Documented vulnerability advisories
Every entry documented: technical breakdown, impact, mitigation and detection, with severity, CVSS and exploitation status at a glance.
124 advisories
Oracle E-Business Suite, unauthenticated remote code execution (Cl0p EBS campaign)
An easily exploitable vulnerability in the BI Publisher Integration component of Oracle Concurrent Processing (part of Oracle E-Business Suite) lets an unauthenticated attacker with HTTP network access compromise the product, resulting in takeover and remote code execution. It was exploited as a zero-day by the Cl0p extortion group for large-scale data theft.
VMware Aria Operations and VMware Tools, local privilege escalation
VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges on a VM that has VMware Tools installed and is managed by Aria Operations with SDMP enabled can exploit it to escalate to root on that VM. Broadcom confirmed exploitation in the wild as a zero-day, and CISA added the CVE to the Known Exploited Vulnerabilities catalog.
Cisco Secure Firewall ASA and FTD, VPN web server authentication bypass / missing authorization (ASA/FTD WebVPN)
A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to access restricted URL endpoints that are related to remote access VPN that should otherwise require authentication. The flaw is due to improper validation of user-supplied input in HTTP(S) requests. A later attack variant can also cause affected devices to reload unexpectedly, resulting in a denial-of-service condition.
Cisco Secure Firewall ASA & FTD, VPN web server buffer overflow RCE (ArcaneDoor)
A buffer overflow in the VPN web server of Cisco Secure Firewall ASA and FTD Software, caused by improper validation of user-supplied input in HTTP(S) requests, lets an authenticated remote attacker with valid VPN credentials execute arbitrary code as root. Chained with the authentication-bypass flaw CVE-2025-20362, it enables full unauthenticated device compromise and was exploited as a zero-day by a state-sponsored actor.
Cisco IOS and IOS XE Software, SNMP stack-based buffer overflow
A stack-based buffer overflow in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software allows an authenticated, remote attacker to cause a denial of service or execute arbitrary code on an affected device. A low-privileged attacker with a valid SNMP read-only community string (SNMPv1/v2c) or SNMPv3 credentials can crash the device and force a reload, while an attacker who additionally holds administrative or privilege 15 credentials can execute code as the root user on IOS XE. The flaw is triggered by sending crafted SNMP packets to an affected system over IPv4 or IPv6 and affects all SNMP versions when SNMP is enabled.
Google Chrome V8, type confusion leading to heap corruption (zero-day)
Type confusion in the V8 JavaScript and WebAssembly engine in Google Chrome prior to 140.0.7339.185 allows a remote attacker to exploit heap corruption via a crafted HTML page. Google's Threat Analysis Group reported the flaw and Google shipped an emergency Stable channel update after confirming an exploit exists in the wild.
Fortra GoAnywhere MFT, deserialization RCE (License Servlet)
A deserialization vulnerability in the License Servlet of Fortra GoAnywhere MFT allows an attacker who can present a forged, validly-signed license response to deserialize an arbitrary attacker-controlled object, leading to command injection and unauthenticated remote code execution. It was exploited in the wild as a zero-day, including Medusa ransomware deployment.
Samsung Mobile libimagecodec Out-of-Bounds Write (LANDFALL Spyware)
An out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitrary code on Samsung mobile devices. The flaw resides in the closed-source Quram image-decoding library used by Samsung Galaxy devices and is reachable by processing a maliciously crafted image. It was abused as a zero-day in the LANDFALL commercial-grade Android spyware campaign, in which booby-trapped DNG image files were delivered via messaging apps.
Adobe Commerce / Magento, improper input validation session takeover (SessionReaper)
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an improper input validation vulnerability. A successful attacker can abuse this to achieve session takeover, raising the confidentiality and integrity impact to high. Exploitation does not require user interaction, and researchers have described an unauthenticated path to remote code execution via the Commerce REST API.
Citrix NetScaler ADC and Gateway, unauthenticated memory-overflow remote code execution
A memory overflow vulnerability in Citrix NetScaler ADC and NetScaler Gateway allows a remote, unauthenticated attacker to execute arbitrary code or trigger a denial-of-service condition when the appliance is configured as a Gateway (VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server, or in certain IPv6 load-balancing and HDX content-routing configurations. The flaw requires no authentication and no user interaction. Citrix confirmed exploitation against unmitigated appliances at the time of disclosure.
Apple iOS/iPadOS/macOS Image I/O, out-of-bounds write zero-day
An out-of-bounds write in the Image I/O framework of Apple iOS, iPadOS, and macOS lets a maliciously crafted image file cause memory corruption when processed. Apple addressed it with improved bounds checking and stated it may have been exploited in an extremely sophisticated attack against specific targeted individuals.
N-able N-central, OS command injection via improper input validation (N-central Command Injection)
An improper input validation vulnerability in N-able N-central allows OS command injection. The flaw is due to improper sanitization of user-supplied input, which permits an authenticated attacker to inject and execute arbitrary operating system commands on the underlying host. N-able observed evidence of exploitation in a limited number of on-premises environments, and the vulnerability has been actively exploited in the wild.
WinRAR, NTFS ADS path-traversal arbitrary code execution (WinRAR zero-day)
A path traversal vulnerability affecting the Windows version of WinRAR allows attackers to execute arbitrary code by crafting malicious archive files. By abusing NTFS alternate data streams and directory-traversal sequences in archive entry paths, a specially crafted RAR archive can write files to attacker-chosen locations such as the Windows Startup folder when the archive is extracted, leading to code execution. The vulnerability was exploited in the wild as a zero-day and was discovered by Anton Cherepanov, Peter Kosinar, and Peter Strycek from ESET.
Microsoft SharePoint Server, deserialization of untrusted data RCE (ToolShell)
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthenticated attacker to execute arbitrary code over the network. The flaw is a patch bypass of CVE-2025-49704/49706 that lets attackers steal the server ASP.NET MachineKey and forge __VIEWSTATE payloads for persistent remote code execution and full content access. Microsoft confirmed active in-the-wild exploitation prior to the fix.
CrushFTP, authentication bypass via AS2 validation (admin-access zero-day)
CrushFTP mishandles AS2 validation when the DMZ proxy feature is not in use, allowing a remote unauthenticated attacker to obtain administrative access over HTTPS. The vulnerability was exploited in the wild as a zero-day beginning in July 2025, giving attackers admin control of unpatched servers.
Fortinet FortiWeb, unauthenticated SQL injection leading to remote code execution
An improper neutralization of special elements used in an SQL command (SQL injection) vulnerability in Fortinet FortiWeb allows a remote, unauthenticated attacker to execute unauthorized SQL commands via crafted HTTP or HTTPS requests. The injection point is reachable pre-authentication and has been demonstrated to escalate to remote code execution. Public proof-of-concept exploits are available and CISA has confirmed active exploitation.
Cisco Identity Services Engine, unauthenticated remote code execution
A vulnerability in a specific API of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this by submitting a crafted API request, and a successful exploit grants the attacker root privileges on the affected device.
Microsoft SharePoint Server, server-side code injection RCE (ToolShell)
A code injection vulnerability in Microsoft Office SharePoint Server allows an authorized attacker to execute arbitrary code over a network. The flaw is due to improper control of generation of code in on-premises SharePoint Server. Chained with the CVE-2025-49706 spoofing vulnerability, it forms the ToolShell exploit chain that enables unauthenticated remote code execution against internet-facing SharePoint servers, and it has been actively exploited in the wild.
Google Chrome V8 Type Confusion (Arbitrary Read/Write Zero-Day)
Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. By coercing the V8 JavaScript and WebAssembly engine into treating an object as a type it is not, an attacker who lures a victim to a malicious page can gain a powerful memory read/write primitive inside the renderer. Google has confirmed that an exploit for CVE-2025-6554 exists in the wild.
Citrix NetScaler ADC & Gateway, out-of-bounds memory read (CitrixBleed 2)
Insufficient input validation in Citrix NetScaler ADC and Gateway causes a memory over-read when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server. An unauthenticated remote attacker can send crafted requests that leak uninitialized memory in the response, frequently exposing valid session tokens and enabling session hijacking and multi-factor authentication bypass.