A V8 engine flaw lets a malicious web page run code inside Chrome’s sandbox with no login or download needed, and it’s already being exploited in the wild.
Every CISA KEV addition, plus critical-severity flaws in the kit that sits at the edge of a network: firewalls, VPN gateways, load balancers, routers, switches and management consoles.
Colour on the left of each entry is the CVSS severity. A pink CISA KEV badge means the flaw is being exploited right now — treat those first, whatever the score says. How each post is sourced and checked is set out in the methodology.
Improper Authentication of FortiPAM Server
A Chrome extension that mediates FortiPAM privileged access sessions can be tricked into routing a user’s browser traffic through an attacker’s servers just by visiting a malicious site.
Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
A server-side template injection in Adobe Commerce and Magento lets an unauthenticated attacker get crafted input evaluated by the template engine, leading to full code execution on the store.
Microsoft Windows Heap-Based Buffer Overflow Vulnerability
A heap overflow in Windows ALPC lets a local attacker with basic access escalate to SYSTEM privileges, and it’s already being exploited in the wild.
Microsoft Windows Link Following Vulnerability
A local privilege escalation bug in the Windows Update Stack lets a logged-in low-privilege user redirect a file operation via a symbolic link to gain full SYSTEM control, and it’s already being exploited.
N-able N-central Static Code Injection Vulnerability
N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution.
Microsoft Entra ID Deserialization of Untrusted Data Vulnerability
A maximum-severity flaw in Microsoft Entra ID lets an attacker execute code over the network with no credentials or user interaction, and it is already being exploited.
Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
An unauthenticated attacker can send crafted SMTP requests to Zimbra servers running the optional zimbra-snmp package with notifications enabled, triggering OS command execution as the Zimbra user.
TrueConf Server Code Injection Vulnerability
An unauthenticated attacker reaching port 4307/TCP on TrueConf Server can escape a sandboxed script environment and run arbitrary code on the underlying host, and the flaw is already being exploited.
TrueConf Server Missing Authentication for Critical Function Vulnerability
An unauthenticated attacker who can reach port 4307/TCP on a TrueConf Server can trigger an undocumented function to run arbitrary scripts, with no login or user action required.