Threat database

Samsung MagicINFO 9 Server has a critical path traversal vulnerability (CVE-2025-4632) that allows unauthenticated attackers to write arbitrary files with system-level privileges. This vulnerability has a very high CVSS score of 9.8 and is known to be exploited in the wild. It affects the MagicINFO 9 Server product, but no specific affected versions are stated. The vulnerability enables full compromise of confidentiality, integrity, and availability of the affected system.

Zimbra Collaboration contains a cross-site scripting (XSS) vulnerability in the CalendarInvite feature of the Zimbra webmail classic user interface. An attacker can exploit this vulnerability via an email message containing a crafted calendar header, leading to the execution of arbitrary JavaScript code.

Srimax Output Messenger has a directory traversal vulnerability (CVE-2025-27920) that enables attackers to access files outside the intended directories. This can lead to leakage of sensitive configuration files or arbitrary file access. The vulnerability has a high severity with a CVSS score of 7.2 and is known to be exploited in the wild. No specific affected versions or patches are currently provided.

Ivanti Endpoint Manager Mobile (EPMM) contains an authentication bypass vulnerability in the API component that allows an attacker to access protected resources without proper credentials via crafted API requests. This vulnerability results from an insecure implementation of the Spring Framework open-source library.

Ivanti Endpoint Manager Mobile (EPMM) has a code injection vulnerability in its API component that allows authenticated attackers to execute arbitrary code remotely. This flaw stems from an insecure use of the Hibernate Validator library. The vulnerability has a high severity score of 7.2 and has been exploited in the wild.

MDaemon Email Server contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to load arbitrary JavaScript code via an HTML e-mail message.

ZKTeco BioTime contains a path traversal vulnerability in its iclock API that allows unauthenticated attackers to read arbitrary files by supplying a crafted payload. This vulnerability has a high severity score and is known to be exploited in the wild. No specific affected versions or patches are currently documented.

DrayTek Vigor2960, Vigor300B, and Vigor3900 routers contain an OS command injection vulnerability due to an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component web management interface.

CVE-2025-42999 is a critical deserialization vulnerability in SAP NetWeaver Visual Composer Metadata Uploader. It allows a privileged attacker to execute deserialization of untrusted or malicious content, potentially compromising the confidentiality, integrity, and availability of the host system. The vulnerability has a high CVSS score of 9.1 and is known to be exploited in the wild, including use in ransomware campaigns. No specific affected versions or patch information is provided in the available data.

A critical stack-based buffer overflow vulnerability exists in multiple Fortinet products including FortiFone, FortiVoice, FortiNDR, and FortiMail. This flaw allows remote unauthenticated attackers to execute arbitrary code or commands via specially crafted HTTP requests. The vulnerability has a high CVSS score of 9.6 and is known to be exploited in the wild. No specific affected versions or patch information is provided in the available data.

CVE-2025-32701 is a use-after-free vulnerability in the Microsoft Windows Common Log File System (CLFS) Driver. It allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has a high severity score of 7.8 and has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

CVE-2025-32706 is a heap-based buffer overflow vulnerability in the Microsoft Windows Common Log File System (CLFS) driver. It allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has been exploited in the wild. The CVSS score is 7.8, indicating high severity. No specific affected versions or patch information is provided in the available data.

CVE-2025-30397 is a high-severity type confusion vulnerability in the Microsoft Windows Scripting Engine. It allows an unauthorized attacker to execute arbitrary code remotely via a specially crafted URL. The vulnerability has been exploited in the wild, increasing its risk profile. No specific affected versions or patch information is provided in the available data.

CVE-2025-30400 is a use-after-free vulnerability in the Microsoft Windows DWM Core Library that allows a local authorized attacker to elevate privileges. The vulnerability has a high severity score of 7.8 and has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

CVE-2025-32709 is a use-after-free vulnerability in the Microsoft Windows Ancillary Function Driver for WinSock. This flaw allows an authorized attacker with limited privileges to escalate their privileges to administrator level. The vulnerability has a high severity score of 7.8 and has been exploited in the wild. No specific affected Windows versions or patch information is provided in the available data.

TeleMessage TM SGNL contains a hidden functionality vulnerability in which the archiving backend holds cleartext copies of messages from TM SGNL application users.

Multiple GeoVision devices have an OS command injection vulnerability (CVE-2024-6047) that allows remote, unauthenticated attackers to execute arbitrary system commands. The vulnerability is critical with a CVSS score of 9.8 and is known to be exploited in the wild. Affected products may be end-of-life or end-of-service, and users are advised to discontinue use.

Multiple GeoVision devices are affected by a critical OS command injection vulnerability (CVE-2024-11120) that allows remote, unauthenticated attackers to execute arbitrary system commands. The affected devices may be end-of-life or end-of-service, and users are advised to discontinue their use. The vulnerability has a high CVSS score of 9.8 and is known to be exploited in the wild.

Langflow has a critical missing authentication vulnerability in the /api/v1/validate/code endpoint. This flaw allows remote, unauthenticated attackers to execute arbitrary code by sending crafted HTTP requests. The vulnerability has a CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. It is known to be exploited in the wild and has been linked to ransomware campaigns. No specific affected versions or patches are provided in the available data.

Commvault Command Center has a critical path traversal vulnerability (CVE-2025-34028) that enables remote, unauthenticated attackers to execute arbitrary code. The vulnerability is actively exploited in the wild. No specific affected versions or patch information is provided.