Vulnerability
The Prime Mover backup and migration plugin for WordPress contains an unsafe deserialization flaw in its search-and-replace routine that accepts untrusted, base64-encoded serialized objects from comment fields. An attacker can inject a malicious object that exploits a Property-Oriented Pro
Vulnerability
Multiple PHP versions contain a use-after-free vulnerability triggered by out-of-memory errors that leave request memory uninitialized, enabling remote code execution. This flaw affects PHP 7.3, 8.2, 8.3, 8.4, and 8.5 across all deployments.
Vulnerability
Collabora Online Built-in CODE Server before version 26.4.303 is vulnerable to OS command injection in proxy.php when the CODE server is not running, allowing unauthenticated remote code execution. This flaw is actively exploited in production environments.
Vulnerability
An authenticated user can exploit SQL injection in VeloCloud Orchestrator to gain operator-level privileges and access internal functionality. This flaw is actively exploited and affects on-premises deployments across multiple versions.
Vulnerability
E-guardian SiteGuard Server Edition versions 2.20 through 8.00 contain an OS command injection vulnerability (CWE-78) exploitable by local users with low privileges. Attackers can execute arbitrary commands with root or SYSTEM level access, fully compromising the host system.
Vulnerability
Plex Media Server before version 1.43.3.10861 contains four distinct actively exploited vulnerabilities including arbitrary file write (CWE-73), server-side request forgery via two endpoints (CWE-918), and URL-scheme mishandling (CWE-84). Together, these allow admin users to achieve code e
Vulnerability
Siemens Software Center before version 4.0.9.8 searches for dynamic-link libraries (DLLs) in uncontrolled paths, allowing an authenticated local attacker to plant a malicious DLL and achieve code execution with the application's privileges. This is actively exploited.
Vulnerability
Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 contain an easily exploitable vulnerability in the Authentication Engine component that allows unauthenticated network attackers to gain full control. This is a CVSS 10.0 flaw with scope change affecting the entire platform.
Vulnerability
E-guardian SiteGuard Server Edition versions 2.20 through 8.00 contain an OS command injection flaw that allows a local attacker with low privileges to execute arbitrary commands as root or SYSTEM. This is actively exploited and requires immediate patching per CISA BOD 26-04 guidance.
Vulnerability
Plex Media Server before version 1.43.3.10861 contains four actively exploited vulnerabilities including arbitrary file execution, SSRF, URL manipulation, and plugin parameter injection. Together these flaws allow remote attackers to compromise the server and internal networks.
Vulnerability
Siemens Software Center versions before 4.0.9.8 load dynamic libraries from an uncontrolled search path, allowing an authenticated local attacker with high privileges to place a malicious DLL and achieve code execution. This is actively exploited.
Vulnerability
Two critical vulnerabilities in PHP's out-of-memory handling and global state management leave freed request memory accessible to subsequent requests, allowing remote code execution without authentication or user interaction. All supported PHP versions 8.2 through 8.5 are affected.