Active threats. Real guidance.
Updated 3× daily.

These vulnerabilities allow an unauthenticated attacker to bypass authentication and execute arbitrary commands. They are frequently chained together for full compromise of Ivanti gateways.

An authentication bypass vulnerability in Ivanti Connect Secure allows an unauthenticated attacker to access restricted resources. This flaw can be chained with other vulnerabilities for full compromise.

A critical OS command injection vulnerability in the GlobalProtect gateway allows an unauthenticated attacker to execute arbitrary commands. This flaw impacts specific PAN-OS versions and can lead to full system compromise.

A critical information disclosure vulnerability, dubbed 'Citrix Bleed,' allows unauthenticated attackers to steal sensitive session tokens. This enables session hijacking and bypasses multi-factor authentication.

A critical remote code execution vulnerability exists in Microsoft SharePoint Server. An authenticated attacker can exploit this flaw to execute arbitrary code with elevated privileges.

A critical authentication bypass vulnerability in Cisco ASA and FTD software allows an unauthenticated, remote attacker to establish a VPN session. This bypasses authentication and grants unauthorized access.

A command injection vulnerability in the GlobalProtect Gateway feature allows unauthenticated attackers to execute arbitrary code with root privileges. This flaw impacts specific PAN-OS versions with GlobalProtect Gateway and device telemetry enabled.

A remote code execution vulnerability exists in Microsoft Windows MSHTML. Attackers can exploit this by tricking users into opening a specially crafted malicious document.

An authentication bypass vulnerability allows unauthenticated attackers to access restricted resources. This critical flaw impacts Ivanti Connect Secure and Policy Secure Gateways.

A critical deserialization vulnerability in Progress WS_FTP Server allows an unauthenticated attacker to achieve remote code execution. This flaw affects the Ad Hoc Transfer module and is actively exploited in the wild.

An unauthenticated SQL injection vulnerability exists in FortiClientEMS. It allows remote attackers to execute arbitrary code or commands on the underlying system.

A critical remote code execution vulnerability exists in Ivanti Connect Secure and Policy Secure gateways. This flaw allows an unauthenticated attacker to execute arbitrary commands on the appliance, leading to full system compromise.