Langflow has a critical missing authentication vulnerability in the /api/v1/validate/code endpoint. This flaw allows remote, unauthenticated attackers to execute arbitrary code by sending crafted HTTP requests. The vulnerability has a CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. It is known to be exploited in the wild and has been linked to ransomware campaigns. No specific affected versions or patches are provided in the available data.
Commvault Command Center has a critical path traversal vulnerability (CVE-2025-34028) that enables remote, unauthenticated attackers to execute arbitrary code. The vulnerability is actively exploited in the wild. No specific affected versions or patch information is provided.
CVE-2024-58136 is a critical vulnerability in the Yii Framework involving improper protection of alternate paths, which may allow remote attackers to execute arbitrary code. This vulnerability has a high CVSS score of 9.0 and is known to be exploited in the wild. It potentially affects other products built on Yii, such as Craft CMS. No specific affected versions or patch information are provided.
CVE-2023-44221 is an OS command injection vulnerability in SonicWall SMA100 appliances affecting the SSL-VPN management interface. It allows a remote, authenticated attacker with administrative privileges to execute arbitrary commands as the 'nobody' user. The vulnerability has a high severity score of 7.2 and has been exploited in the wild.
CVE-2024-38475 is a critical vulnerability in Apache HTTP Server's mod_rewrite module involving improper escaping of output. This flaw allows attackers to map URLs to filesystem locations that are accessible by the server but not intended to be directly reachable via URLs. Exploitation can lead to remote code execution or source code disclosure. The vulnerability has a high CVSS score of 9.1 and is known to be exploited in the wild. No specific affected versions or patch information is provided in the available data.
Qualitia Active! Mail has a critical stack-based buffer overflow vulnerability (CVE-2025-42599) that permits remote, unauthenticated attackers to execute arbitrary code or cause denial-of-service via specially crafted requests. The vulnerability is actively exploited in the wild and has a CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
CVE-2025-3928 is a high-severity vulnerability in Commvault Web Server that allows a remote, authenticated attacker to create and execute webshells. This vulnerability has been exploited in the wild. The CVSS score is 8.8, indicating a critical impact on confidentiality, integrity, and availability. No specific affected versions or patch information is provided.
CVE-2025-1976 is a high-severity code injection vulnerability in Broadcom Brocade Fabric OS that allows a local user with administrative privileges to execute arbitrary code with full root privileges. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.
SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.17.26. See the following advisory for the RPM packages for this release:
https://access.redhat.com/errata/RHBA-2025:4014
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/
Security Fix(es):
* golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of
golang.org/x/crypto/ssh (CVE-2025-22869)
* golang-jwt/jwt: jwt-go allows excessive memory allocation during header
parsing (CVE-2025-30204)
* kernel: ALSA: usb-audio: Fix out of bounds reads when finding clock
sources (CVE-2024-53150)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli.
CVE-2025-24054 is a vulnerability in Microsoft Windows NTLM that involves external control of file name or path, enabling an unauthorized attacker to perform spoofing over a network. It affects multiple Windows versions prior to specific fixed releases. The vulnerability has been exploited in the wild and has a medium severity rating with a CVSS score of 6.5. Fixed versions have been released by Microsoft.
CVE-2025-31200 is a critical memory corruption vulnerability in Apple operating systems that process audio streams from maliciously crafted media files. The flaw allows remote code execution without user interaction. Apple fixed this issue in iOS 18.4.1, iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1, and watchOS 11.5. The vulnerability has been exploited in highly sophisticated targeted attacks on iOS versions prior to 18.4.1.
This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS.
CVE-2025-30406 is a critical vulnerability in Gladinet CentreStack and Triofox involving the use of a hard-coded cryptographic key for ViewState integrity verification. This flaw allows attackers to forge ViewState payloads, leading to server-side deserialization and remote code execution. The vulnerability has a high CVSS score of 9.0 and is known to be exploited in the wild.
CVE-2025-29824 is a use-after-free vulnerability in the Microsoft Windows Common Log File System (CLFS) Driver. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has a high severity score of 7.8 and has been exploited in the wild, including use in known ransomware campaigns.
CVE-2025-31161 is a critical authentication bypass vulnerability in CrushFTP affecting the HTTP authorization header. It allows remote unauthenticated attackers to authenticate as any known or guessable user, including administrative accounts, potentially leading to full system compromise. The vulnerability has a very high CVSS score of 9.8 and is known to be exploited in the wild, including use in ransomware campaigns. No affected versions or patch information is provided in the available data.
A critical stack-based buffer overflow vulnerability exists in Ivanti Connect Secure, Policy Secure, and ZTA Gateways. This flaw allows a remote unauthenticated attacker to execute arbitrary code remotely. The vulnerability has been exploited in the wild and is associated with known ransomware campaigns. The CVSS score is 9.0, indicating high severity with significant impact on confidentiality, integrity, and availability.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.15.48. See the following advisory for the RPM packages for this release:
https://access.redhat.com/errata/RHBA-2025:3057
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/
Security Fix(es):
* kernel: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy
and Mbox devices (CVE-2024-53197)
* libxml2: Use-After-Free in libxml2 (CVE-2024-56171)
* libxml2: Stack-based buffer overflow in xmlSnprintfElements of libxml2
(CVE-2025-24928)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High)
CVE-2019-9875 is a deserialization vulnerability in Sitecore CMS and Experience Platform (XP) within the Sitecore.Security.AntiCSRF module. It allows an authenticated attacker to execute arbitrary code by sending a malicious serialized .NET object in the HTTP POST parameter __CSRFTOKEN. This vulnerability has been exploited in the wild and is considered high severity.