DEV Community: Freedom Coder

CVE-2024-27199: JetBrains TeamCity Relative Path Traversal Vulnerability

Freedom Coder — Tue, 21 Apr 2026 01:09:19 +0000

CVE ID

CVE-2024-27199

Vulnerability Name

JetBrains TeamCity Relative Path Traversal Vulnerability

Project: JetBrains
Product: TeamCity

Date

Date Added: 2026-04-20
Due Date: 2026-05-04

Description

JetBrains TeamCity contains a relative path traversal vulnerability that could allow limited admin actions to be performed.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Additional Notes

https://www.jetbrains.com/privacy-security/issues-fixed/ ; https://nvd.nist.gov/vuln/detail/CVE-2024-27199

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2026-20128: Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability

Freedom Coder — Tue, 21 Apr 2026 01:06:48 +0000

CVE ID

CVE-2026-20128

Vulnerability Name

Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability

Project: Cisco
Product: Catalyst SD-WAN Manager

Date

Date Added: 2026-04-20
Due Date: 2026-04-23

Description

Cisco Catalyst SD-WAN Manager contains a storing passwords in a recoverable format vulnerability that allows an authenticated, local attacker to gain DCA user privileges by accessing a credential file for the DCA user on the filesystem as a low-privileged user.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

Additional Notes

CISA Mitigation Instructions: https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems ; https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v ; https://nvd.nist.gov/vuln/detail/CVE-2026-20128

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2025-2749: Kentico Xperience Path Traversal Vulnerability

Freedom Coder — Tue, 21 Apr 2026 01:03:41 +0000

CVE ID

CVE-2025-2749

Vulnerability Name

Kentico Xperience Path Traversal Vulnerability

Project: Kentico
Product: Kentico Xperience

Date

Date Added: 2026-04-20
Due Date: 2026-05-04

Description

Kentico Xperience contains a path traversal vulnerability that could allow an authenticated user's Staging Sync Server to upload arbitrary data to path relative locations.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Additional Notes

https://devnet.kentico.com/download/hotfixes ; https://nvd.nist.gov/vuln/detail/CVE-2025-2749

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2026-20133: Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

Freedom Coder — Tue, 21 Apr 2026 01:02:23 +0000

CVE ID

CVE-2026-20133

Vulnerability Name

Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

Project: Cisco
Product: Catalyst SD-WAN Manager

Date

Date Added: 2026-04-20
Due Date: 2026-04-23

Description

Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to an unauthorized actor vulnerability that could allow remote attackers to view sensitive information on affected systems.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Additional Notes

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2026-20122: Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability

Freedom Coder — Tue, 21 Apr 2026 01:01:06 +0000

CVE ID

CVE-2026-20122

Vulnerability Name

Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability

Project: Cisco
Product: Catalyst SD-WAN Manger

Date

Date Added: 2026-04-20
Due Date: 2026-04-23

Description

Cisco Catalyst SD-WAN Manager contains an incorrect use of privileged APIs vulnerability due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Additional Notes

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2026-34197: Apache ActiveMQ Improper Input Validation Vulnerability

Freedom Coder — Fri, 17 Apr 2026 16:01:10 +0000

CVE ID

CVE-2026-34197

Vulnerability Name

Apache ActiveMQ Improper Input Validation Vulnerability

Project: Apache
Product: ActiveMQ

Date

Date Added: 2026-04-16
Due Date: 2026-04-30

Description

Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Additional Notes

https://activemq.apache.org/security-advisories.data/CVE-2026-34197-announcement.txt ; https://nvd.nist.gov/vuln/detail/CVE-2026-34197

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2026-32201: Microsoft SharePoint Server Improper Input Validation Vulnerability

Freedom Coder — Tue, 14 Apr 2026 22:06:07 +0000

CVE ID

CVE-2026-32201

Vulnerability Name

Microsoft SharePoint Server Improper Input Validation Vulnerability

Project: Microsoft
Product: SharePoint Server

Date

Date Added: 2026-04-14
Due Date: 2026-04-28

Description

Microsoft SharePoint Server contains an improper input validation vulnerability that allows an unauthorized attacker to perform spoofing over a network.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Additional Notes

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-32201 ; https://nvd.nist.gov/vuln/detail/CVE-2026-32201

Related Security News

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2009-0238: Microsoft Office Remote Code Execution

Freedom Coder — Tue, 14 Apr 2026 22:01:06 +0000

CVE ID

CVE-2009-0238

Vulnerability Name

Microsoft Office Remote Code Execution

Project: Microsoft
Product: Office

Date

Date Added: 2026-04-14
Due Date: 2026-04-28

Description

Microsoft Office Excel contains a remote code execution vulnerability that could allow an attacker to take complete control of an affected system if a user opens a specially crafted Excel file that includes a malformed object.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Additional Notes

https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-009 ; https://nvd.nist.gov/vuln/detail/CVE-2009-0238

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2026-34621: Adobe Acrobat and Reader Prototype Pollution Vulnerability

Freedom Coder — Mon, 13 Apr 2026 19:09:46 +0000

CVE ID

CVE-2026-34621

Vulnerability Name

Adobe Acrobat and Reader Prototype Pollution Vulnerability

Project: Adobe
Product: Acrobat and Reader

Date

Date Added: 2026-04-13
Due Date: 2026-04-27

Description

Adobe Acrobat and Reader contain a prototype pollution vulnerability that allows for arbitrary code execution.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Additional Notes

https://helpx.adobe.com/security/products/acrobat/apsb26-43.html ; https://nvd.nist.gov/vuln/detail/CVE-2026-34621

Related Security News

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2026-21643: Fortinet SQL Injection Vulnerability

Freedom Coder — Mon, 13 Apr 2026 19:08:20 +0000

CVE ID

CVE-2026-21643

Vulnerability Name

Fortinet SQL Injection Vulnerability

Project: Fortinet
Product: FortiClient EMS

Date

Date Added: 2026-04-13
Due Date: 2026-04-16

Description

Fortinet FortiClient EMS contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2020-9715: Adobe Acrobat Use-After-Free Vulnerability

Freedom Coder — Mon, 13 Apr 2026 19:06:53 +0000

CVE ID

CVE-2020-9715

Vulnerability Name

Adobe Acrobat Use-After-Free Vulnerability

Project: Adobe
Product: Acrobat

Date

Date Added: 2026-04-13
Due Date: 2026-04-27

Description

Adobe Acrobat contains a use-after-free vulnerability that allows for code execution

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Additional Notes

https://helpx.adobe.com/security/products/acrobat/apsb20-48.html ; https://nvd.nist.gov/vuln/detail/CVE-2020-9715

Related Security News

CISA Adds 6 Known Exploited Flaws in Fortinet, Microsoft, and Adobe Software

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2023-36424: Microsoft Windows Out-of-Bounds Read Vulnerability

Freedom Coder — Mon, 13 Apr 2026 19:05:27 +0000

CVE ID

CVE-2023-36424

Vulnerability Name

Microsoft Windows Out-of-Bounds Read Vulnerability

Project: Microsoft
Product: Windows

Date

Date Added: 2026-04-13
Due Date: 2026-04-27

Description

Microsoft Windows Common Log File System Driver contains an out-of-bounds read vulnerability that could allow a threat actor for privileges escalation

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Additional Notes

https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2023-36424 ; https://nvd.nist.gov/vuln/detail/CVE-2023-36424

Related Security News

CISA Adds 6 Known Exploited Flaws in Fortinet, Microsoft, and Adobe Software

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List