CVE Vulnerability Catalog

Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.

A path traversal vulnerability in Fortinet FortiMail (versions 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, 7.2.0-7.2.9) stems from improper limitation of a pathname to a restricted directory. An unauthenticated attacker can write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.

All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root.

A session hijack vulnerability in Zammad versions 6.3.0 to 6.5.4 leads to remote code execution as the zammad user. The bug is also present in versions 7.0.0 to 7.1.2, but not exploitable due to framework changes.

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access the system with admin privileges. The issue is due to improper handling of URI encoding in HTTP requests, allowing bypass of an authentication rule for a specific API endpoint. An attacker can send a crafted HTTP request to gain admin access.

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.

Vulnerability in Citrix NetScaler ADC and Gateway leading to Remote Code Execution or Denial of Service.

Improper input validation in Citrix NetScaler ADC and Gateway allows an unauthenticated attacker to execute arbitrary commands.

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions are met, this can lead to remote code execution.

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specially crafted traffic can lead to remote code execution (RCE). The vulnerability exists only when BIG-IP APM is configured as an OAuth Authorization Server; deployments using APM strictly as an OAuth Client/Resource Server are not affected.

A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on the Check Point Management Server.

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.

The vulnerability is a local privilege escalation due to insecure file permissions. It affects Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, and Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.

A vulnerability in the API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This is due to insufficient authentication control on an API endpoint. An attacker could send a crafted request to gain unauthorized access to the device by bypassing the web-based management interface.

In the Cellular Modem, a logic error allows permission bypass. This may lead to remote (proximal/adjacent) privilege escalation with no user interaction or additional execution privileges required.

A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway is due to insufficient validation in the parsing logic. An unauthenticated remote attacker could send a crafted email containing malicious SQL statements, potentially leading to execution of arbitrary SQL statements and command execution with root privileges on the underlying operating system.

GitLab CE/EE contains a vulnerability in the repository commits API caused by improper path confinement and missing authentication enforcement. Under certain conditions, an unauthenticated user could read arbitrary files from the GitLab server.

Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.

Out-of-bounds write vulnerability in V8 in Google Chrome prior to 153.0.8010.36. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page.

A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.