Microsoft Visual Basic for Applications (VBA) contains an insecure library loading vulnerability (CVE-2012-1854) that could allow remote code execution. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.
CVE-2026-20122 is a medium severity vulnerability in Cisco Catalyst SD-WAN Manager's API that allows an authenticated remote attacker with valid read-only API credentials to overwrite arbitrary files on the local file system. This occurs due to improper file handling in the API interface. Successful exploitation can lead to the attacker gaining elevated vmanage user privileges.
CVE-2026-20128 is a high-severity vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager. It allows an unauthenticated, remote attacker to gain DCA user privileges by exploiting a credential file containing the DCA password accessible via a crafted HTTP request. This vulnerability affects multiple versions prior to 20.18, which is not vulnerable. Successful exploitation could enable an attacker to access other affected systems with elevated privileges.
A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system.
This vulnerability is due to insufficient file system restrictions. An authenticated attacker with netadmin privileges could exploit this vulnerability by accessing the vshell of an affected system. A successful exploit could allow the attacker to read sensitive information on the underlying operating system.
CVE-2025-48700 is a Cross-Site Scripting (XSS) vulnerability affecting Zimbra Collaboration Suite (ZCS) versions 8.8.15, 9.0, 10.0, and 10.1 in the Classic UI. The flaw allows attackers to execute arbitrary JavaScript within a user's session by sending a crafted email containing malicious HTML with an @import directive and other script injection vectors. Exploitation occurs when a user views the malicious email, requiring no further interaction. This can lead to unauthorized access to sensitive information within the affected session. The vulnerability has a CVSS score of 6.
TrueConf Client downloads application update code and applies it without performing verification. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user.
An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
CVE-2026-5281 is a use-after-free vulnerability in the Dawn component of Google Chrome versions prior to 146.0.7680.178. This flaw allows a remote attacker who has compromised the renderer process to execute arbitrary code by delivering a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported. The vulnerability affects Chrome desktop versions before 146.0.
CVE-2026-1340 is a critical vulnerability in Ivanti Endpoint Manager Mobile involving improper control of code generation, classified as CWE-94 (Code Injection). This flaw allows unauthenticated attackers to execute arbitrary code remotely. The vulnerability has a CVSS 3.1 base score of 9.8, indicating high impact on confidentiality, integrity, and availability. No patch or official remediation information is currently available. There are no known exploits in the wild at this time. The affected versions are unspecified, and the product is not a cloud service.
CVE-2026-35616 is a critical improper access control vulnerability in Fortinet FortiClientEMS versions 7.4.5 through 7.4.6. It allows an unauthenticated attacker to execute unauthorized code or commands via crafted requests. This vulnerability has a high CVSS score of 9.1 and is known to be exploited in the wild. An official fix is available to remediate this issue.
Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquasecurity/trivy-action` to credential-stealing malware, and replace all 7 tags in `aquasecurity/setup-trivy` with malicious commits. This incident is a continuation of the supply chain attack that began in late February 2026. Following the initial disclosure on March 1, credential rotation was performed but was not atomic (not all credentials were revoked simultaneously). The attacker could have use a valid token to exfiltrate newly rotated secrets during the rotation window (which lasted a few days). This could have allowed the attacker to retain access and execute the March 19 attack. Affected components include the `aquasecurity/trivy` Go / Container image version 0.69.4, the `aquasecurity/trivy-action` GitHub Action versions 0.0.1 – 0.34.2 (76/77), and the`aquasecurity/setup-trivy` GitHub Action versions 0.2.0 – 0.2.6, prior to the recreation of 0.2.6 with a safe commit. Known safe versions include versions 0.69.2 and 0.69.3 of the Trivy binary, version 0.35.0 of trivy-action, and version 0.2.6 of setup-trivy. Additionally, take other mitigations to ensure the safety of secrets. If there is any possibility that a compromised version ran in one's environment, all secrets accessible to affected pipelines must be treated as exposed and rotated immediately. Check whether one's organization pulled or executed Trivy v0.69.4 from any source. Remove any affected artifacts immediately. Review all workflows using `aquasecurity/trivy-action` or `aquasecurity/setup-trivy`. Those who referenced a version tag rather than a full commit SHA should check workflow run logs from March 19–20, 2026 for signs of compromise. Look for repositories named `tpcp-docs` in one's GitHub organization. The presence of such a repository may indicate that the fallback exfiltration mechanism was triggered and secrets were successfully stolen. Pin GitHub Actions to full, immutable commit SHA hashes, don't use mutable version tags.
CVE-2026-33017 is a critical unauthenticated remote code execution vulnerability in langflow versions prior to 1.9.0. The vulnerability exists in the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint, which allows building public flows without authentication. When the optional data parameter is supplied, attacker-controlled flow data containing arbitrary Python code is executed via exec() without sandboxing. This flaw enables attackers to execute arbitrary code remotely without any privileges. The issue was fixed in langflow version 1.9.0.
Craft CMS has a critical code injection vulnerability (CVE-2025-32432) that allows remote attackers to execute arbitrary code without authentication. This vulnerability has a CVSS score of 10.0, indicating maximum severity, and is known to be exploited in the wild. No specific affected versions or patches have been provided in the available data.
Laravel Livewire contains a code injection vulnerability that can allow unauthenticated attackers to execute remote commands under specific conditions. This vulnerability is identified as CVE-2025-54068 and has been exploited in the wild. No specific affected versions or patches are currently provided. The severity is assessed as high due to the potential for remote code execution.
A memory corruption issue was addressed with improved lock state checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious application may cause unexpected changes in memory shared between processes.
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious application may be able to cause unexpected system termination or write kernel memory.
The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption.