A remote code execution zero-day vulnerability (CVE-2025-0994) in Cityworks, an asset management system, is actively exploited by a Chinese-speaking threat group called UAT-6382. The attacks, ongoing since January 2025, target local government utilities management systems in the United States. The attackers deploy web shells such as AntSword and Chopper, and use custom Rust-based loaders named TetraLoader to deliver Cobalt Strike beacons and VSHell malware. Their operations include reconnaissance, directory enumeration, and staging files for exfiltration. This activity demonstrates a high level of sophistication and language proficiency consistent with Chinese origin threat actors.
Samsung MagicINFO 9 Server has a critical path traversal vulnerability (CVE-2025-4632) that allows unauthenticated attackers to write arbitrary files with system-level privileges. This vulnerability has a very high CVSS score of 9.8 and is known to be exploited in the wild. It affects the MagicINFO 9 Server product, but no specific affected versions are stated. The vulnerability enables full compromise of confidentiality, integrity, and availability of the affected system.
CVE-2025-4427 is an authentication bypass vulnerability in Ivanti Endpoint Manager Mobile (EPMM) affecting its API component. The flaw arises from an insecure use of the Spring Framework library, allowing attackers to access protected resources without valid credentials via crafted API requests. The vulnerability has a medium severity with a CVSS score of 5.3 and is known to be exploited in the wild. Public exploit code is available through Metasploit and Exploit-DB. No specific affected versions or patch information is provided.
MDaemon Email Server versions up to 24.5.0 contain a cross-site scripting (XSS) vulnerability that allows remote attackers to execute arbitrary JavaScript via crafted HTML email messages. This vulnerability has been exploited in the wild and is listed in the CISA KEV catalog. The issue has a medium severity rating with a CVSS score of 5.3.
A cross-site scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra Collaboration Suite (ZCS) webmail classic user interface. This flaw allows an attacker to execute arbitrary JavaScript code by sending a crafted email with a malicious calendar header. The vulnerability has been confirmed as exploited in the wild and is tracked as CVE-2024-27443 with a medium severity rating.
Ivanti Endpoint Manager Mobile (EPMM) has a code injection vulnerability in its API component that allows authenticated attackers to execute arbitrary code remotely. This flaw stems from an insecure use of the Hibernate Validator library. The vulnerability has a high severity score of 7.2 and has been exploited in the wild.
ZKTeco BioTime contains a path traversal vulnerability in its iclock API that allows unauthenticated attackers to read arbitrary files by supplying a crafted payload. This vulnerability has a high severity score and is known to be exploited in the wild. No specific affected versions or patches are currently documented.
Srimax Output Messenger has a directory traversal vulnerability (CVE-2025-27920) that enables attackers to access files outside the intended directories. This can lead to leakage of sensitive configuration files or arbitrary file access. The vulnerability has a high severity with a CVSS score of 7.2 and is known to be exploited in the wild. No specific affected versions or patches are currently provided.
CVE-2024-12987 is an OS command injection vulnerability in DrayTek Vigor2960, Vigor300B, and Vigor3900 routers. It arises from an unknown function in the /cgi-bin/mainfunction.cgi/apmcfgupload component of the web management interface. The vulnerability allows unauthenticated remote attackers to execute OS commands. It has a CVSS 4.0 base score of 6.9, indicating medium severity. Exploitation in the wild has been confirmed. The affected version explicitly identified is 1.5.1.4. No patch or official remediation has been documented yet.
CVE-2025-42999 is a critical deserialization vulnerability in SAP NetWeaver Visual Composer Metadata Uploader. It allows a privileged attacker to execute deserialization of untrusted or malicious content, potentially compromising the confidentiality, integrity, and availability of the host system. The vulnerability has a high CVSS score of 9.1 and is known to be exploited in the wild, including use in ransomware campaigns. No specific affected versions or patch information is provided in the available data.
A critical stack-based buffer overflow vulnerability exists in multiple Fortinet products including FortiFone, FortiVoice, FortiNDR, and FortiMail. This flaw allows remote unauthenticated attackers to execute arbitrary code or commands via specially crafted HTTP requests. The vulnerability has a high CVSS score of 9.6 and is known to be exploited in the wild. No specific affected versions or patch information is provided in the available data.
A security update for tomcat9 addresses a vulnerability identified as CVE-2025-24813, which involves potential remote code execution, information disclosure, or information corruption via partial PUT requests. This vulnerability affects multiple versions of tomcat9 distributed with Red Hat Enterprise Linux 10 and related products. Red Hat has rated the security impact as moderate and has released patches to remediate the issue.
CVE-2025-30400 is a use-after-free vulnerability in the Microsoft Windows DWM Core Library that allows a local authorized attacker to elevate privileges. The vulnerability has a high severity score of 7.8 and has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
CVE-2025-30397 is a high-severity type confusion vulnerability in the Microsoft Windows Scripting Engine. It allows an unauthorized attacker to execute arbitrary code remotely via a specially crafted URL. The vulnerability has been exploited in the wild, increasing its risk profile. No specific affected versions or patch information is provided in the available data.
CVE-2025-32706 is a heap-based buffer overflow vulnerability in the Microsoft Windows Common Log File System (CLFS) driver. It allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has been exploited in the wild. The CVSS score is 7.8, indicating high severity. No specific affected versions or patch information is provided in the available data.
CVE-2025-32701 is a use-after-free vulnerability in the Microsoft Windows Common Log File System (CLFS) Driver. It allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has a high severity score of 7.8 and has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
CVE-2025-32709 is a use-after-free vulnerability in the Microsoft Windows Ancillary Function Driver for WinSock. This flaw allows an authorized attacker with limited privileges to escalate their privileges to administrator level. The vulnerability has a high severity score of 7.8 and has been exploited in the wild. No specific affected Windows versions or patch information is provided in the available data.
CVE-2025-47729 is a low-severity vulnerability in TeleMessage TM SGNL where the archiving backend retains cleartext copies of user messages. This hidden functionality exposes message content in an unencrypted form. The vulnerability has been exploited in the wild. The affected versions include all releases up to and including 2025-05-05. No official patch or remediation guidance is provided in the available data.
Multiple GeoVision devices are affected by a critical OS command injection vulnerability (CVE-2024-11120) that allows remote, unauthenticated attackers to execute arbitrary system commands. The affected devices may be end-of-life or end-of-service, and users are advised to discontinue their use. The vulnerability has a high CVSS score of 9.8 and is known to be exploited in the wild.
Multiple GeoVision devices have an OS command injection vulnerability (CVE-2024-6047) that allows remote, unauthenticated attackers to execute arbitrary system commands. The vulnerability is critical with a CVSS score of 9.8 and is known to be exploited in the wild. Affected products may be end-of-life or end-of-service, and users are advised to discontinue use.