Threat database

An integer overflow or wraparound vulnerability exists in multiple Apple products including tvOS, macOS, Safari, iPadOS, and watchOS. This flaw arises from the processing of maliciously crafted web content and may allow an attacker to execute arbitrary code. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

Multiple Rockwell products have a vulnerability involving insufficiently protected credentials. Specifically, Studio 5000 Logix Designer software may expose a key used to verify communication with Logix controllers. Exploiting this vulnerability could allow unauthorized applications to connect to Logix controllers if the attacker has network access. This vulnerability has been exploited in the wild.

CVE-2022-20775 is a path traversal vulnerability in the Cisco SD-WAN CLI that allows an authenticated local attacker to bypass access controls and gain elevated privileges. Exploitation can lead to arbitrary command execution as the root user. This vulnerability has been observed exploited in the wild.

GitLab contains a server-side request forgery (SSRF) vulnerability that affects the handling of requests to the internal network when webhooks are enabled. This vulnerability has been exploited in the wild and is considered high severity. No specific affected versions or patch information are provided in the available data.

CVE-2008-0015 is a remote code execution vulnerability in the Microsoft Windows Video ActiveX Control. An attacker can exploit this by crafting a malicious web page that, when viewed by a user, allows the attacker to execute code with the same privileges as the logged-on user. This vulnerability has been exploited in the wild.

CVE-2020-7796 is a server-side request forgery (SSRF) vulnerability in Synacor Zimbra Collaboration Suite (ZCS) that occurs if the WebEx zimlet is installed and the zimlet JSP is enabled. This vulnerability has been exploited in the wild and is considered high severity.

Notepad++ contains a vulnerability in its WinGUp updater where code is downloaded without an integrity check. This flaw allows attackers to intercept or redirect update traffic to deliver and execute malicious installers with the user's privileges. The vulnerability has been exploited in the wild and is considered high severity.

CVE-2019-19006 is an improper authentication vulnerability in Sangoma FreePBX that allows unauthorized users to bypass password authentication and access administrative services. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided.

GitLab Community and Enterprise Editions have a server-side request forgery (SSRF) vulnerability in the CI Lint API that allows unauthorized external users to perform SSRF attacks. This vulnerability has been exploited in the wild and is considered high severity. No specific affected versions or patch information is provided in the available data.

CVE-2018-14634 is an integer overflow vulnerability in the Linux Kernel's create_elf_tables() function. This flaw allows an unprivileged local user with access to a SUID or otherwise privileged binary to escalate their privileges on the affected system. The vulnerability has been exploited in the wild. Red Hat issued an important security advisory providing patches for Red Hat Enterprise Linux 7.4 Extended Update Support to address this and related kernel vulnerabilities. Systems must be rebooted after applying the update for the fix to take effect.

CVE-2025-34026 is an improper authentication vulnerability in the Versa Concerto SD-WAN orchestration platform. It stems from the Traefik reverse proxy configuration, which allows attackers to access administrative endpoints without proper authentication. This includes access to the internal Actuator endpoint, which can expose sensitive information such as heap dumps and trace logs. The vulnerability has a high severity with a CVSS score of 9.2 and is known to be exploited in the wild.

Gogs contains a path traversal vulnerability in the PutContents API due to improper symbolic link handling. This vulnerability could allow an attacker with limited privileges to execute code remotely. The vulnerability has a high severity score of 8.7 and is known to be exploited in the wild.

Microsoft Office PowerPoint contains a code injection vulnerability (CVE-2009-0556) that allows remote attackers to execute arbitrary code via a specially crafted PowerPoint file. The vulnerability is triggered by an OutlineTextRefAtom with an invalid index value causing memory corruption. This vulnerability has been exploited in the wild.

SonicWall SMA1000 contains a missing authorization vulnerability that could allow for privilege escalation appliance management console (AMC) of affected devices.

CVE-2018-4063 is a vulnerability in Sierra Wireless AirLink ALEOS that allows an authenticated attacker to upload files with dangerous types via a specially crafted HTTP request. This can lead to executable code being uploaded and accessible on the webserver. The affected product may be end-of-life or end-of-service, and users are advised to discontinue its use.

OSGeo GeoServer has a high-severity vulnerability (CVE-2025-58360) involving improper restriction of XML external entity (XXE) references. This flaw occurs when the application processes XML input via the /geoserver/wms GetMap operation, allowing attackers to define external entities within the XML request. The vulnerability has been exploited in the wild and can lead to high confidentiality impact and limited availability impact.

A buffer overflow vulnerability (CWE-120) exists in D-Link routers, impacting confidentiality, integrity, and availability. The affected products may be end-of-life or end-of-service, and exploitation is known to occur in the wild. Users are advised to discontinue use of the affected devices.

OpenPLC ScadaBR has a vulnerability that allows remote authenticated users to upload and execute arbitrary JSP files due to unrestricted file upload with dangerous types. This can lead to remote code execution on the affected system. The vulnerability is identified as CVE-2021-26828 and is considered high severity. Exploits have been observed in the wild. No specific affected versions or patches are provided in the available data.

OpenPLC ScadaBR contains a cross-site scripting (XSS) vulnerability in the system_settings.shtm component. This vulnerability allows attackers to inject malicious scripts that can be executed in the context of a user's browser session. The vulnerability is known to be exploited in the wild. No specific affected versions or patches are provided in the available data.

Gladinet Triofox has an improper access control vulnerability that permits unauthorized access to initial setup pages even after the setup process is complete. This vulnerability has a high severity score and is known to be exploited in the wild.