📝 A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered byAnton Cherepanov, Peter Koinr, and Peter Strek from ESET.

📅 Published: 08/08/2025

📈 CVSS: 8.4

🛡️ CISA KEV: True

🧭 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

📣 Mentions: 23

⚠️ Priority: 1+

📝 Analysis: A path traversal vulnerability in Windows WinRAR allows attackers to execute arbitrary code via malicious archive files. This vulnerability has been exploited in the wild and was discovered by ESET researchers. Given its high CVSS score and prior activity, it is a priority 2 issue.

📝 A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.

📅 Published: 14/11/2025

📈 CVSS: 9.1

🛡️ CISA KEV: True

🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

📣 Mentions: 22

⚠️ Priority: 1+

📝 Analysis: A relative path traversal vulnerability exists in Fortinet FortiWeb versions 8.0.0 to 8.0.1, and others, allowing remote attackers to execute administrative commands via crafted HTTP/HTTPS requests. Confirmed exploited by attackers, this is a priority 1+ issue.

📝 An Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) vulnerability [CWE-78] in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.

📅 Published: 18/11/2025

📈 CVSS: 6.7

🛡️ CISA KEV: True

🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

📣 Mentions: 26

⚠️ Priority: 1+

📝 Analysis: An OS Command Injection vulnerability (CWE-78) in Fortinet FortiWeb versions 7.0.0 through 8.0.1 allows authenticated attackers to execute unauthorized code via crafted HTTP requests or CLI commands, with known in-the-wild activity as confirmed by CISA. This is a priority 1+ vulnerability due to confirmed exploitation.

📝 Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10.

@fs

denies access to files outside of Vite serving allow list. Adding

?raw??

or

?import&raw??

to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as

?

are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using

--host

or

server.host

config option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue.

📅 Published: 24/03/2025

📈 CVSS: 5.3

🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

📣 Mentions: 22

⚠️ Priority: 4

📝 Analysis: A file disclosure vulnerability exists in Vite versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 due to a URL manipulation bypass. Only apps exposing the Vite dev server are affected. No known in-the-wild activity reported; priority level is 4 according to CISA KEV and EPSS scoring.

📝 NSecsoft NSecKrnl is a Windows driver that allows a local, authenticated attacker to terminate processes owned by other users, including SYSTEM and Protected Processes by issuing crafted IOCTL requests to the driver.

📅 Published: 13/01/2026

📈 CVSS: 4.7

🧭 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

📣 Mentions: 3

⚠️ Priority: 4

📝 Analysis: A local authenticated attacker can terminate processes owned by other users, including SYSTEM and Protected Processes on Windows systems, using crafted IOCTL requests to the NSecKrnl driver. No known exploits have been detected in the wild. This vulnerability is categorized as a priority 4 issue due to its low CVSS score and lack of confirmed exploitation.

📝 Planting a custom configuration file in ESET Inspect Connectorallowload a malicious DLL.

📅 Published: 30/01/2026

📈 CVSS: 8.4

🧭 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

📣 Mentions: 3

⚠️ Priority: 2

📝 Analysis: A custom configuration file planting enables malicious DLL loading in ESET Inspect Connector. No exploits found in-the-wild, but priority 2 due to high CVSS score and low Exploitability Scoring System (EPSS) value.

📝 Rocket TRUfusion Enterprise through 7.10.5 exposes the endpoint at /axis2/services/WsPortalV6UpDwAxis2Impl to authenticated users to be able to upload files. However, the application doesnt properly sanitize the jobDirectory parameter, which allows path traversal sequences to be included. This allows writing files to arbitrary local filesystem locations and may subsequently lead to remote code execution.

📅 Published: 17/02/2026

📈 CVSS: 0

🧭 Vector: n/a

📣 Mentions: 2

⚠️ Priority: 4

📝 Analysis: Path traversal vulnerability found in Rocket TRUfusion Enterprise versions up to 7.10.5. Unsanitized jobDirectory parameter enables writing files to arbitrary local locations, potentially leading to remote code execution. No known exploits detected; priority is 2 due to high CVSS but low Exploitability Scoring System (EPSS) score.

📝 Rocket TRUfusion Enterprise through 7.10.4.0 uses a reverse proxy to handle incoming connections. However, the proxy is misconfigured in a way that allows specifying absolute URLs in the HTTP request line, causing the proxy to load the given resource.

📅 Published: 17/02/2026

📈 CVSS: 0

🧭 Vector: n/a

📣 Mentions: 2

⚠️ Priority: 4

📝 Analysis: A misconfiguration in Rocket TRUfusion Enterprise's reverse proxy allows arbitrary resource loading, potentially enabling remote code execution. As of now, no known exploits have been detected; priority for analysis is 0, as further verification is required.

📝 Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.

📅 Published: 18/02/2020

📈 CVSS: 0

🛡️ CISA KEV: True

🧭 Vector: n/a

📣 Mentions: 32

⚠️ Priority: 1+

📝 Analysis: SSRF vulnerability in Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7, exacerbated by WebEx zimlet and JSP enablement. Confirmed exploited, prioritize remediation efforts urgently.

📝 ThreatSonar Anti-Ransomware from TeamT5 does not properly validate the content of uploaded files. Remote attackers with administrator privileges on the product platform can upload malicious files, which can be used to execute arbitrary system command on the server.

📅 Published: 12/08/2024

📈 CVSS: 7.2

🛡️ CISA KEV: True

🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

📣 Mentions: 3

⚠️ Priority: 1+

📝 Analysis: Remote code execution vulnerability found in ThreatSonar Anti-Ransomware from TeamT5 (matching described version). Administrators on the product platform can upload malicious files for arbitrary server command execution. This issue is confirmed exploited and has a high priority, score 1+.

📝 A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered byAnton Cherepanov, Peter Koinr, and Peter Strek from ESET.

📅 Published: 08/08/2025

📈 CVSS: 8.4

🛡️ CISA KEV: True

🧭 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

📣 Mentions: 23

⚠️ Priority: 1+

📝 Analysis: A path traversal vulnerability in Windows WinRAR allows attackers to execute arbitrary code via malicious archive files. This vulnerability has been exploited in the wild and was discovered by ESET researchers. Given its high CVSS score and prior activity, it is a priority 2 issue.

📝 A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.

📅 Published: 14/11/2025

📈 CVSS: 9.1

🛡️ CISA KEV: True

🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

📣 Mentions: 22

⚠️ Priority: 1+

📝 Analysis: A relative path traversal vulnerability exists in Fortinet FortiWeb versions 8.0.0 to 8.0.1, and others, allowing remote attackers to execute administrative commands via crafted HTTP/HTTPS requests. Confirmed exploited by attackers, this is a priority 1+ issue.

📝 An Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) vulnerability [CWE-78] in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.

📅 Published: 18/11/2025

📈 CVSS: 6.7

🛡️ CISA KEV: True

🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

📣 Mentions: 26

⚠️ Priority: 1+

📝 Analysis: An OS Command Injection vulnerability (CWE-78) in Fortinet FortiWeb versions 7.0.0 through 8.0.1 allows authenticated attackers to execute unauthorized code via crafted HTTP requests or CLI commands, with known in-the-wild activity as confirmed by CISA. This is a priority 1+ vulnerability due to confirmed exploitation.

📝 Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10.

@fs

denies access to files outside of Vite serving allow list. Adding

?raw??

or

?import&raw??

to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as

?

are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using

--host

or

server.host

config option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue.

📅 Published: 24/03/2025

📈 CVSS: 5.3

🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

📣 Mentions: 22

⚠️ Priority: 4

📝 Analysis: A file disclosure vulnerability exists in Vite versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 due to a URL manipulation bypass. Only apps exposing the Vite dev server are affected. No known in-the-wild activity reported; priority level is 4 according to CISA KEV and EPSS scoring.

📝 NSecsoft NSecKrnl is a Windows driver that allows a local, authenticated attacker to terminate processes owned by other users, including SYSTEM and Protected Processes by issuing crafted IOCTL requests to the driver.

📅 Published: 13/01/2026

📈 CVSS: 4.7

🧭 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

📣 Mentions: 3

⚠️ Priority: 4

📝 Analysis: A local authenticated attacker can terminate processes owned by other users, including SYSTEM and Protected Processes on Windows systems, using crafted IOCTL requests to the NSecKrnl driver. No known exploits have been detected in the wild. This vulnerability is categorized as a priority 4 issue due to its low CVSS score and lack of confirmed exploitation.

📝 Planting a custom configuration file in ESET Inspect Connectorallowload a malicious DLL.

📅 Published: 30/01/2026

📈 CVSS: 8.4

🧭 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

📣 Mentions: 3

⚠️ Priority: 2

📝 Analysis: A custom configuration file planting enables malicious DLL loading in ESET Inspect Connector. No exploits found in-the-wild, but priority 2 due to high CVSS score and low Exploitability Scoring System (EPSS) value.

📝 Rocket TRUfusion Enterprise through 7.10.5 exposes the endpoint at /axis2/services/WsPortalV6UpDwAxis2Impl to authenticated users to be able to upload files. However, the application doesnt properly sanitize the jobDirectory parameter, which allows path traversal sequences to be included. This allows writing files to arbitrary local filesystem locations and may subsequently lead to remote code execution.

📅 Published: 17/02/2026

📈 CVSS: 0

🧭 Vector: n/a

📣 Mentions: 2

⚠️ Priority: 4

📝 Analysis: Path traversal vulnerability found in Rocket TRUfusion Enterprise versions up to 7.10.5. Unsanitized jobDirectory parameter enables writing files to arbitrary local locations, potentially leading to remote code execution. No known exploits detected; priority is 2 due to high CVSS but low Exploitability Scoring System (EPSS) score.

📝 Rocket TRUfusion Enterprise through 7.10.4.0 uses a reverse proxy to handle incoming connections. However, the proxy is misconfigured in a way that allows specifying absolute URLs in the HTTP request line, causing the proxy to load the given resource.

📅 Published: 17/02/2026

📈 CVSS: 0

🧭 Vector: n/a

📣 Mentions: 2

⚠️ Priority: 4

📝 Analysis: A misconfiguration in Rocket TRUfusion Enterprise's reverse proxy allows arbitrary resource loading, potentially enabling remote code execution. As of now, no known exploits have been detected; priority for analysis is 0, as further verification is required.

📝 Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.

📅 Published: 18/02/2020

📈 CVSS: 0

🛡️ CISA KEV: True

🧭 Vector: n/a

📣 Mentions: 32

⚠️ Priority: 1+

📝 Analysis: SSRF vulnerability in Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7, exacerbated by WebEx zimlet and JSP enablement. Confirmed exploited, prioritize remediation efforts urgently.

📝 ThreatSonar Anti-Ransomware from TeamT5 does not properly validate the content of uploaded files. Remote attackers with administrator privileges on the product platform can upload malicious files, which can be used to execute arbitrary system command on the server.

📅 Published: 12/08/2024

📈 CVSS: 7.2

🛡️ CISA KEV: True

🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

📣 Mentions: 3

⚠️ Priority: 1+

📝 Analysis: Remote code execution vulnerability found in ThreatSonar Anti-Ransomware from TeamT5 (matching described version). Administrators on the product platform can upload malicious files for arbitrary server command execution. This issue is confirmed exploited and has a high priority, score 1+.