated local attacker with administrative credentials on the server to modify a key table, potentially injecting malicious code that could be deployed to agents. Exploitation requires prior administrative access to the Apex One server and is limited to the on-premise deployment. The vulnerability has a CVSS score of 6.7, indicating medium severity. No official patch or remediation information is currently available, and no known exploits are reported in the wild.

Langflow suffers from an origin validation error vulnerability due to an overly permissive CORS configuration combined with a refresh token cookie set as SameSite=None. This flaw allows malicious webpages to perform cross-origin requests with credentials, enabling calls to the refresh endpoint. Exploitation can lead to arbitrary code execution and full system compromise by leveraging obtained tokens that grant access to authenticated endpoints.

CVE-2024-21182 is a high-severity vulnerability in Oracle WebLogic Server versions 12.2.1.4.0 and 14.1.1.0.0. It allows an unauthenticated attacker with network access via T3 or IIOP protocols to compromise the server.

Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally.

Microsoft Defender Denial of Service Vulnerability

CVE-2008-4250 is a buffer overflow vulnerability in the Windows Server Service of Microsoft Windows. It allows remote attackers to execute arbitrary code by sending a specially crafted RPC request that triggers an overflow during path canonicalization. This vulnerability has been exploited in the wild and is considered high severity.