Commvault Command Center has a critical path traversal vulnerability (CVE-2025-34028) that enables remote, unauthenticated attackers to execute arbitrary code. The vulnerability is actively exploited in the wild. No specific affected versions or patch information is provided.
CVE-2024-38475 is a critical vulnerability in Apache HTTP Server's mod_rewrite module involving improper escaping of output. This flaw allows attackers to map URLs to filesystem locations that are accessible by the server but not intended to be directly reachable via URLs. Exploitation can lead to remote code execution or source code disclosure. The vulnerability has a high CVSS score of 9.1 and is known to be exploited in the wild. No specific affected versions or patch information is provided in the available data.
CVE-2023-44221 is an OS command injection vulnerability in SonicWall SMA100 appliances affecting the SSL-VPN management interface. It allows a remote, authenticated attacker with administrative privileges to execute arbitrary commands as the 'nobody' user. The vulnerability has a high severity score of 7.2 and has been exploited in the wild.
CVE-2025-31324 is a critical vulnerability in SAP NetWeaver Visual Composer Metadata Uploader that allows unauthenticated attackers to upload arbitrary files, including malicious executable binaries. This unrestricted file upload flaw can lead to complete system compromise, affecting confidentiality, integrity, and availability. The vulnerability is actively exploited in the wild and has been linked to ransomware campaigns. No specific affected versions or patch information is provided in the available data.
Qualitia Active! Mail has a critical stack-based buffer overflow vulnerability (CVE-2025-42599) that permits remote, unauthenticated attackers to execute arbitrary code or cause denial-of-service via specially crafted requests. The vulnerability is actively exploited in the wild and has a CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
CVE-2025-3928 is a high-severity vulnerability in Commvault Web Server that allows a remote, authenticated attacker to create and execute webshells. This vulnerability has been exploited in the wild. The CVSS score is 8.8, indicating a critical impact on confidentiality, integrity, and availability. No specific affected versions or patch information is provided.
CVE-2025-1976 is a high-severity code injection vulnerability in Broadcom Brocade Fabric OS that allows a local user with administrative privileges to execute arbitrary code with full root privileges. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.
Microsoft Windows NTLM contains an external control of file name or path vulnerability that allows an unauthorized attacker to perform spoofing over a network.
CVE-2025-30406 is a critical vulnerability in Gladinet CentreStack and Triofox involving the use of a hard-coded cryptographic key for ViewState integrity verification. This flaw allows attackers to forge ViewState payloads, leading to server-side deserialization and remote code execution. The vulnerability has a high CVSS score of 9.0 and is known to be exploited in the wild.
CVE-2025-29824 is a use-after-free vulnerability in the Microsoft Windows Common Log File System (CLFS) Driver. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has a high severity score of 7.8 and has been exploited in the wild, including use in known ransomware campaigns.
CVE-2025-31161 is a critical authentication bypass vulnerability in CrushFTP affecting the HTTP authorization header. It allows remote unauthenticated attackers to authenticate as any known or guessable user, including administrative accounts, potentially leading to full system compromise. The vulnerability has a very high CVSS score of 9.8 and is known to be exploited in the wild, including use in ransomware campaigns. No affected versions or patch information is provided in the available data.
A critical stack-based buffer overflow vulnerability exists in Ivanti Connect Secure, Policy Secure, and ZTA Gateways. This flaw allows a remote unauthenticated attacker to execute arbitrary code remotely. The vulnerability has been exploited in the wild and is associated with known ransomware campaigns. The CVSS score is 9.0, indicating high severity with significant impact on confidentiality, integrity, and availability.
CVE-2019-9875 is a deserialization vulnerability in Sitecore CMS and Experience Platform (XP) within the Sitecore.Security.AntiCSRF module. It allows an authenticated attacker to execute arbitrary code by sending a malicious serialized .NET object in the HTTP POST parameter __CSRFTOKEN. This vulnerability has been exploited in the wild and is considered high severity.
The reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that causes exposed secrets to be dumped into GitHub Actions Workflow Logs. This vulnerability has been exploited in the wild, posing a high risk of secret leakage during automated workflows.
CVE-2017-12637 is a directory traversal vulnerability in SAP NetWeaver Application Server Java. It allows remote attackers to read arbitrary files by exploiting a '..' (dot dot) sequence in the query string of a specific JavaScript resource. This vulnerability has been exploited in the wild and is considered high severity.
Juniper Junos OS contains an improper isolation or compartmentalization vulnerability. This vulnerability could allows a local attacker with high privileges to inject arbitrary code.
CVE-2025-26633 is a high-severity vulnerability in Microsoft Windows Management Console (MMC) that allows a local unauthorized attacker to bypass a security feature. The vulnerability involves improper neutralization, leading to potential full compromise of confidentiality, integrity, and availability. It has been exploited in the wild and is known to be used in ransomware campaigns. No specific affected versions or patch information is provided in the available data.
CVE-2025-24983 is a use-after-free vulnerability in the Microsoft Windows Win32 Kernel Subsystem that allows a local authorized attacker to elevate privileges. This vulnerability has been exploited in the wild and is rated with a high severity score of 7. The vulnerability requires high attack complexity and low privileges but no user interaction. It impacts confidentiality, integrity, and availability with high impact. No specific affected Windows versions or patch information is provided in the available data.
A heap-based buffer overflow vulnerability exists in Microsoft Windows NTFS that allows local unauthorized attackers to execute code. This vulnerability has been exploited in the wild and carries a high severity rating.
Microsoft Windows New Technology File System (NTFS) contains an insertion of sensitive Information into log file vulnerability that allows an unauthorized attacker to disclose information with a physical attack. An attacker who successfully exploited this vulnerability could potentially read portions of heap memory.