CVE-2018-4063 is a vulnerability in Sierra Wireless AirLink ALEOS that allows an authenticated attacker to upload files with dangerous types via a specially crafted HTTP request. This can lead to executable code being uploaded and accessible on the webserver. The affected product may be end-of-life or end-of-service, and users are advised to discontinue its use.
OSGeo GeoServer has a high-severity vulnerability (CVE-2025-58360) involving improper restriction of XML external entity (XXE) references. This flaw occurs when the application processes XML input via the /geoserver/wms GetMap operation, allowing attackers to define external entities within the XML request. The vulnerability has been exploited in the wild and can lead to high confidentiality impact and limited availability impact.
CVE-2025-6218 is a high-severity path traversal vulnerability in RARLAB WinRAR version 7.11 (64-bit) that allows remote attackers to execute arbitrary code. The flaw exists in the handling of file paths within archive files, enabling crafted paths to traverse directories improperly. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page. The vulnerability permits code execution with the privileges of the current user.
A buffer overflow vulnerability (CWE-120) exists in D-Link routers, impacting confidentiality, integrity, and availability. The affected products may be end-of-life or end-of-service, and exploitation is known to occur in the wild. Users are advised to discontinue use of the affected devices.
An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.
If the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured.
CVE-2025-40602 is a high-severity vulnerability affecting SonicWall SMA 100 series appliances, which are critical for secure remote access and network security. The vulnerability has been actively exploited in the wild, allowing attackers to potentially gain unauthorized access or disrupt services without requiring user interaction. European organizations relying on these appliances, especially in sectors dependent on VPN and remote access, face significant risk. Immediate patching, enhanced monitoring, and network segmentation are essential mitigation steps. Germany, France, and the UK are the most likely affected countries due to high SonicWall market penetration and critical infrastructure reliance. The threat impacts confidentiality and availability, with ease of exploitation and broad scope, warranting a high severity rating. Defenders should prioritize applying patches, reviewing access logs, and reinforcing perimeter defenses to mitigate this threat effectively.
A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges.
This vulnerability is due to insufficient validation of HTTP requests by the Spam Quarantine feature. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.
OpenPLC ScadaBR has a vulnerability that allows remote authenticated users to upload and execute arbitrary JSP files due to unrestricted file upload with dangerous types. This can lead to remote code execution on the affected system. The vulnerability is identified as CVE-2021-26828 and is considered high severity. Exploits have been observed in the wild. No specific affected versions or patches are provided in the available data.
A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0.0 through 7.0.21, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.
In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
OpenPLC ScadaBR contains a cross-site scripting (XSS) vulnerability in the system_settings.shtm component. This vulnerability allows attackers to inject malicious scripts that can be executed in the context of a user's browser session. The vulnerability is known to be exploited in the wild. No specific affected versions or patches are provided in the available data.
KRVTZ-NET IDS alerts from February 19, 2026, report reconnaissance activity targeting web applications using React Server Components and vulnerable JavaScript code. The alerts focus on attempts to exploit CVE-2025-55182, known as React2Shell, which allows unsafe property access, and JavaScript prototype pollution attacks via the __proto__ property in HTTP request bodies. These activities are preliminary probes without confirmed active exploitation or available patches. The vulnerabilities could enable remote code execution, privilege escalation, data manipulation, or denial of service if exploited. Multiple suspicious IPs suggest coordinated scanning, with European organizations using these technologies at particular risk. The threat is currently assessed as low severity but carries significant risk if unmitigated. Early detection, input validation, and network monitoring are recommended to reduce potential impact.
