Craft CMS has a critical code injection vulnerability (CVE-2025-32432) that allows remote attackers to execute arbitrary code without authentication. This vulnerability has a CVSS score of 10.0, indicating maximum severity, and is known to be exploited in the wild. No specific affected versions or patches have been provided in the available data.
Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authentication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.
CVE-2021-22054 is a server-side request forgery (SSRF) vulnerability in Omnissa Workspace One UEM (formerly VMware Workspace One UEM). It allows a malicious actor with network access to the UEM to send unauthorized requests and potentially access sensitive information. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided.
Multiple Hikvision products have an improper authentication vulnerability that allows malicious users to escalate privileges and access sensitive information. This vulnerability is known to be exploited in the wild. No specific affected versions or patch information is provided.
Multiple Rockwell products have a vulnerability involving insufficiently protected credentials. Specifically, Studio 5000 Logix Designer software may expose a key used to verify communication with Logix controllers. Exploiting this vulnerability could allow unauthorized applications to connect to Logix controllers if the attacker has network access. This vulnerability has been exploited in the wild.
An integer overflow or wraparound vulnerability exists in multiple Apple products including tvOS, macOS, Safari, iPadOS, and watchOS. This flaw arises from the processing of maliciously crafted web content and may allow an attacker to execute arbitrary code. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device.
This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root.
Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.
CVE-2026-20079 is a critical authentication bypass vulnerability in Cisco Secure Firewall Management Center (FMC) web interface. It allows an unauthenticated remote attacker to bypass authentication and execute scripts on the device, gaining root access to the underlying operating system. The flaw arises from an improper system process created at boot time. Exploitation requires sending crafted HTTP requests to the affected device. This vulnerability affects multiple specific versions of Cisco FMC. It has a CVSS score of 10.0 and is known to be exploited in the wild.
VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress.
To remediate CVE-2026-22719, apply the patches listed in the 'Fixed Version' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001
Workarounds for CVE-2026-22719 are documented in the 'Workarounds' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001
CVE-2026-20122 is a medium severity vulnerability in Cisco Catalyst SD-WAN Manager's API that allows an authenticated remote attacker with valid read-only API credentials to overwrite arbitrary files on the local file system. This occurs due to improper file handling in the API interface. Successful exploitation can lead to the attacker gaining elevated vmanage user privileges.
CVE-2026-20127 is a critical vulnerability in Cisco Catalyst SD-WAN Manager and related components that allows unauthenticated remote attackers to bypass authentication and gain administrative privileges. The flaw is due to improper functioning of the peering authentication mechanism. Exploitation enables attackers to log in as a high-privileged internal user and access NETCONF to manipulate network configurations of the SD-WAN fabric.
CVE-2026-20128 is a high-severity vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager. It allows an unauthenticated, remote attacker to gain DCA user privileges by exploiting a credential file containing the DCA password accessible via a crafted HTTP request. This vulnerability affects multiple versions prior to 20.18, which is not vulnerable. Successful exploitation could enable an attacker to access other affected systems with elevated privileges.
A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system.
This vulnerability is due to insufficient file system restrictions. An authenticated attacker with netadmin privileges could exploit this vulnerability by accessing the vshell of an affected system. A successful exploit could allow the attacker to read sensitive information on the underlying operating system.
CVE-2022-20775 is a path traversal vulnerability in the Cisco SD-WAN CLI that allows an authenticated local attacker to bypass access controls and gain elevated privileges. Exploitation can lead to arbitrary command execution as the root user. This vulnerability has been observed exploited in the wild.
The KRVTZ-NET IDS alerts from 2026-02-23 report reconnaissance activity targeting Fortigate VPN devices via repeated GET requests to the /remote/logincheck endpoint linked to CVE-2023-27997. This vulnerability allows unauthenticated attackers to bypass authentication and potentially execute arbitrary commands. The alerts also note scanning for hidden environment files and PHP info pages to gather sensitive configuration data. No active exploitation or ransomware campaigns are currently associated with these activities. The threat is considered low severity and represents broad scanning efforts from diverse global sources.
