Monthly
OS command injection in vsDesk's Task Scheduler component enables authenticated administrators to execute arbitrary operating system commands on the underlying server due to insufficient input filtering. Affecting at least vsDesk 11.06.02, the flaw - discovered and reported by Kaspersky - can be leveraged to disrupt web server operations, exfiltrate sensitive data, or achieve full server compromise. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires high-privilege authenticated access, which meaningfully constrains opportunistic attack scenarios.
Remote code execution and information disclosure in IBM Db2 Genius Hub (1.1, 1.1.1, 1.1.2) and IBM Agentics 1.0 stem from the use of inherently dangerous functions invoked without sufficient input restrictions, allowing remote attackers to run arbitrary code or read sensitive data. IBM's PSIRT reported the flaw with a 9.8 critical CVSS reflecting network-reachable, unauthenticated exploitation with full confidentiality, integrity and availability impact. There is no public exploit identified at time of analysis, and the low EPSS score (0.33%, 25th percentile) suggests exploitation is not yet widespread.
Denial-of-service attacks against Fortinet FortiAnalyzer and FortiManager 6.4 through 7.6.4 allow authenticated attackers to trigger system hangs via specially crafted HTTP requests that exploit a use of potentially dangerous function vulnerability (CWE-676). The crash occurs only when internal lock alignment conditions are met, making exploitation dependent on timing and system state rather than attacker control. CVSS 5.2 reflects medium severity with high attack complexity and low availability impact; active exploitation is not confirmed.
The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Designer User) to embed OLE objects into graphics, and escalate their privileges to the identity of a victim user who subsequently interacts with the graphical elements. [CVSS 7.4 HIGH]
Use of potentially dangerous function issue exists in Chatwork Desktop Application (Windows) versions prior to 2.9.2. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unitronics Vision PLC - CWE-676: Use of Potentially Dangerous Function may allow security feature bypass. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Use of potentially dangerous function issue exists in Ricoh Streamline NX PC Client. Rated medium severity (CVSS 4.0), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
When Open5GS UPF receives a PFCP Session Establishment Request, it stores related values for building the PFCP Session Establishment Response. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OS command injection in vsDesk's Task Scheduler component enables authenticated administrators to execute arbitrary operating system commands on the underlying server due to insufficient input filtering. Affecting at least vsDesk 11.06.02, the flaw - discovered and reported by Kaspersky - can be leveraged to disrupt web server operations, exfiltrate sensitive data, or achieve full server compromise. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires high-privilege authenticated access, which meaningfully constrains opportunistic attack scenarios.
Remote code execution and information disclosure in IBM Db2 Genius Hub (1.1, 1.1.1, 1.1.2) and IBM Agentics 1.0 stem from the use of inherently dangerous functions invoked without sufficient input restrictions, allowing remote attackers to run arbitrary code or read sensitive data. IBM's PSIRT reported the flaw with a 9.8 critical CVSS reflecting network-reachable, unauthenticated exploitation with full confidentiality, integrity and availability impact. There is no public exploit identified at time of analysis, and the low EPSS score (0.33%, 25th percentile) suggests exploitation is not yet widespread.
Denial-of-service attacks against Fortinet FortiAnalyzer and FortiManager 6.4 through 7.6.4 allow authenticated attackers to trigger system hangs via specially crafted HTTP requests that exploit a use of potentially dangerous function vulnerability (CWE-676). The crash occurs only when internal lock alignment conditions are met, making exploitation dependent on timing and system state rather than attacker control. CVSS 5.2 reflects medium severity with high attack complexity and low availability impact; active exploitation is not confirmed.
The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Designer User) to embed OLE objects into graphics, and escalate their privileges to the identity of a victim user who subsequently interacts with the graphical elements. [CVSS 7.4 HIGH]
Use of potentially dangerous function issue exists in Chatwork Desktop Application (Windows) versions prior to 2.9.2. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unitronics Vision PLC - CWE-676: Use of Potentially Dangerous Function may allow security feature bypass. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Use of potentially dangerous function issue exists in Ricoh Streamline NX PC Client. Rated medium severity (CVSS 4.0), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
When Open5GS UPF receives a PFCP Session Establishment Request, it stores related values for building the PFCP Session Establishment Response. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.