A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device.
This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending a sequence of crafted HTTP requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root.
Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root.
KRVTZ IDS alerts from January 21, 2026, report network reconnaissance targeting Fortigate VPN devices, specifically repeated GET requests to the /remote/logincheck endpoint associated with CVE-2023-27997. This vulnerability allows unauthenticated attackers to bypass authentication and execute arbitrary commands. Additional suspicious scanning includes anomalous HTTP user-agent strings and attempts to access sftp-config.json files to discover exposed credentials. No active exploitation or public patches are currently reported. European organizations, especially in critical infrastructure, finance, and government sectors, are at increased risk. The threat level is medium due to the potential impact if exploited combined with ease of reconnaissance. Defenders should prioritize patching when available, restrict access, and secure credentials to mitigate risk.
Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in. While the vulnerability is in Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data. Note: Affected version for Weblogic Server Proxy Plug-in for IIS is 12.2.1.4.0 only. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).
The KRVTZ IDS alerts from January 19, 2026, report low-severity reconnaissance and scanning activities targeting AjaxPro Remote Code Execution vulnerability (CVE-2021-23758) and IIS 8.3 web servers. These include brute force attempts, suspicious user-agent strings linked to InfoBot malware, and directory brute forcing. No active exploits or patches are currently associated with these alerts, but early-stage probing could lead to more serious attacks. European countries such as Germany, France, the UK, Netherlands, Italy, Spain, and Poland are highlighted as likely affected due to market presence. The overall threat severity is medium given the potential impact if exploitation occurs.
CVE-2025-25249 is a heap-based buffer overflow vulnerability affecting multiple versions of Fortinet FortiSwitchManager and FortiOS. This flaw allows an attacker to execute unauthorized code or commands by sending specially crafted packets. The vulnerability impacts FortiSwitchManager versions 7.2.0 through 7.2.6 and FortiOS versions 6.4 (all versions), 7.0.0 through 7.0.17, 7.2.0 through 7.2.11, 7.4.0 through 7.4.8, and 7.6.0 through 7.6.3. The CVSS v3.1 base score is 7.4, indicating a high severity. Known exploits exist in the wild. Currently, only workarounds are available as remediation, with no official patch released yet.
Gogs contains a path traversal vulnerability in the PutContents API due to improper symbolic link handling. This vulnerability could allow an attacker with limited privileges to execute code remotely. The vulnerability has a high severity score of 8.7 and is known to be exploited in the wild.
Microsoft Office PowerPoint contains a code injection vulnerability (CVE-2009-0556) that allows remote attackers to execute arbitrary code via a specially crafted PowerPoint file. The vulnerability is triggered by an OutlineTextRefAtom with an invalid index value causing memory corruption. This vulnerability has been exploited in the wild.
CVE-2025-66376 is a high-severity stored cross-site scripting (XSS) vulnerability in Zimbra Collaboration (ZCS) versions 10.0 before 10.0.18 and 10.1 before 10.1.13. It allows an attacker to inject malicious CSS @import directives via HTML email messages in the Classic UI, leading to improper input neutralization during web page generation. This vulnerability can be exploited remotely without authentication and does not require user interaction. It impacts confidentiality and integrity but not availability. Known exploits exist in the wild.
Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.
WebKitGTK+ is port of the WebKit portable web rendering engine to the GTK+ platform. These packages provide WebKitGTK+ for GTK+ 3.
Security Fix(es):
* webkitgtk: webkitgtk: Use-after-free due to improper memory management (CVE-2025-43529)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43501)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43531)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43535)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43536)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43541)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFilter servlet. An unauthenticated remote attacker can craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory.
n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.122.0 contain a critical Remote Code Execution (RCE) vulnerability in their workflow expression evaluation system. Under certain conditions, expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime. An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations. This issue has been fixed in versions 1.120.4, 1.121.1, and 1.122.0. Users are strongly advised to upgrade to a patched version, which introduces additional safeguards to restrict expression evaluation. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Limit workflow creation and editing permissions to fully trusted users only; and/or deploy n8n in a hardened environment with restricted operating system privileges and network access to reduce the impact of potential exploitation. These workarounds do not fully eliminate the risk and should only be used as short-term measures.
Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.
An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.
If the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured.
CVE-2025-40602 is a high-severity vulnerability affecting SonicWall SMA 100 series appliances, which are critical for secure remote access and network security. The vulnerability has been actively exploited in the wild, allowing attackers to potentially gain unauthorized access or disrupt services without requiring user interaction. European organizations relying on these appliances, especially in sectors dependent on VPN and remote access, face significant risk. Immediate patching, enhanced monitoring, and network segmentation are essential mitigation steps. Germany, France, and the UK are the most likely affected countries due to high SonicWall market penetration and critical infrastructure reliance. The threat impacts confidentiality and availability, with ease of exploitation and broad scope, warranting a high severity rating. Defenders should prioritize applying patches, reviewing access logs, and reinforcing perimeter defenses to mitigate this threat effectively.
CVE-2025-43529 is a use-after-free vulnerability in Safari and related Apple operating systems that could allow arbitrary code execution when processing maliciously crafted web content. The issue is fixed in Safari 26.2 and corresponding OS versions including iOS 18.7.3, iPadOS 18.7.3, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, and watchOS 26.2. Apple is aware of exploitation in the wild targeting specific individuals on iOS versions prior to 26. The vulnerability has a high severity score of 8.8 and is related to CWE-416 (use-after-free).
