Do Son Urgent: Uninstall the EOL Spring CLI VS Code extension now. CVE-2026-22718 (CVSS 6.6) allows command injection and will not be patched.
Command Injection
Critical flaw CVE-2025-15471 (CVSS 9.8) in Trendnet TEW-713RE allows unauthenticated attackers to execute root commands via a single HTTP request.
Critical Coolify flaws (CVE-2025-64419+) expose 52k instances to root RCE and SSH key theft. Patch immediately to secure your self-hosted apps.
JD Cloud alerts users to CVE-2025-66848, a 9.8 critical flaw allowing remote attackers to bypass auth and gain root access on NAS routers.
TeamViewer patches high-severity flaws in its DEX line, including CVE-2025-44016, which allows attackers to bypass file integrity and execute code.
A critical OS Command Injection (CVE-2025-68154) in the systeminformation Node.js library risks RCE on Windows. Affects 16M+ users. Upgrade to v5.27.14.
A Critical RCE flaw (CVSS 9.4) in the n8n Git Node allows command execution by manipulating the core.hooksPath setting in workflows. Update to v1.119.2 immediately.
CISA KEV adds EOL D-Link and Array Networks flaws. ArrayOS AG (CVE-2025-66644) is actively exploited in Japan to drop PHP webshells. Retire EOL D-Link and patch ArrayOS AG immediately.
WatchGuard patched five flaws in Fireware OS. CVE-2025-11838 (CVSS 8.7) allows unauthenticated VPN DoS, while CLI Command Injection risks RCE in the management interface. Update immediately to v2025.1.3.
A High-severity RCE flaw (CVE-2025-66399) in Cacti allows authenticated attackers to execute commands by injecting newline characters into the SNMP Community String. Update to v1.2.29 immediately.
Zenitel TCIV-3+ intercoms face critical, unauthenticated command injection and XSS flaws (CVSS 9.8). Update to v9.3.3.0 immediately to patch.
ASUS fixes 8 severe router flaws, including a critical AiCloud authentication bypass (CVSS 9.4). Users must update firmware immediately to patch vulnerabilities.
A critical chain of Fluent Bit vulnerabilities allows RCE, path traversal, and log tampering by exploiting tag handling and an auth bypass. Update to v4.1.1 now.
Critical Unpatched Flaw: Vivotek EOL IP Cameras Exposed to Unauthenticated RCE via Command Injection
Critical Unpatched Flaw: Vivotek EOL IP Cameras Exposed to Unauthenticated RCE via Command Injection
A critical, unpatched flaw in EOL Vivotek IP Cameras allows unauthenticated RCE via command injection in eventtask.cgi. Firmware versions 0100c–0305a4 are vulnerable and will not receive fixes.
CERT/CC warned that Tenda 4G03 Pro/N300 routers are exposed to an unpatched RCE flaw (CVE-2025-13207). Authenticated attackers can execute root-level commands via web requests due to insecure input handling.
D-Link warned that DIR-878 has reached EOL with three unpatched RCE flaws. Unauthenticated remote attackers can execute arbitrary commands via Dynamic DNS and DMZ settings due to insecure CGI parameters.
A Critical (CVSS 9.0) flaw in W3 Total Cache (CVE-2025-9501) allows unauthenticated attackers to execute arbitrary PHP code via a crafted comment. 1M+ sites are at risk. Update to v2.8.13.
pgAdmin patched four flaws. The Critical RCE (CVE-2025-12762) risks arbitrary code execution via malicious PostgreSQL dump files. LDAP Injection (CVE-2025-12764) and TLS Bypass were also fixed. Update to v9.10.
Dell patched seven flaws in CloudLink, including two Critical bugs that allow an authenticated user to escape the restricted shell and execute arbitrary commands for system takeover. Update to v8.2.
A Critical RCE flaw (CVE-2025-11953, CVSS 9.8) in React Native Community CLI allows unauthenticated attackers to execute arbitrary code via a command injection in the exposed Metro Dev Server.
CISA warned of two critical flaws in Veeder-Root TLS4B ATG systems. The RCE (CVE-2025-58428, CVSS 9.9) allows command injection via the SOAP interface, risking system takeover and energy disruption.
SUSE patched a Critical RCE flaw (CVE-2025-54469, CVSS 10.0) in NeuVector Enforcer that allows attackers to inject commands via unsanitized environment variables, risking container root shell access.