DEV Community: Freedom Coder

CVE-2023-48788: Fortinet FortiClient EMS SQL Injection Vulnerability

Freedom Coder — Fri, 19 Jun 2026 03:35:11 +0000

CVE ID

CVE-2023-48788

Vulnerability Name

Fortinet FortiClient EMS SQL Injection Vulnerability

Project: Fortinet
Product: FortiClient EMS

Date

Date Added: 2024-03-25
Due Date: 2024-04-15

Description

Fortinet FortiClient EMS contains a SQL injection vulnerability that allows an unauthenticated attacker to execute commands as SYSTEM via specifically crafted requests.

Known To Be Used in Ransomware Campaigns?

Known

Action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Additional Notes

https://www.fortiguard.com/psirt/FG-IR-24-007; https://nvd.nist.gov/vuln/detail/CVE-2023-48788

Related Security News

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2026-20253: Splunk Enterprise Missing Authentication for Critical Function Vulnerability

Freedom Coder — Thu, 18 Jun 2026 22:01:30 +0000

CVE ID

CVE-2026-20253

Vulnerability Name

Splunk Enterprise Missing Authentication for Critical Function Vulnerability

Project: Splunk
Product: Enterprise

Date

Date Added: 2026-06-18
Due Date: 2026-06-21

Description

Splunk Enterprise contains a missing authentication for critical function vulnerability which could allow an unauthenticated user to create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Additional Notes

https://advisory.splunk.com/advisories/SVD-2026-0603 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-20253

Related Security News

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2026-48907: Widget Factory Joomla Content Editor Improper Access Control Vulnerability

Freedom Coder — Wed, 17 Jun 2026 19:01:35 +0000

CVE ID

CVE-2026-48907

Vulnerability Name

Widget Factory Joomla Content Editor Improper Access Control Vulnerability

Project: Widget Factory
Product: *Joomla Content Editor *

Date

Date Added: 2026-06-16
Due Date: 2026-06-19

Description

Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Additional Notes

https://www.joomlacontenteditor.net/news/jce-security-update-and-a-free-patch-for-older-sites ; https://www.joomlacontenteditor.net/support/changelog/editor ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-48907

Related Security News

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2026-20262: Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability

Freedom Coder — Tue, 16 Jun 2026 16:06:23 +0000

CVE ID

CVE-2026-20262

Vulnerability Name

Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability

Project: Cisco
Product: Catalyst SD-WAN Manager

Date

Date Added: 2026-06-15
Due Date: 2026-06-29

Description

Cisco Catalyst SD-WAN Manager contains a directory or path traversal vulnerability that could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

CVE-2026-54420: LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability

Freedom Coder — Tue, 16 Jun 2026 16:01:22 +0000

CVE ID

CVE-2026-54420

Vulnerability Name

LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability

Project: LiteSpeed
Product: cPanel Plugin

Date

Date Added: 2026-06-15
Due Date: 2026-06-18

Description

LiteSpeed cPanel plugin contains a UNIX symbolic link (Symlink) following vulnerability that could allow a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Additional Notes

https://blog.litespeedtech.com/2026/06/01/security-update-for-litespeed-cpanel-plugin-2/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-54420

Related Security News

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2024-20399: Cisco NX-OS Command Injection Vulnerability

Freedom Coder — Fri, 12 Jun 2026 20:35:04 +0000

CVE ID

CVE-2024-20399

Vulnerability Name

Cisco NX-OS Command Injection Vulnerability

Project: Cisco
Product: NX-OS

Date

Date Added: 2024-07-02
Due Date: 2024-07-23

Description

Cisco NX-OS contains a command injection vulnerability in the command line interface (CLI) that could allow an authenticated, local attacker to execute commands as root on the underlying operating system of an affected device.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Additional Notes

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-cmd-injection-xD9OhyOP; https://nvd.nist.gov/vuln/detail/CVE-2024-20399

Related Security News

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2026-10520: Ivanti Sentry OS Command Injection Vulnerability

Freedom Coder — Fri, 12 Jun 2026 04:01:05 +0000

CVE ID

CVE-2026-10520

Vulnerability Name

Ivanti Sentry OS Command Injection Vulnerability

Project: Ivanti
Product: Sentry

Date

Date Added: 2026-06-11
Due Date: 2026-06-14

Description

Ivanti Sentry (formerly known as MobileIron Sentry) contains an OS command injection vulnerability which could allow a remote unauthenticated user to achieve root-level remote code execution. This vulnerability can be successfully exploited in cases where the Sentry appliance is in an unmanaged state with its endpoints externally reachable. The use of mTLS with EPMM or restricted HTTPS access through Neurons for MDM makes interfaces inaccessible to external actors.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Additional Notes

https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523?language=en_US ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-10520

Related Security News

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2026-33017: Langflow Code Injection Vulnerability

Freedom Coder — Wed, 10 Jun 2026 16:38:10 +0000

CVE ID

CVE-2026-33017

Vulnerability Name

Langflow Code Injection Vulnerability

Project: Langflow
Product: Langflow

Date

Date Added: 2026-03-25
Due Date: 2026-04-08

Description

Langflow contains a code injection vulnerability that could allow building public flows without requiring authentication.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Additional Notes

https://github.com/langflow-ai/langflow/security/advisories/GHSA-vwmf-pq79-vjvx ; https://nvd.nist.gov/vuln/detail/CVE-2026-33017

Related Security News

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2026-50751: Check Point Security Gateway Improper Authentication Vulnerability

Freedom Coder — Tue, 09 Jun 2026 19:08:38 +0000

CVE ID

CVE-2026-50751

Vulnerability Name

Check Point Security Gateway Improper Authentication Vulnerability

Project: Check Point
Product: Security Gateway

Date

Date Added: 2026-06-08
Due Date: 2026-06-11

Description

Check Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.

Known To Be Used in Ransomware Campaigns?

Known

Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Additional Notes

https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/ ; https://support.checkpoint.com/results/sk/sk185033?_gl=1*1wqeqhc*_gcl_au*MTI1MzE5MjI2LjE3ODA5MzQ1NTM. ; https://nvd.nist.gov/vuln/detail/CVE-2026-50751

Related Security News

Researchers release details, PoC for exploited Check Point VPN flaw (CVE-2026-50751)

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2026-20245: Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability

Freedom Coder — Tue, 09 Jun 2026 19:06:07 +0000

CVE ID

CVE-2026-20245

Vulnerability Name

Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability

Project: Cisco
Product: Catalyst SD-WAN Manager

Date

Date Added: 2026-06-09
Due Date: 2026-06-23

Description

Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage contains an improper encoding or escaping of output vulnerability. This vulnerability could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Additional Notes

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-4uxFrdzx ; https://nvd.nist.gov/vuln/detail/CVE-2026-20245

Related Security News

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2026-7473: Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability

Freedom Coder — Tue, 09 Jun 2026 19:03:36 +0000

CVE ID

CVE-2026-7473

Vulnerability Name

Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability

Project: Arista
Product: Extensible Operating System

Date

Date Added: 2026-06-09
Due Date: 2026-06-23

Description

Arista Extensible Operating System (EOS) contains an incomplete comparison with missing factors vulnerability when the switch incorrectly decapsulate and forwards other unexpected tunneled packet with a destination IP matching its configured decapsulation IP.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Additional Notes

https://www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-0137 ; https://nvd.nist.gov/vuln/detail/CVE-2026-7473

Related Security News

CISA Adds Cisco, Chrome, and Arista Flaws to KEV Catalog Amid Active Exploitation

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2026-11645: Google Chromium V8 Out-of-Bounds Read and Write Vulnerability

Freedom Coder — Tue, 09 Jun 2026 19:01:05 +0000

CVE ID

CVE-2026-11645

Vulnerability Name

Google Chromium V8 Out-of-Bounds Read and Write Vulnerability

Project: Google
Product: Chromium V8

Date

Date Added: 2026-06-09
Due Date: 2026-06-23

Description

Google Chromium V8 out-of-bounds read and write vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Additional Notes

https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html ; https://issues.chromium.org/issues/506689381 ; https://nvd.nist.gov/vuln/detail/CVE-2026-11645

Related Security News

CISA Adds Cisco, Chrome, and Arista Flaws to KEV Catalog Amid Active Exploitation

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List