Active threats. Real guidance.
Updated 3× daily.

An unauthenticated SQL injection vulnerability exists in FortiClientEMS, allowing remote attackers to execute arbitrary code or access sensitive information. This flaw has been actively exploited in the wild.

This critical out-of-bounds write vulnerability in the DCERPC protocol implementation allows for remote code execution. It has been observed being exploited in the wild by sophisticated threat actors.

This critical RCE vulnerability allows an unauthenticated attacker to execute arbitrary shell commands via deserialization of untrusted data. It has been widely exploited by ransomware groups.

A heap-based buffer overflow vulnerability in FortiGate SSL-VPN allows a remote, unauthenticated attacker to execute arbitrary code. This vulnerability is actively exploited in the wild.

A critical remote code execution vulnerability affects Atlassian Confluence Data Center and Server. This flaw allows unauthenticated attackers to create a new administrator account and gain full control of the instance.

A critical remote code execution vulnerability exists in PaperCut MF and NG. This flaw allows an unauthenticated attacker to bypass authentication and execute arbitrary code on the server.

A critical authentication bypass vulnerability in Cisco IOS XE Software's web UI allows an unauthenticated attacker to create an account with administrative privileges. This account can then be used to gain full control of the device.

A critical remote code execution vulnerability in Cisco IOS XE Software's web UI allows an authenticated attacker to execute arbitrary commands. This flaw is often chained with CVE-2023-20198 for unauthenticated RCE.

A command injection vulnerability exists in Ivanti Connect Secure and Policy Secure gateways. This allows an authenticated administrator to execute arbitrary commands on the appliance.

This post-authentication command injection vulnerability allows an authenticated administrator to execute arbitrary commands. It is often chained with CVE-2024-21887 for unauthenticated RCE.

This out-of-bounds write vulnerability in FortiOS SSL-VPN allows an unauthenticated attacker to achieve remote code execution. It is actively exploited in the wild, posing a significant threat to affected organizations.