CVE Repository

GitLab CE/EE (versions 18.7–19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2)

GitLab is a web-based platform that teams use to host, review, and collaborate on software code.

Cisco Secure Firewall Management Center (versions prior to patched releases)

A centralised management platform used by network administrators to control and monitor Cisco firewall devices across an organisation's infrastructure.

Adobe Commerce / Magento (versions 2.4.7, 2.4.8, 2.4.9)

Adobe Commerce, built on the open-source Magento platform, is the software that powers the checkout, product catalogue, and payment processing for thousands of online shops worldwide.

SonicWall SMA 1000 (versions 12.4.3-03453 / 12.5.0-02835 and older)

A remote access gateway used by organisations to let employees connect securely to corporate networks from outside the office.

Ruby on Rails (versions prior to 8.1.3.1 and earlier patched releases)

A popular open-source web application framework used by developers to build websites and web services — including many you use every day without knowing it.

Zimbra Collaboration Suite (versions prior to v10.1.20)

A widely used platform that combines email, calendar, contacts, and file sharing — common in government agencies, universities, and mid-to-large businesses.

Spring for GraphQL (versions affected, see advisory)

Part of Broadcom's Spring application framework, a widely used open-source toolkit for building Java-based enterprise software — Spring for GraphQL specifically handles APIs built using the GraphQL query language.

Microsoft Entra ID (all versions prior to Microsoft's server-side patch)

Microsoft Entra ID is a cloud-based identity and access management service — the system that verifies who you are and controls what you can access across Microsoft 365 and connected apps.

Ray (versions below 2.52.0)

Ray is an open-source Python framework used by developers and data scientists to run large AI and machine learning workloads across many computers at once.

VMware vCenter Server (versions prior to 9.1.0.0300, 9.0.2.0100, 8.0 U3k / 8.0 U2f)

Centralised IT management software that lets organisations control, monitor, and configure all their virtual machines and servers from a single platform.

Adobe ColdFusion (versions prior to 2025.0.12 and 2023.0.23)

ColdFusion is Adobe's web application server platform, used by developers to build and host database-driven websites and internal business applications.

SAP Commerce Cloud (Data Hub Adapter, all versions prior to patch)

An enterprise e-commerce platform used by large retailers and manufacturers to manage online storefronts, product catalogues, and customer data.

Progress Kemp LoadMaster (GA v7.2.63.1 and below, LTSF v7.2.54.17 and below)

LoadMaster is an application delivery controller and load balancer used by enterprises and government agencies worldwide to distribute web traffic across multiple servers and keep applications running reliably. Progress Software reports over 100,000 deployments, including across 80% of Fortune 500 companies.

Cisco IOS XE Software (Command Injection)

The operating system that runs on a wide range of Cisco routers and switches used in corporate and government networks worldwide.

JetBrains TeamCity (all on-premise versions before the patched release)

A continuous integration and delivery (CI/CD) server — software development teams use it to automatically build, test, and deploy their code.

cPanel & WHM (all supported versions), WP Squared

cPanel is the control panel software that web hosting companies use to let customers manage websites, email accounts, and databases through a browser interface. WHM (Web Host Manager) sits above it, used by hosting administrators to manage the server itself.

N-able N-central (versions prior to 2026.3.1.7)

N-central is a remote monitoring and management (RMM) platform used by managed service providers (MSPs) — companies that handle IT infrastructure for other businesses — to monitor, patch, and remotely access their clients' servers and devices.

SonicWall SMA1000 (all versions prior to the patch issued July 14, 2026)

A hardware appliance organisations use to give remote workers secure access to internal corporate networks, sitting at the edge of the network as a gateway.

Adobe Campaign Classic (versions prior to 7.4.3 build 9398)

Adobe Campaign Classic is enterprise marketing software used by large organisations to manage and automate mass email, SMS, and direct mail campaigns.

Google Chrome (versions prior to Chrome 145)

Google Chrome is the world's most widely used web browser, installed on billions of devices for everyday browsing, work, and personal use.

Ruby on Rails Active Storage (versions 7.0.0–8.1.3 and Rails 6.x with Vips enabled)

Ruby on Rails is a popular open-source web development framework used to build web applications. Active Storage is its built-in system for handling file uploads.

OpenWrt (versions prior to 24.10.8 and 25.12.5)

OpenWrt is an open-source operating system that replaces the factory firmware on home and small-business routers, giving users more control over their network hardware.

JetBrains TeamCity On-Premises (all versions before 2025.11.7 and 2026.1.3)

TeamCity is a continuous integration and delivery server made by JetBrains — software used by development teams to automatically build, test, and deploy code.

Alibaba Fastjson (versions 1.2.68 through 1.2.83)

Fastjson is an open-source Java library maintained by Alibaba that parses and generates JSON (a common data exchange format), used extensively in enterprise web services and APIs.

PTC Windchill and FlexPLM (all versions before June 2026 patches)

CVE-2026-12569 is a critical unsafe deserialization vulnerability (a flaw where an application processes attacker-supplied data as trusted executable instructions without verifying it first). Successful exploitation allows an unauthenticated attacker to execute arbitrary code on the vulnerable server, as reported by Bleeping Computer.

Microsoft SharePoint Server (all supported on-premises versions)

SharePoint is Microsoft's on-premises collaboration platform used by organisations to host internal websites, share documents, and manage team workflows.

ServiceNow AI Platform (unpatched instances before June 2026 patch releases)

ServiceNow is a cloud-based platform used by businesses to manage IT operations, employee workflows, and customer service processes.

NGINX Web Server (versions 0.9.6 through 1.31.2)

NGINX is a web server used by a large portion of the internet to deliver websites and handle web traffic — it sits between your browser and the application behind it.

WordPress Core (versions 6.9.0 through 7.0.1)

WordPress is the software that powers roughly half of all websites on the internet, from personal blogs to major news outlets.

Fortinet FortiSandbox (versions 5.0.0–5.0.5, 4.4.0–4.4.8, all 4.2 versions, and FortiSandbox Cloud/PaaS 5.0.4–5.0.5)

A Fortinet security product that analyses suspicious files and network traffic in an isolated environment to detect malware before it reaches the rest of a network.

Zoom Desktop Client for Windows (versions before 6.3.10)

Zoom is the video conferencing and online meetings platform used by hundreds of millions of people worldwide for work calls, webinars, and remote collaboration.

SonicWall SMA 1000 Series (versions below 12.4.3-03453 / 12.5.0-02835)

A hardware and virtual appliance that organisations use to give remote workers secure access to internal corporate networks and applications.

Balbooa Forms for Joomla (versions prior to 2.4.1)

A drag-and-drop form builder for Joomla websites that lets site owners create contact forms with file upload functionality.

Gitea Docker Image (versions 1.26.2 and below)

Gitea is an open-source, self-hosted platform for storing and managing source code — think a version of GitHub or GitLab that a company runs on its own servers.

UniFi Connect Application (versions 3.4.16 and below)

UniFi Connect is a Ubiquiti platform for managing displays, intercom systems, and building access hardware — popular in small offices, schools, and home setups.

Adobe ColdFusion (versions 2025.9, 2023.20 and earlier)

A commercial platform used by developers to build and deploy enterprise websites and web applications.

Cursor AI Code Editor (versions before 3.0)

Cursor is an AI-powered code editor used by software developers to write, edit, and review code, with a built-in AI agent that can execute terminal commands automatically on the developer's behalf.

Adobe ColdFusion (versions prior to ColdFusion 2023 Update 21 and ColdFusion 2025 Update 10)

ColdFusion is Adobe's web application server platform, used by organisations to build and run database-driven websites and internal business applications.

Progress Kemp LoadMaster (GA v7.2.63.1 and older, LTSF v7.2.54.17 and older)

An application delivery controller and load balancer that enterprises use to manage and distribute incoming traffic across servers — it sits at the network edge, making it a high-value target.

libssh2 (versions 1.11.1 and below)

A C library that gives software the ability to connect to SSH servers — it is embedded inside widely-used tools including curl, Git, and PHP, meaning it quietly runs inside many applications you use every day without advertising its presence.

PTC Windchill and FlexPLM (all versions prior to patched releases)

Windchill is enterprise software used by manufacturers — in industries like automotive, aerospace, and defence — to manage the full lifecycle of a product, from design files and engineering specs through to compliance records. Think of it as the document nervous system of a factory floor.

Lantronix EDS5000 Series (firmware 2.1.0.0R3 and below)

A serial-to-IP converter — a piece of hardware that connects older serial devices (like industrial sensors or legacy equipment) to a modern network, often found in factories, hospitals, and infrastructure environments.

Cisco Unified Communications Manager (Unified CM)

Cisco Unified CM is an enterprise on-premises platform that manages voice calls, video conferencing, and internal communications for large organisations — the phone system backbone for thousands of businesses.

NGINX Open Source (versions using the HTTP/3 QUIC module)

NGINX is open-source web server software that sits in front of websites and applications to handle incoming traffic, widely used as a reverse proxy and load balancer across the internet.

Cisco ISE (versions prior to 3.3 Patch 11, 3.4 Patch 6, 3.5 Patch 4)

Identity Services Engine (ISE) is software many large organizations use to control which devices and users are allowed onto their network.

Fortinet FortiSandbox (Multiple Versions)

FortiSandbox is a cybersecurity product made by Fortinet that organisations use to detect malware and advanced threats by running suspicious files and code in an isolated environment before they reach the network.

Splunk Enterprise (versions 10.0.6 and below, 10.2.3 and below)

Splunk is a platform used by IT and security teams to collect, search, and analyse machine-generated data — logs, alerts, and system events — across an organisation's infrastructure.

Ivanti Sentry (versions before 10.5.2, 10.6.2, and 10.7.1)

A security gateway appliance (formerly MobileIron Sentry) that organisations use to manage and secure mobile device access to enterprise email and internal applications.

FortiSandbox (versions 5.0.0–5.0.5 and 4.4.0–4.4.8)

FortiSandbox is a security tool made by Fortinet that analyses suspicious files and web content in an isolated environment to detect malware before it reaches a network.

Check Point Remote Access VPN and Mobile Access

A security product made by Israeli cybersecurity company Check Point that lets employees connect securely to their company's network from outside the office.