An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here>
Microsoft Office Excel contains a remote code execution vulnerability (CVE-2009-0238) that allows an attacker to take complete control of an affected system if a user opens a specially crafted Excel file containing a malformed object. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
CVE-2023-36424 is a high-severity out-of-bounds read vulnerability in the Microsoft Windows Common Log File System Driver. This flaw can be exploited by a threat actor with limited privileges to escalate their privileges on the affected system. The vulnerability has been observed exploited in the wild. No specific affected Windows versions or patch information is provided in the available data.
Microsoft Visual Basic for Applications (VBA) contains an insecure library loading vulnerability (CVE-2012-1854) that could allow remote code execution. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
CVE-2020-9715 is a use-after-free vulnerability in Adobe Acrobat that can lead to remote code execution. The vulnerability has been exploited in the wild. It requires user interaction and local access to the vulnerable system. The vulnerability has a high severity rating with a CVSS score of 7.8.
CVE-2023-21529 is a deserialization vulnerability in Microsoft Exchange Server that allows an authenticated attacker to execute remote code. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns. No specific affected versions or patch information is provided in the available data.
Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.
This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.
Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.
Marimo versions prior to 0.23.0 contain a critical vulnerability where the /terminal/ws WebSocket endpoint lacks authentication. This allows unauthenticated attackers to gain a full PTY shell and execute arbitrary system commands remotely. The issue arises because this endpoint does not perform authentication validation unlike other endpoints. The vulnerability is fixed in version 0.23.0.
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ.
Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including
BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String).
An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext.
Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().
This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3.
Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue
CVE-2026-35616 is a critical improper access control vulnerability in Fortinet FortiClientEMS versions 7.4.5 through 7.4.6. It allows an unauthenticated attacker to execute unauthorized code or commands via crafted requests. This vulnerability has a high CVSS score of 9.1 and is known to be exploited in the wild. An official fix is available to remediate this issue.
CVE-2026-5281 is a use-after-free vulnerability in the Dawn component of Google Chrome versions prior to 146.0.7680.178. This flaw allows a remote attacker who has compromised the renderer process to execute arbitrary code by delivering a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported. The vulnerability affects Chrome desktop versions before 146.0.
TrueConf Client downloads application update code and applies it without performing verification. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user.
Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquasecurity/trivy-action` to credential-stealing malware, and replace all 7 tags in `aquasecurity/setup-trivy` with malicious commits. This incident is a continuation of the supply chain attack that began in late February 2026. Following the initial disclosure on March 1, credential rotation was performed but was not atomic (not all credentials were revoked simultaneously). The attacker could have use a valid token to exfiltrate newly rotated secrets during the rotation window (which lasted a few days). This could have allowed the attacker to retain access and execute the March 19 attack. Affected components include the `aquasecurity/trivy` Go / Container image version 0.69.4, the `aquasecurity/trivy-action` GitHub Action versions 0.0.1 – 0.34.2 (76/77), and the`aquasecurity/setup-trivy` GitHub Action versions 0.2.0 – 0.2.6, prior to the recreation of 0.2.6 with a safe commit. Known safe versions include versions 0.69.2 and 0.69.3 of the Trivy binary, version 0.35.0 of trivy-action, and version 0.2.6 of setup-trivy. Additionally, take other mitigations to ensure the safety of secrets. If there is any possibility that a compromised version ran in one's environment, all secrets accessible to affected pipelines must be treated as exposed and rotated immediately. Check whether one's organization pulled or executed Trivy v0.69.4 from any source. Remove any affected artifacts immediately. Review all workflows using `aquasecurity/trivy-action` or `aquasecurity/setup-trivy`. Those who referenced a version tag rather than a full commit SHA should check workflow run logs from March 19–20, 2026 for signs of compromise. Look for repositories named `tpcp-docs` in one's GitHub organization. The presence of such a repository may indicate that the fallback exfiltration mechanism was triggered and secrets were successfully stolen. Pin GitHub Actions to full, immutable commit SHA hashes, don't use mutable version tags.
CVE-2026-33017 is a critical unauthenticated remote code execution vulnerability in langflow versions prior to 1.9.0. The vulnerability exists in the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint, which allows building public flows without authentication. When the optional data parameter is supplied, attacker-controlled flow data containing arbitrary Python code is executed via exec() without sandboxing. This flaw enables attackers to execute arbitrary code remotely without any privileges. The issue was fixed in langflow version 1.9.0.
Craft CMS has a critical code injection vulnerability (CVE-2025-32432) that allows remote attackers to execute arbitrary code without authentication. This vulnerability has a CVSS score of 10.0, indicating maximum severity, and is known to be exploited in the wild. No specific affected versions or patches have been provided in the available data.