DEV Community: Freedom Coder

CVE-2026-45659: Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability

Freedom Coder — Fri, 03 Jul 2026 15:20:22 +0000

CVE ID

CVE-2026-45659

Vulnerability Name

Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability

Project: Microsoft
Product: SharePoint Server

Date

Date Added: 2026-07-01
Due Date: 2026-07-04

Description

Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Additional Notes

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45659 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-45659

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2023-4863: Google Chromium WebP Heap-Based Buffer Overflow Vulnerability

Freedom Coder — Thu, 02 Jul 2026 08:30:05 +0000

CVE ID

CVE-2023-4863

Vulnerability Name

Google Chromium WebP Heap-Based Buffer Overflow Vulnerability

Project: Google
Product: Chromium WebP

Date

Date Added: 2023-09-13
Due Date: 2023-10-04

Description

Google Chromium WebP contains a heap-based buffer overflow vulnerability that allows a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. This vulnerability can affect applications that use the WebP Codec.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CVE-2022-41082: Microsoft Exchange Server Remote Code Execution Vulnerability

Freedom Coder — Fri, 26 Jun 2026 21:37:08 +0000

CVE ID

CVE-2022-41082

Vulnerability Name

Microsoft Exchange Server Remote Code Execution Vulnerability

Project: Microsoft
Product: Exchange Server

Date

Date Added: 2022-09-30
Due Date: 2022-10-21

Description

Microsoft Exchange Server contains an unspecified vulnerability that allows for authenticated remote code execution. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41040 which allows for the remote code execution.

Known To Be Used in Ransomware Campaigns?

Known

Action

Apply updates per vendor instructions.

Additional Notes

https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/; https://nvd.nist.gov/vuln/detail/CVE-2022-41082

Related Security News

New SharkLoader Malware Deploys Cobalt Strike in StrikeShark Cyberattacks

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2022-40684: Fortinet Multiple Products Authentication Bypass Vulnerability

Freedom Coder — Fri, 26 Jun 2026 21:36:07 +0000

CVE ID

CVE-2022-40684

Vulnerability Name

Fortinet Multiple Products Authentication Bypass Vulnerability

Project: Fortinet
Product: Multiple Products

Date

Date Added: 2022-10-11
Due Date: 2022-11-01

Description

Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.

Known To Be Used in Ransomware Campaigns?

Known

Action

Apply updates per vendor instructions.

Additional Notes

https://www.fortiguard.com/psirt/FG-IR-22-377; https://nvd.nist.gov/vuln/detail/CVE-2022-40684

Related Security News

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2023-32315: Ignite Realtime Openfire Path Traversal Vulnerability

Freedom Coder — Fri, 26 Jun 2026 21:35:06 +0000

CVE ID

CVE-2023-32315

Vulnerability Name

Ignite Realtime Openfire Path Traversal Vulnerability

Project: Ignite Realtime
Product: Openfire

Date

Date Added: 2023-08-24
Due Date: 2023-09-14

Description

Ignite Realtime Openfire contains a path traversal vulnerability that allows an unauthenticated attacker to access restricted pages in the Openfire Admin Console reserved for administrative users.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Additional Notes

https://www.igniterealtime.org/downloads/#openfire; https://nvd.nist.gov/vuln/detail/CVE-2023-32315

Related Security News

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2026-20230: Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability

Freedom Coder — Thu, 25 Jun 2026 22:06:11 +0000

CVE ID

CVE-2026-20230

Vulnerability Name

Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability

Project: Cisco
Product: Unified Communications Manager

Date

Date Added: 2026-06-25
Due Date: 2026-06-28

Description

Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) contain a server-side request forgery (SSRF) Vulnerability that could allow an unauthenticated, remote attacker to write files to the underlying operating system that could be used later to elevate to root.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Additional Notes

https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-cucm-ssrf-cXPnHcW.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-20230

Related Security News

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2026-12569: PTC Windchill and FlexPLM Improper Input Validation Vulnerability

Freedom Coder — Thu, 25 Jun 2026 22:01:10 +0000

CVE ID

CVE-2026-12569

Vulnerability Name

PTC Windchill and FlexPLM Improper Input Validation Vulnerability

Project: PTC
Product: Windchill and FlexPLM

Date

Date Added: 2026-06-25
Due Date: 2026-06-28

Description

PTC Windchill and FlexPLM contains an improper input validation vulnerability allowing an unauthenticated, remote attacker to execute arbitrary code by sending a malicious request to the network.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Additional Notes

https://www.ptc.com/en/support/article/CS473270 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-12569

Related Security News

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2026-34908: Ubiquiti UniFi OS Improper Access Control Vulnerability

Freedom Coder — Tue, 23 Jun 2026 22:08:41 +0000

CVE ID

CVE-2026-34908

Vulnerability Name

Ubiquiti UniFi OS Improper Access Control Vulnerability

Project: Ubiquiti
Product: UniFi OS

Date

Date Added: 2026-06-23
Due Date: 2026-06-26

Description

Ubiquiti UniFi OS contains an improper access control vulnerability which could allow a malicious actor with access to the network to make unauthorized changes to the system.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Additional Notes

https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-34908

Related Security News

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2026-34909: Ubiquiti UniFi OS Path Traversal Vulnerability

Freedom Coder — Tue, 23 Jun 2026 22:06:10 +0000

CVE ID

CVE-2026-34909

Vulnerability Name

Ubiquiti UniFi OS Path Traversal Vulnerability

Project: Ubiquiti
Product: UniFi OS

Date

Date Added: 2026-06-23
Due Date: 2026-06-26

Description

Ubiquiti UniFi OS contains a path traversal vulnerability which could allow a malicious actor with access to the network to access files on the underlying system that could be manipulated to access an underlying account.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Additional Notes

Related Security News

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2026-34910: Ubiquiti UniFi OS Improper Input Validation Vulnerability

Freedom Coder — Tue, 23 Jun 2026 22:03:40 +0000

CVE ID

CVE-2026-34910

Vulnerability Name

Ubiquiti UniFi OS Improper Input Validation Vulnerability

Project: Ubiquiti
Product: UniFi OS

Date

Date Added: 2026-06-23
Due Date: 2026-06-26

Description

Ubiquiti UniFi OS contains an improper input validation vulnerability which could allow a malicious actor with access to the network to conduct command injection.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Additional Notes

Related Security News

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2025-67038: Lantronix EDS5000 Code Injection Vulnerability

Freedom Coder — Tue, 23 Jun 2026 22:01:09 +0000

CVE ID

CVE-2025-67038

Vulnerability Name

Lantronix EDS5000 Code Injection Vulnerability

Project: Lantronix
Product: EDS5000

Date

Date Added: 2026-06-23
Due Date: 2026-06-26

Description

Lantronix EDS5000 contains a code injection vulnerability that could allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Additional Notes

https://ltrxdev.atlassian.net/wiki/spaces/LTRXTS/pages/2538438657/Latest+Firmware+for+the+EDS5000+series+EDS5008+EDS5016+EDS5032 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2025-67038

Related Security News

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2025-24813: Apache Tomcat Path Equivalence Vulnerability

Freedom Coder — Mon, 22 Jun 2026 17:30:03 +0000

CVE ID

CVE-2025-24813

Vulnerability Name

Apache Tomcat Path Equivalence Vulnerability

Project: Apache
Product: Tomcat

Date

Date Added: 2025-04-01
Due Date: 2025-04-22

Description

Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Additional Notes

This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq ; https://nvd.nist.gov/vuln/detail/CVE-2025-24813

Related Security News

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List