CVE Vulnerability Catalog

FreePBX, an open-source graphical user interface, has vulnerabilities in versions 15, 16, and 17 due to insufficiently sanitized user-supplied data. This allows unauthenticated access to the FreePBX Administrator, leading to arbitrary database manipulation and remote code execution.

Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server, or in specific LB and CR virtual server configurations with IPv6 services.

Wykryto problem z zapisem poza dozwolonym zakresem, który został rozwiązany poprzez poprawę sprawdzania granic. Problem ten został naprawiony w kilku wersjach systemów iOS, iPadOS oraz macOS. Przetwarzanie złośliwego pliku graficznego może prowadzić do uszkodzenia pamięci.

Improper Input Validation vulnerability in N-able N-central allows OS Command Injection. This issue affects N-central before 2025.3.1.

Deserialization of untrusted data vulnerability in N-able N-central allows local code execution. Affects versions before 2025.3.1.

WinRAR for Windows has a path traversal vulnerability that allows attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild.

Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code without user interaction.

A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.

A missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to gain privileged access to the application.

An improper control of code generation (code injection) vulnerability in DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to execute arbitrary code.

A vulnerability in WebKit allows memory corruption when processing maliciously crafted web content. The issue was fixed by improving memory handling in Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS.

A race condition was found in the Linux kernel between handle_posix_cpu_timers() and posix_cpu_timer_del(). An exiting non-autoreaping task can be reaped by its parent after unlock_task_sighand(), causing synchronization issues.

Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware of an exploit in the wild and is preparing an update.

eslint-config-prettier versions 8.10.1, 9.1.1, 10.1.6, and 10.1.7 contain embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.

CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.

Livewire to pełnostackowy framework dla Laravel. W wersjach Livewire v3 do v3.6.3 występuje podatność, która pozwala nieautoryzowanym atakującym na zdalne wykonanie poleceń w określonych scenariuszach, związana z aktualizacjami właściwości komponentów.

W Fortinet FortiWeb w wersjach od 7.0.0 do 7.6.3 występuje podatność na wstrzykiwanie SQL (SQL Injection), która pozwala nieautoryzowanemu atakującemu na wykonanie nieautoryzowanego kodu SQL lub poleceń poprzez odpowiednio skonstruowane żądania HTTP lub HTTPS.

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input.

Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.