CVE-2026-25108
FileZen is affected by a high-severity OS command injection vulnerability that allows a threat actor to execute arbitrary commands on the underlying operating system.
Critical vulnerabilities, curated daily for security professionals
See how vulnerabilities affect your specific environment
CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework
Sunday's disclosures highlight 13 actively exploited vulnerabilities affecting enterprise infrastructure from Ivanti, Broadcom VMware, Qualcomm, and Apple. No new critical-severity CVEs were published, a sharp drop from Saturday's 9, while 40 high-priority vulnerabilities were disclosed, down 60% from the prior day's 100. Notably, CVE-2026-1603 targets Ivanti Endpoint Manager, CVE-2026-22719 affects VMware Aria Operations, and CVE-2026-25108 impacts Soliton FileZen, all carrying CVSS 9.5 scores under active exploitation. Attack patterns include remote code execution and authentication bypass across endpoint management platforms, network appliances, and mobile chipsets. No patches are currently available for Sunday's disclosures, requiring defenders to apply compensating controls and monitor vendor advisories closely.
Immediate action: Prioritize reviewing exposure to Ivanti Endpoint Manager, VMware Aria Operations, Soliton FileZen, and Apple products, as all have confirmed active exploitation at CVSS 9.5. With no patches currently available, apply network segmentation, restrict administrative access, and monitor vendor channels for emergency updates.
FileZen is affected by a high-severity OS command injection vulnerability that allows a threat actor to execute arbitrary commands on the underlying operating system.
Omnissa Workspace ONE Server-Side Request Forgery - Active in CISA KEV catalog.
Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability - Active in CISA KEV catalog.
VMware Aria Operations contains a command injection vulnerability that could allow an attacker to execute arbitrary commands on the affected system.
A memory corruption vulnerability exists in memory allocation processes when handling specific alignments, potentially leading to arbitrary code execution or system instability.
n8n Improper Control of Dynamically-Managed Code Resources Vulnerability - Active in CISA KEV catalog.
Hikvision Multiple Products Improper Authentication Vulnerability - Active in CISA KEV catalog.
Rockwell Multiple Products Insufficient Protected Credentials Vulnerability - Active in CISA KEV catalog.
Apple Multiple products Use-After-Free Vulnerability - Active in CISA KEV catalog.
Apple Multiple Products Integer Overflow or Wraparound Vulnerability - Active in CISA KEV catalog.
Apple iOS and iPadOS Use-After-Free Vulnerability - Active in CISA KEV catalog.
Google Chrome versions prior to 146 contain an out-of-bounds write vulnerability in the Skia graphics engine, which is currently being exploited in the wild.
Google Chrome versions prior to 146 feature an inappropriate implementation in the V8 JavaScript engine that is currently being exploited in the wild to achieve code execution.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themelexus Medilazar Core medilazar-core allows PHP Local File Inclusion
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemetechMount Boldman boldman allows PHP Local File Inclusion
The Formidable Forms plugin for WordPress is vulnerable to a payment integrity bypass, allowing for potential financial manipulation in forms.
Ella Core, a 5G core for private networks, contains a security vulnerability that could impact the availability or integrity of private cellular communications.
The Simply Schedule Appointments plugin for WordPress is vulnerable to unauthorized access of sensitive data due to a failure in access control.
wpDiscuz before 7
LibreChat, an open-source ChatGPT clone, contains a vulnerability that could allow for unauthorized access to application features or user data.
Authentication bypass by capture-replay vulnerability in ABB AWIN GW100 rev
In UNIX Fourth Research Edition (v4), the su command is vulnerable to a buffer overflow due to the 'password' variable having a fixed size of 100 bytes
PyJWT, a Python implementation of JSON Web Token, contains a vulnerability that could compromise token integrity or verification processes.
Missing authentication for critical function vulnerability in ABB AWIN GW100 rev
The weDevs WP ERP plugin for WordPress is vulnerable to SQL Injection, which could allow attackers to extract or modify database information.
The Ays Pro Fox LMS plugin for WordPress is vulnerable to Blind SQL Injection, allowing attackers to exfiltrate data from the database through inference.
The Collapsing Categories plugin for WordPress is vulnerable to Blind SQL Injection, which could lead to unauthorized database access and information disclosure.
The Geo to Lat (geo-to-lat) software contains a Blind SQL Injection vulnerability due to improper neutralization of special elements within SQL commands.
A Blind SQL Injection vulnerability exists in David Lingren Media Library Assistant (media-library-assistant) due to improper neutralization of special elements in SQL commands.
The levelfourdevelopment WP EasyCart (wp-easycart) software is vulnerable to Blind SQL Injection through improper neutralization of special elements used in SQL commands.
The CP Contact Form with Paypal (cp-contact-form-with-paypal) software is susceptible to Blind SQL Injection due to improper neutralization of special elements in SQL commands.
The UpsellWP (checkout-upsell-and-order-bumps) software contains a Blind SQL Injection vulnerability caused by improper neutralization of special elements within SQL commands.
Improper Control of Generation of Code ('Code Injection') vulnerability in ILLID Advanced Woo Labels advanced-woo-labels allows Remote Code Inclusion
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdevelop Booking Calendar booking allows Blind SQL Injection
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jordy Meow Meow Gallery meow-gallery allows Blind SQL Injection
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 WOLF bulk-editor allows Blind SQL Injection
HMS Networks Ewon Flexy with firmware before 15
wpDiscuz before 7
wpDiscuz before 7
The OpenClaw personal AI assistant is vulnerable to a security flaw that could allow for unauthorized interactions or data exposure.
There is a memory corruption vulnerability due to an out-of-bounds write when loading a corrupted DSB file in Digilent DASYLab
There is a memory corruption vulnerability due to an out-of-bounds read when loading a corrupted file in Digilent DASYLab
There is a memory corruption vulnerability due to an out-of-bounds read when loading a corrupted file in Digilent DASYLab
There is a memory corruption vulnerability due to an out-of-bounds write when loading a corrupted file in Digilent DASYLab
OneUptime, an observability and monitoring platform, contains a vulnerability that could allow attackers to interfere with service monitoring or access sensitive configuration data.
HMS Networks Ewon Flexy with firmware before 15
Dagu is a workflow engine with a built-in Web user interface
CairoSVG, a Python-based SVG to PDF/PNG converter, is vulnerable to a flaw that may lead to unauthorized file access or resource exhaustion during graphics processing.
A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path
Anchore Enterprise versions before 5
Use of Hard-coded Credentials vulnerability in Avantra allows Accessing Functionality Not Properly Constrained by ACLs