Microsoft January 2026 Security Updates

Microsoft December 2025 Security Updates

Microsoft December 2025 Early Security Updates

Microsoft November 2025 Security Updates

Microsoft October 2025 Security Updates

Microsoft September 2025 Security Updates

Microsoft August 2025 Security Updates

Microsoft August Early 2025 Security Updates

Microsoft July 2025 Security Updates

Microsoft June 2025 Security Updates

Microsoft June Early 2025 Security Updates

Microsoft May 2025 Security Updates

Microsoft May Early 2025 Security Updates

Microsoft April 2025 Security Updates

Microsoft March 2025 Security Updates

Microsoft March 2025 Early Security Updates

Microsoft February 2025 Security Updates

Microsoft February 2025 Early Security Updates

Microsoft January 2025 Security Updates

Microsoft January 2025 Early Security Updates

Microsoft December 2024 Security Updates

Microsoft November 2024 Security Updates

Microsoft October 2024 Security Updates

Microsoft September 2024 Security Updates

Microsoft August 2024 Security Updates

Microsoft July 2024 Security Updates

Microsoft June 2024 Security Updates

Microsoft May 2024 Security Updates

Microsoft April 2024 Security Updates

Microsoft March 2024 Security Updates

Microsoft February 2024 Security Updates

Microsoft January 2024 Security Updates

Incorrect Privilege Assignment

Improper Privilege Management

Incorrect Privilege Assignment vulnerability in Modular DS allows Privilege Escalation.This issue affects Modular DS: from n/a through 2.5.1.

Modular DS

Incorrect Privilege Assignment vulnerability in Modular DS that allows privilege escalation. This issue affects Modular DS versions through 2.5.1.

Improper Control of Generation of Code ('Code Injection')

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The vulnerability, if exploited, could allow an unauthenticated 
miscreant to achieve remote code execution under OS system privileges of
 “taoimr” service, potentially resulting in complete compromise of the  model application server.

A code injection vulnerability exists in the "taoimr" service that could allow an unauthenticated attacker to achieve remote code execution under OS system privileges, potentially resulting in complete compromise of the model application server.

Code Injection

Leverage Executable Code in Non-Executable Files

Manipulating User-Controlled Variables

pan-os

Improper Check for Unusual or Exceptional Conditions

A vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to cause a denial of service (DoS) to the firewall. Repeated attempts to trigger this issue results in the firewall entering into maintenance mode.

PAN-OS

Prisma Access

Cloud NGFW

Palo Alto Networks

cyber_cafe_management_system

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Phpgurukul Cyber Cafe Management System v1.0 contains a SQL Injection vulnerability in the user management module. The application fails to properly validate user-supplied input in the username parameter of the add-users.php endpoint.

SQL Injection vulnerability in Phpgurukul Cyber Cafe Management System v1.0 in the user management module. The application fails to properly validate user-supplied input in the username parameter of the add-users.php endpoint, allowing attackers to inject malicious SQL commands.

Command Line Execution through SQL Injection

Object Relational Mapping Injection

SQL Injection through SOAP Parameter Tampering

Expanding Control over the Operating System from the Database

SQL Injection

Blind SQL Injection

Sites running NOAA PMEL Live Access Server (LAS) are vulnerable to remote code execution via specially crafted requests that include PyFerret expressions. By leveraging a SPAWN command, a remote, unauthenticated attacker can execute arbitrary OS commands. Fixed in a version of 'gov.noaa.pmel.tmap.las.filter.RequestInputFilter.java'  from 2025-09-24.

Live Access Server (LAS)

National Oceanic and Atmospheric Administration (NOAA)

NOAA PMEL Live Access Server (LAS) is vulnerable to remote code execution through specially crafted requests containing PyFerret expressions. The vulnerability exploits a SPAWN command that allows attackers to execute arbitrary operating system commands.

Command Delimiters

Exploiting Multiple Input Interpretation Layers

Argument Injection

OS Command Injection

imagick

Unrestricted Upload of File with Dangerous Type

File upload vulnerability in Omnispace Agora Project before 25.10 allowing attackers to execute code through the MSL engine of the Imagick library via crafted PDF file to the file upload and thumbnail functions.

File upload vulnerability in Omnispace Agora Project before version 25.10 that allows attackers to execute code through the MSL engine of the Imagick library via crafted PDF files submitted to the file upload and thumbnail functions.

Accessing Functionality Not Properly Constrained by ACLs

Services File Permissions Weakness

fortisiem

An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7.1.0 through 7.1.8, FortiSIEM 7.0.0 through 7.0.4, FortiSIEM 6.7.0 through 6.7.10 may allow an attacker to execute unauthorized code or commands via  crafted TCP requests.

FortiSIEM

Fortinet

An improper neutralization of special elements used in an OS command (OS Command Injection) vulnerability in Fortinet FortiSIEM allows an attacker to execute unauthorized code or commands via crafted TCP requests. Affected versions include FortiSIEM 7.4.0, 7.3.0 through 7.3.4, 7.2.0 through 7.2.6, 7.1.0 through 7.1.8, 7.0.0 through 7.0.4, and 6.7.0 through 6.7.10.

fortiguard.fortinet.com

Arcane provides modern docker management. Prior to 1.13.0, Arcane has a command injection in the updater service. Arcane’s updater service supported lifecycle labels com.getarcaneapp.arcane.lifecycle.pre-update and com.getarcaneapp.arcane.lifecycle.post-update that allowed defining a command to run before or after a container update. The label value is passed directly to /bin/sh -c without sanitization or validation. Because any authenticated user (not limited to administrators) can create projects through the API, an attacker can create a project that specifies one of these lifecycle labels with a malicious command. When an administrator later triggers a container update (either manually or via scheduled update checks), Arcane reads the lifecycle label and executes its value as a shell command inside the container. This vulnerability is fixed in 1.13.0.

Remote code execution (RCE) within the updated container context. Host filesystem access when host volumes are mounted into the container. Potential data exfiltration via outbound network requests or by exposing readable files. Potential full host compromise if sensitive mounts are present (e.g., /var/run/docker.sock).

Github Advisory

Search CVEs by ID

Trending Vulnerabilities

Latest Patch Tuesday Reports

January 2026 Patch Tuesday: 8 Critical Vulnerabilities Amid 112 CVEs

December 2025 Patch Tuesday: 10 Critical Vulnerabilities Amid 64 CVEs

December 2025 Early Security Update: 0 Critical Vulnerabilities Amid 1 CVEs

Browse

Be the first to know about critical vulnerabilities