Actively exploited

Security update for clamav

JetBrains TeamCity — JetBrains TeamCity Deserialization of Untrusted Data Vulnerability

Langflow Unauth RCE

PTC Windchill and FlexPLM — PTC Windchill and FlexPLM Improper Input Validation Vulnerability

WebPros cPanel & WHM and WP2 (WordPress Squared) — WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

Check Point Security Gateway — Check Point Security Gateway Improper Authentication Vulnerability

Palo Alto Networks PAN-OS — Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

SolarWinds Web Help Desk — SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) — BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability

Cisco Secure Firewall Management Center (FMC) — Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data V…

SmarterTools SmarterMail — SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability

SmarterTools SmarterMail — SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability

SmarterTools SmarterMail — SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability

Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

React Server Components are Vulnerable to RCE

SonicWall SMA1000 Appliances — SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability

Oracle PeopleSoft Enterprise PeopleTools — Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability

Fortra GoAnywhere MFT — Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability

Oracle E-Business Suite — Oracle E-Business Suite Unspecified Vulnerability

Argument Injection in PHP-CGI

Microsoft Exchange Server — Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability

ConnectWise ScreenConnect — ConnectWise ScreenConnect Path Traversal Vulnerability

Security Advisory 2025-027 — Critical Vulnerabilities in Microsoft SharePoint

WatchGuard Firebox — WatchGuard Firebox Out of Bounds Write Vulnerability

SAP NetWeaver — SAP NetWeaver Unrestricted File Upload Vulnerability

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.12 security update

CrushFTP CrushFTP — CrushFTP Authentication Bypass Vulnerability

SonicWall SMA1000 Appliances — SonicWall SMA1000 Appliances Code Injection Vulnerability

CyberPersons CyberPanel — CyberPanel Incorrect Default Permissions Vulnerability

SonicWall SonicOS — SonicWall SonicOS SSLVPN Improper Authentication Vulnerability

CyberPersons CyberPanel — CyberPanel Incorrect Default Permissions Vulnerability

Security Advisory 2025-022 — Severe Vulnerabilities in Citrix Products

Cleo Multiple Products — Cleo Multiple Products Unauthenticated File Upload Vulnerability

Palo Alto Networks PAN-OS — Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability

Cleo Multiple Products — Cleo Multiple Products Unrestricted File Upload Vulnerability

Fortinet FortiOS and FortiProxy — Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

Veeam Backup & Replication — Veeam Backup and Replication Deserialization Vulnerability

Jenkins Jenkins Command Line Interface (CLI) — Jenkins Command Line Interface (CLI) Path Traversal Vulnerability

Progress WhatsUp Gold — Progress WhatsUp Gold SQL Injection Vulnerability

Array Networks AG/vxAG ArrayOS — Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability

Palo Alto Networks PAN-OS — Palo Alto Networks PAN-OS Command Injection Vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

Rejetto HTTP File Server — Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability

GitLab Community and Enterprise Editions — GitLab Community and Enterprise Editions Remote Code Execution Vulnerability

ConnectWise ScreenConnect — ConnectWise ScreenConnect Authentication Bypass Vulnerability

Atlassian Confluence Data Center and Server — Atlassian Confluence Data Center and Server Template Injection Vulnerability

Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core — Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability

Microsoft SharePoint — Microsoft SharePoint Code Injection Vulnerability

Drupal Core Remote Code Execution Vulnerability

Atlassian Confluence Data Center and Server — Atlassian Confluence Data Center and Server Improper Authorization Vulnerability