CVE-2025-55182 is a critical pre-authentication remote code execution vulnerability in Meta's React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0. The issue arises from unsafe deserialization of payloads from HTTP requests to Server Function endpoints in react-server-dom-webpack and related packages. This vulnerability has a CVSS score of 10.0 and is known to be exploited in the wild, including use in ransomware campaigns.
OpenPLC ScadaBR has a vulnerability that allows remote authenticated users to upload and execute arbitrary JSP files due to unrestricted file upload with dangerous types. This can lead to remote code execution on the affected system. The vulnerability is identified as CVE-2021-26828 and is considered high severity. Exploits have been observed in the wild. No specific affected versions or patches are provided in the available data.
CVE-2025-58360 is a high-severity XML External Entity (XXE) vulnerability affecting GeoServer, an open-source server for sharing geospatial data. This vulnerability allows attackers to exploit XML parsers to read arbitrary files, cause denial of service, or potentially execute remote code. Although no known exploits are currently active in the wild, the vulnerability poses significant risks to organizations relying on GeoServer for geospatial data services. European organizations using GeoServer in critical infrastructure, government, or environmental monitoring could face data breaches or service disruptions. Mitigation requires disabling external entity processing in XML parsers, applying patches once available, and restricting network access to GeoServer instances. Countries with high adoption of geospatial technologies and critical infrastructure reliance on GeoServer, such as Germany, France, the UK, and the Netherlands, are most at risk. Given the ease of exploitation without authentication and the potential impact on confidentiality and availability, this vulnerability is assessed as high severity. Defenders should prioritize vulnerability scanning, configuration audits, and network segmentation to reduce exposure.
OpenPLC ScadaBR contains a cross-site scripting (XSS) vulnerability in the system_settings.shtm component. This vulnerability allows attackers to inject malicious scripts that can be executed in the context of a user's browser session. The vulnerability is known to be exploited in the wild. No specific affected versions or patches are provided in the available data.
Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient guard against browser-based attacks, as the current defense uses the User-Agent header starting with the string "Mozilla" as a defense mechanism. This defense is insufficient as the fetch specification allows the User-Agent header to be modified. Combined with a DNS rebinding attack against the browser, and this vulnerability is exploitable against a developer running Ray who inadvertently visits a malicious website, or is served a malicious advertisement (malvertising). This issue has been patched in version 2.52.0.
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.
Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.
Gladinet Triofox has an improper access control vulnerability that permits unauthorized access to initial setup pages even after the setup process is complete. This vulnerability has a high severity score and is known to be exploited in the wild.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.
Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.
FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions 17.0.2.36 and above before 17.0.3, the filestore module within the Administrative interface is vulnerable to a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to obtain remote access to the system as an asterisk user. This issue is fixed in version 17.0.3.
A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6. Processing maliciously crafted web content may lead to memory corruption.
CWP Control Web Panel has a critical OS command injection vulnerability allowing unauthenticated remote code execution via shell metacharacters in the t_total parameter of a filemanager changePerm request. Exploitation requires knowledge of a valid non-root username. The vulnerability is actively exploited in the wild and has a CVSS score of 9.0.
CVE-2025-11953 is a critical OS command injection vulnerability in the Metro Development Server version 4.8.0 used by the React Native Community CLI. The server binds to external interfaces by default and exposes an endpoint that allows unauthenticated network attackers to execute arbitrary commands. On Windows systems, this enables attackers to run shell commands with fully controlled arguments. The vulnerability has a CVSS score of 9.8, indicating critical severity. No patch or official remediation information is currently available.
Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Salt Typhoon, a China-linked cyber espionage group, exploited a zero-day vulnerability (CVE-2024-40766) in Citrix NetScaler Gateway appliances to target a European telecommunications organization. The attackers used DLL sideloading to deploy the SNAPPYBEE backdoor and leveraged LightNode VPS endpoints for command and control. The intrusion involved lateral movement from the compromised gateway to Citrix VDA hosts with the intent of data exfiltration. Darktrace detected the attack early through anomaly-based detection, enabling containment before significant damage occurred. No known exploits are currently in the wild. The threat demonstrates sophisticated stealth techniques by state-sponsored actors targeting critical infrastructure. Organizations using Citrix infrastructure, especially in telecommunications, should monitor proactively and apply patches when available. The suggested severity is medium due to the targeted nature and exploitation complexity.
Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, allowing an attacker to execute arbitrary code by sending specially crafted packets.
An unspecified vulnerability in the JavaScriptCore component affects multiple Apple products including macOS, iOS, tvOS, Safari, and watchOS. This flaw may allow arbitrary code execution when processing web content. The affected products could include versions that are end-of-life or end-of-service, and users are advised to discontinue use of impacted products. Exploitation of this vulnerability has been observed in the wild.
