CVE-2026-25108
FileZen is affected by a high-severity OS command injection vulnerability that allows a threat actor to execute arbitrary commands on the underlying operating system.
Critical vulnerabilities, curated daily for security professionals
See how vulnerabilities affect your specific environment
CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework
Monday's vulnerability disclosures affect a broad range of enterprise and consumer products, with Ivanti Endpoint Manager, Broadcom VMware Aria Operations, and multiple Apple platforms among the most notable targets. The day's dataset includes 40 high-priority CVEs (CVSS 7.0-8.9), unchanged from the prior day, with no new critical-severity disclosures. Actively exploited vulnerabilities include CVE-2026-1603 in Ivanti EPM, CVE-2026-22719 in VMware Aria Operations, and CVE-2026-25108 in Soliton FileZen, all carrying CVSS 9.5 scores. Attack patterns span remote code execution, authentication bypass, and memory corruption flaws, with Qualcomm chipset vulnerabilities (CVE-2026-21385) extending the threat surface to mobile and embedded devices. Patch availability currently stands at 0%, requiring organizations to prioritize compensating controls and network segmentation until vendor fixes are released.
Immediate action: Prioritize network segmentation and access restrictions for Ivanti EPM, VMware Aria Operations, and Soliton FileZen deployments, as all three face active exploitation with no patches currently available. Review exposure of Qualcomm-based mobile devices and Apple platforms, and monitor vendor advisories closely for forthcoming security updates.
FileZen is affected by a high-severity OS command injection vulnerability that allows a threat actor to execute arbitrary commands on the underlying operating system.
Omnissa Workspace ONE Server-Side Request Forgery - Active in CISA KEV catalog.
Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability - Active in CISA KEV catalog.
VMware Aria Operations contains a command injection vulnerability that could allow an attacker to execute arbitrary commands on the affected system.
A memory corruption vulnerability exists in memory allocation processes when handling specific alignments, potentially leading to arbitrary code execution or system instability.
n8n Improper Control of Dynamically-Managed Code Resources Vulnerability - Active in CISA KEV catalog.
Hikvision Multiple Products Improper Authentication Vulnerability - Active in CISA KEV catalog.
Rockwell Multiple Products Insufficient Protected Credentials Vulnerability - Active in CISA KEV catalog.
Apple Multiple products Use-After-Free Vulnerability - Active in CISA KEV catalog.
Apple Multiple Products Integer Overflow or Wraparound Vulnerability - Active in CISA KEV catalog.
Apple iOS and iPadOS Use-After-Free Vulnerability - Active in CISA KEV catalog.
Google Chrome versions prior to 146 contain an out-of-bounds write vulnerability in the Skia graphics engine, which is currently being exploited in the wild.
Google Chrome versions prior to 146 feature an inappropriate implementation in the V8 JavaScript engine that is currently being exploited in the wild to achieve code execution.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themelexus Medilazar Core medilazar-core allows PHP Local File Inclusion
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemetechMount Boldman boldman allows PHP Local File Inclusion
The Formidable Forms plugin for WordPress is vulnerable to a payment integrity bypass, allowing for potential financial manipulation in forms.
Ella Core, a 5G core for private networks, contains a security vulnerability that could impact the availability or integrity of private cellular communications.
The Simply Schedule Appointments plugin for WordPress is vulnerable to unauthorized access of sensitive data due to a failure in access control.
wpDiscuz before 7
LibreChat, an open-source ChatGPT clone, contains a vulnerability that could allow for unauthorized access to application features or user data.
Authentication bypass by capture-replay vulnerability in ABB AWIN GW100 rev
In UNIX Fourth Research Edition (v4), the su command is vulnerable to a buffer overflow due to the 'password' variable having a fixed size of 100 bytes
PyJWT, a Python implementation of JSON Web Token, contains a vulnerability that could compromise token integrity or verification processes.
Missing authentication for critical function vulnerability in ABB AWIN GW100 rev
The weDevs WP ERP plugin for WordPress is vulnerable to SQL Injection, which could allow attackers to extract or modify database information.
The Ays Pro Fox LMS plugin for WordPress is vulnerable to Blind SQL Injection, allowing attackers to exfiltrate data from the database through inference.
The Collapsing Categories plugin for WordPress is vulnerable to Blind SQL Injection, which could lead to unauthorized database access and information disclosure.
The Geo to Lat (geo-to-lat) software contains a Blind SQL Injection vulnerability due to improper neutralization of special elements within SQL commands.
A Blind SQL Injection vulnerability exists in David Lingren Media Library Assistant (media-library-assistant) due to improper neutralization of special elements in SQL commands.
The levelfourdevelopment WP EasyCart (wp-easycart) software is vulnerable to Blind SQL Injection through improper neutralization of special elements used in SQL commands.
The CP Contact Form with Paypal (cp-contact-form-with-paypal) software is susceptible to Blind SQL Injection due to improper neutralization of special elements in SQL commands.
The UpsellWP (checkout-upsell-and-order-bumps) software contains a Blind SQL Injection vulnerability caused by improper neutralization of special elements within SQL commands.
Improper Control of Generation of Code ('Code Injection') vulnerability in ILLID Advanced Woo Labels advanced-woo-labels allows Remote Code Inclusion
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdevelop Booking Calendar booking allows Blind SQL Injection
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jordy Meow Meow Gallery meow-gallery allows Blind SQL Injection
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 WOLF bulk-editor allows Blind SQL Injection
HMS Networks Ewon Flexy with firmware before 15
wpDiscuz before 7
wpDiscuz before 7
The OpenClaw personal AI assistant is vulnerable to a security flaw that could allow for unauthorized interactions or data exposure.
There is a memory corruption vulnerability due to an out-of-bounds write when loading a corrupted DSB file in Digilent DASYLab
There is a memory corruption vulnerability due to an out-of-bounds read when loading a corrupted file in Digilent DASYLab
There is a memory corruption vulnerability due to an out-of-bounds read when loading a corrupted file in Digilent DASYLab
There is a memory corruption vulnerability due to an out-of-bounds write when loading a corrupted file in Digilent DASYLab
OneUptime, an observability and monitoring platform, contains a vulnerability that could allow attackers to interfere with service monitoring or access sensitive configuration data.
HMS Networks Ewon Flexy with firmware before 15
Dagu is a workflow engine with a built-in Web user interface
CairoSVG, a Python-based SVG to PDF/PNG converter, is vulnerable to a flaw that may lead to unauthorized file access or resource exhaustion during graphics processing.
A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path
Anchore Enterprise versions before 5
Use of Hard-coded Credentials vulnerability in Avantra allows Accessing Functionality Not Properly Constrained by ACLs