CISA Known Exploited Vulnerabilities

CVE-2019-9621 is a server-side request forgery (SSRF) vulnerability in the ProxyServlet component of Synacor Zimbra Collaboration Suite (ZCS). This vulnerability has been exploited in the wild and is considered high severity. No specific affected versions or patch information is provided in the available data.

CVE-2019-5418 is a path traversal vulnerability in Ruby on Rails' Action View component. It allows specially crafted Accept headers combined with calls to `render file:` to cause arbitrary files on the server to be rendered, potentially disclosing their contents. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the input data.

Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

CVE-2025-49704 is a high severity code injection vulnerability in Microsoft SharePoint Enterprise Server 2016 version 16.0.0. It allows an authorized attacker to execute arbitrary code remotely over the network without user interaction. This vulnerability has known exploits in the wild and has been used in ransomware campaigns.

Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)

The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump, as exploited in the wild in May 2025.

The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in May 2025.

Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.

Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

CVE-2019-6693 is a vulnerability in Fortinet FortiOS involving the use of hard-coded credentials. This flaw allows an attacker who knows the hard-coded key to decipher sensitive data contained in FortiOS configuration backup files. The vulnerability has been exploited in the wild and is associated with known ransomware campaigns. No specific affected versions or patch information is provided in the available data.

AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-859 1.06B01. It has been rated as critical. Affected by this issue is some unknown functionality of the file /hedwig.cgi of the component HTTP POST Request Handler. The manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-251666 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.

CVE-2025-5777 is a critical out-of-bounds read vulnerability in Citrix NetScaler ADC when configured as a Gateway or AAA virtual server. It results from insufficient input validation, allowing memory overread. The flaw affects versions 13.1 up to but not including 58.32 and 14.1 up to but not including 43.56. Exploitation requires no privileges or user interaction and has been observed in the wild, including use in ransomware campaigns.

A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.

An unspecified vulnerability exists in multiple Apple products including iOS, iPadOS, macOS, watchOS, and visionOS when processing maliciously crafted photos or videos shared via iCloud Link. This vulnerability has been exploited in the wild. Apple has released fixes in versions 18.3.1, 16.7.11, 15.8.4, 17.7.5, 15.3.1, 14.7.4, 13.7.4, 2.3.1, and 11.3.1 to address this issue. The vulnerability has a medium severity with a CVSS score of 4.2, indicating limited confidentiality and integrity impact without availability impact.

TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm .

External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network.

Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI parameters are a serialized as JSON and deserialized using `as_wazuh_object` (in `framework/wazuh/core/cluster/common.py`). If an attacker manages to inject an unsanitized dictionary in DAPI request/response, they can forge an unhandled exception (`__unhandled_exc__`) to evaluate arbitrary python code. The vulnerability can be triggered by anybody with API access (compromised dashboard or Wazuh servers in the cluster) or, in certain configurations, even by a compromised agent. Version 4.9.1 contains a fix.