CVE-2025-11953
React Native Community CLI OS Command Injection Vulnerability - Active in CISA KEV catalog.
Critical vulnerabilities, curated daily for security professionals
See how vulnerabilities affect your specific environment
CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework
Wednesday's vulnerability disclosures include 21 critical and 79 high-priority CVEs across enterprise infrastructure, cloud platforms, and endpoint software. Critical CVEs nearly doubled from the prior day (up 91%), while high-priority disclosures rose 16%. A perfect CVSS 10.0 vulnerability in Enclave enclave-vm leads the critical findings, joined by CVE-2026-24849 (CVSS 9.9) in HP OpenEMR and four SolarWinds Serv-U flaws rated CVSS 9.1. Multiple Microsoft Windows and Office vulnerabilities are confirmed under active exploitation, along with targeted campaigns against Apple OS, Google Chromium, Roundcube Webmail, and Zimbra Collaboration Suite. No patches are currently available for the disclosed vulnerabilities, requiring defenders to prioritize compensating controls and network segmentation for affected systems.
Immediate action: Prioritize compensating controls for Microsoft Windows and Office systems, SolarWinds Serv-U, Roundcube Webmail, and Google Chromium, all of which have confirmed active exploitation with no patches currently available. Monitor vendor advisories closely for patch releases on the CVSS 10.0 Enclave VM flaw and the four SolarWinds Serv-U vulnerabilities, and restrict network exposure to affected services until fixes are issued.
React Native Community CLI OS Command Injection Vulnerability - Active in CISA KEV catalog.
SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability - Active in CISA KEV catalog.
A protection mechanism failure in the MSHTML Framework allows an unauthenticated attacker to bypass security features over a network, potentially leading to unauthorized system access.
Microsoft Windows NULL Pointer Dereference Vulnerability - Active in CISA KEV catalog.
A protection mechanism failure in the Windows Shell allows an unauthenticated attacker to bypass security features over a network connection.
Improper privilege management in Windows Remote Desktop allows an authorized attacker to elevate their privileges locally on the affected system.
A type confusion vulnerability in the Desktop Window Manager (DWM) allows an authorized local attacker to elevate their privileges to a higher level.
A security feature bypass vulnerability in Microsoft Office Word exists due to reliance on untrusted inputs, allowing an unauthorized local attacker to circumvent security protections.
A memory corruption vulnerability in Apple software was addressed through improved state management to prevent potential exploitation.
Microsoft Configuration Manager SQL Injection Vulnerability - Active in CISA KEV catalog.
Notepad++ Download of Code Without Integrity Check Vulnerability - Active in CISA KEV catalog.
Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability - Active in CISA KEV catalog.
TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type Vulnerability - Active in CISA KEV catalog.
Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability - Active in CISA KEV catalog.
Google Chrome is vulnerable to a "Use After Free" condition in its CSS engine, which could allow a remote attacker to execute arbitrary code via a crafted webpage.
GitLab Server-Side Request Forgery (SSRF) Vulnerability - Active in CISA KEV catalog.
RoundCube Webmail Deserialization of Untrusted Data Vulnerability - Active in CISA KEV catalog.
RoundCube Webmail Cross-site Scripting Vulnerability - Active in CISA KEV catalog.
FileZen is affected by a high-severity OS command injection vulnerability that allows a threat actor to execute arbitrary commands on the underlying operating system.
A security boundary escape vulnerability in the Enclave JavaScript sandbox core allows attackers to bypass restrictions and achieve remote code execution (RCE).
Ormar ORM aggregate queries lack sanitization in `min()` and `max()` methods, allowing unauthenticated attackers to inject raw SQL and extract entire database contents via subqueries.
An unauthenticated stored cross-site scripting (XSS) vulnerability in Bugsink allows attackers to execute arbitrary JavaScript in an administrator's browser, leading to account takeover.
An arbitrary file read vulnerability in OpenEMR allows any authenticated user to access sensitive files on the server filesystem via the EtherFax component.
A critical authentication bypass in FreeScout allows attackers to compute valid session tokens and take over any user account, including administrators, if the application key is exposed.
A critical attack chain involving OS command injection and privilege escalation in api-gateway-deploy allows for root-level execution and container escape.
A broken access control vulnerability in Serv-U allows domain or group administrators to escalate privileges, create system admin users, and execute arbitrary code as a privileged account.
A type confusion vulnerability in Serv-U enables authenticated administrative users to execute arbitrary native code with the privileges of the service account.
A critical type confusion vulnerability in Serv-U allows an authenticated administrative user to execute arbitrary native code, potentially compromising the host system.
An Insecure Direct Object Reference (IDOR) vulnerability in Serv-U allows authenticated administrators to execute native code as a privileged account by manipulating object identifiers.
A stored cross-site scripting (XSS) vulnerability in the RustFS Console allows attackers to steal administrator credentials and achieve full system compromise.
A command injection vulnerability in the UPnP function of the Zyxel EX3510-B0 router allows remote attackers to execute arbitrary OS commands via crafted SOAP requests.
A SQL injection vulnerability in the InSAT MasterSCADA BUK-TS web interface allows attackers to execute arbitrary commands and achieve remote code execution (RCE).
All versions of InSAT MasterSCADA BUK-TS are vulnerable to OS command injection via the MMadmServ web interface, leading to remote code execution (RCE).
A critical path traversal and extension bypass vulnerability in Flask-Reuploaded allows for arbitrary file writes and remote code execution (RCE) via Server-Side Template Injection (SSTI).
OliveTin is vulnerable to unauthenticated remote code execution (RCE) via two vectors: shell argument injection and unsafe webhook processing.
Binardat 10G08-0800GSM switches contain hard-coded administrative credentials in firmware. Knowledge of these static credentials allows an attacker to gain full administrative control of the device.
A path traversal vulnerability in Lanscope Endpoint Manager allows attackers to tamper with arbitrary files. This flaw can be leveraged to execute arbitrary code on the affected Sub-Manager Server.
Statamic CMS contains a flaw in its password reset feature that allows attackers to capture reset tokens. By knowing a user's email, an attacker can hijack the reset process and take over accounts.
Smolder versions through 1.51 use the insecure Perl rand() function for cryptographic operations. This lack of cryptographically secure entropy weakens the security of generated tokens and keys.
Binardat network switches generate predictable numeric session identifiers in their web management interface. This flaw allows attackers to guess active session IDs and hijack authenticated administrative sessions.
The Advanced Woo Labels plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2
DAG Author (who already has quite a lot of permissions) could manipulate database of Airflow 2 in the way to execute arbitrary code in the web-server context, which they should normally not be able to do, leading to potentially remote code execution in the context of web-server (server-side) as a result of a user viewing historical task information
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework
A security flaw in ImageMagick, a popular image manipulation software, allows for potential exploitation during the processing of digital images.
The WPGSI: Spreadsheet Integration plugin for WordPress is vulnerable to unauthorized modification and loss of data due to missing capability checks and an insecure authentication mechanism on the `wpgsi_callBackFuncAccept` and `wpgsi_callBackFuncUpdate` REST API functions in all versions up to, and including, 3
The Geo Mashup plugin for WordPress is vulnerable to SQL Injection via the 'sort' parameter in all versions up to, and including, 1
The Responsive Lightbox & Gallery WordPress plugin before 2
Use-after-free in the DOM: Core & HTML component
Valkey is a distributed key-value database
Dell Wyse Management Suite, versions prior to WMS 5
OpenEMR is a free and open source electronic health records and medical practice management application
Improper validation of user-supplied input in the ZIA Admin UI could allow an authenticated administrator to initiate backend functions through specific input fields in limited scenarios
A vulnerability in the Valkey distributed key-value database could allow attackers to compromise database operations or data integrity.
A security issue in the Valkey key-value database management system may lead to unauthorized exploitation of database functions or service disruption.
Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior use RC4 with a hard-coded key embedded in client-side JavaScript
Improper certificate validation (CWE-295) in JXcore JXM master allows for potential Man-in-the-Middle (MitM) attacks and data interception.
A vulnerability was determined in SourceCodester Student Result Management System 1
Dell Repository Manager (DRM), versions prior to 3
A vulnerability has been found in itsourcecode Document Management System 1
Dell Wyse Management Suite, versions prior to WMS 5
A vulnerability was detected in itsourcecode Event Management System 1
A security vulnerability has been detected in itsourcecode E-Logbook with Health Monitoring System for COVID-19 1
A weakness has been identified in itsourcecode Document Management System 1
A security vulnerability has been detected in itsourcecode Document Management System 1
A security flaw has been discovered in itsourcecode News Portal Project 1
A weakness has been identified in itsourcecode News Portal Project 1
A vulnerability was determined in SourceCodester Simple and Nice Shopping Cart Script 1
A vulnerability was detected in itsourcecode College Management System 1
A flaw has been found in itsourcecode College Management System 1
A vulnerability has been found in itsourcecode Document Management System 1
A vulnerability was found in itsourcecode News Portal Project 1
A vulnerability has been found in Tenda AC8 16
A post-authentication command injection vulnerability in the log file download function of the Zyxel EX3301-T0 firmware versions through 5
A vulnerability was determined in Tenda F453 1
A vulnerability was identified in Tenda F453 1
A security flaw has been discovered in Tenda F453 1
A weakness has been identified in Tenda F453 1
A security vulnerability has been detected in Tenda F453 1
SummaryThis advisory addresses a SQL injection vulnerability in the API endpoint used for retrieving contact activities
NVIDIA Cumulus Linux and NVOS products contain a vulnerability in the NVUE interface, where a low-privileged user could run an unauthorized command
NVIDIA Cumulus Linux and NVOS products contain a vulnerability in the NVUE interface, where a low-privileged user could inject a command
Tenda FH1203 V2
NVIDIA Cumulus Linux and NVOS products contain a vulnerability in the NVUE interface, where a low-privileged user could inject a command
A post-authentication command injection vulnerability in the TR-369 certificate download CGI program of the Zyxel VMG3625-T50B firmware versions through 5
A vulnerability in the New API large language model (LLM) gateway and AI asset management system could allow for unauthorized access or manipulation of AI resources.
A privilege escalation (PE) vulnerability in the Tencent iOA app thru 210
A privilege escalation (PE) vulnerability in the Tencent PC Manager app thru 17
A vulnerability was determined in UTT HiPER 810G up to 1
A vulnerability was identified in UTT HiPER 810G up to 1
yt-dlp is a command-line audio/video downloader
Use-after-free in the Storage: IndexedDB component
MindsDB is a platform for building artificial intelligence from enterprise data
Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior contain a command injection vulnerability in the traceroute diagnostic function of the affected device web management interface
Versions of the Traccar open-source GPS tracking system starting with 6
OpenEMR is a free and open source electronic health records and medical practice management application
ImageMagick is free and open-source software used for editing and manipulating digital images
changedetection
ImageMagick is free and open-source software used for editing and manipulating digital images
Karakeep is a elf-hostable bookmark-everything app
Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior expose user passwords in plaintext within the administrative interface and HTTP responses, allowing recovery of valid credentials
OpenEMR is a free and open source electronic health records and medical practice management application
RustFS is a distributed object storage system built in Rust
TOTOLink X5000R v9
When the "Silent Just-In-Time Provisioning" feature is enabled for a federated identity provider (IDP) there is a risk that a local user store user's information may be replaced during the account provisioning process in cases where federated users share the same username as local users
ImageMagick is free and open-source software used for editing and manipulating digital images
ImageMagick is free and open-source software used for editing and manipulating digital images
ImageMagick is free and open-source software used for editing and manipulating digital images
Binardat 10G08-0800GSM network switch firmware versions prior to V300SP10260209 store a user password in a client-side cookie as a Base64-encoded value accessible via the web interface
Fiber is an Express inspired web framework written in Go
ImageMagick is free and open-source software used for editing and manipulating digital images
ImageMagick is free and open-source software used for editing and manipulating digital images
libtiff up to v4
A flaw has been found in ShuoRen Smart Heating Integrated Management Platform 1
A vulnerability has been found in erzhongxmu JEEWMS 3
Versions of the Traccar open-source GPS tracking system up to and including 6
A vulnerability was determined in DataLinkDC dinky up to 1
A flaw was found in the 389-ds-base server
Coturn is a free open source implementation of TURN and STUN Server
Versions of the Traccar open-source GPS tracking system up to and including 6