https://cyberfeed.cesnet.czCESNET CyberFeed – Vulnerability Reportshttp://www.rssboard.org/rss-specificationpython-feedgenTue, 10 Nov 2026 16:35:41 +0000https://cyberfeed.cesnet.cz/reports/1119?lang=enVulnerabilities: Critical vulnerability in OpenSSH (*sshole)https://cyberfeed.cesnet.cz/reports/1119?lang=enhttps://cyberfeed.cesnet.cz/reports/1118?lang=enVulnerabilities: summaryhttps://cyberfeed.cesnet.cz/reports/1118?lang=enhttps://cyberfeed.cesnet.cz/reports/1117?lang=enIn version 1.26.2 of Unbound, NLnet Labs fixes 5 vulnerabilities. The most severe vulnerability is described below; the remaining ones can be found at. Vulnerabilities: NLnet Labs Unbound - DoS (CVE-2026-97206, CVSS 7.5), NLnet Labs Unbound - introductionhttps://cyberfeed.cesnet.cz/reports/1117?lang=enhttps://cyberfeed.cesnet.cz/reports/1116?lang=enGoogle Brotli fixes 1 critical vulnerability in versions 1.0.10, 1.1.1 and 1.2.1. If an update is not possible, it is recommended to block incoming requests with the Content-Encoding: br header at the WAF/proxy level. In Python, the Brotli/brotlicffi packages may be pulled in indirectly through the dependencies of HTTP clients and scanners may not identify them; as a temporary workaround, it is recommended to uninstall them, which makes clients automatically fall back to gzip and deflate. No active exploitation has been reported so far, but unverified PoCs have appeared. Further details, including commands for checking the versions of popular packages/tools that use brotli, can be found at. Individual Linux distribution releases and their fixed versions: Ubuntu: brotli: awaiting evaluation in all versions node.js: vulnerable only in the Focal release, no fixed version has been released yet Debian: brotli: bookworm (security) - 1.0.9-2+deb12u1 trixie (security) - 1.1.0-2+deb13u1 sid - 1.2.0-4.1 python-brotlicffi: sid - 1.2.1.0+ds-1 nodejs: No fixed version has been released yet for the bookworm, trixie, forky and sid releases Red Hat: None of the affected Red Hat products have fixes yet, except for Red Hat Hardened Images (brotli-main) - RHSA-2026:87420 Popular projects that use the Brotli library and their fixed versions: Node.js - 22.23.4, 24.22.1 and 26.12.1 Bun - 1.4.4 .NET - 8.0.33, 9.0.22, 10.0.14 and 11.0.0-rc.3.26522.148 Envoy - 1.36.12, 1.37.8, 1.38.6, 1.39.3 and 1.40.0 Istio - 1.29.9, 1.30.6 and 1.31.2 Python Brotli - 1.2.1 Python brotlicffi - 1.2.1.0 Vulnerabilities: Google Brotli - intro, Google Brotli - RCE, DoS (CVE-2026-111497, CVSS 9.2)https://cyberfeed.cesnet.cz/reports/1116?lang=enhttps://cyberfeed.cesnet.cz/reports/1115?lang=enGitLab fixes 12 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) in versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13, one of them critical. The most severe ones are described below; the rest can be found at. Vulnerabilities: GitLab - intro, GitLab - RCE (CVE-2026-110264, CVSS 10.0), GitLab - account takeover (CVE-2026-15723, CVSS 8.2), GitLab - authentication interception (CVE-2026-112212, CVSS 7.5)https://cyberfeed.cesnet.cz/reports/1115?lang=enhttps://cyberfeed.cesnet.cz/reports/1114?lang=enPHP (including SAPIs such as Apache mod_php, php-cgi, FrankenPHP or LiteSpeed) fixes 2 critical vulnerabilities in versions 8.5.12, 8.4.27, 8.3.36, 8.2.35 and backports for 8.1, 8.0 and 7.4. If you cannot update immediately, below is a list of temporary mitigations, which however do not replace a proper update. For CVE-2026-109618, it is recommended to set the parameter memory_limit = -1, limit the size of multipart requests in PHP via the post_max_size parameter to the lowest possible value, implement additional limits at the web server or proxy level (for the size of the decoded request, the number of input fields, the number of multipart parts, the number of headers and the nesting depth), and use cgroups instead of RLIMIT restrictions for container memory management. Details can be found here. For CVE-2026-109619, it is recommended to globally disable upload tracking (session.upload_progress.enabled = 0) in php.ini, the FPM pool or the server configuration, remove invalid or obsolete configuration settings that cause early warnings and handle crashes and timeouts that an attacker can trigger, and disable fatal_error_backtraces in PHP 8.5. Details can be found here. Individual Linux distribution releases and their fixed versions: Ubuntu: Stonking - 8.5.9-0ubuntu2.1 Resolute - 8.5.4-0ubuntu1.5 Noble - 8.3.6-0ubuntu0.24.04.13 Jammy - 8.1.2-1ubuntu2.28 Focal - 7.4.3-4ubuntu2.29+esm5 Bionic - 7.2.24-0ubuntu0.18.04.17+esm14 Xenial - 7.0.33-0ubuntu0.16.04.16+esm22 Trusty - 5.5.9+dfsg-1ubuntu4.29+esm18 Debian: bookworm (security) - 8.2.35~deb12u1 trixie (security) - 8.4.27~deb13u1 Red Hat: Red Hat Enterprise Linux 8 - fix available for php:7.4, details at Vulnerabilities: PHP - RCE (CVE-2026-109618, CVSS 9.2), PHP - intro, PHP - RCE (CVE-2026-109619, CVSS 9.2)https://cyberfeed.cesnet.cz/reports/1114?lang=enhttps://cyberfeed.cesnet.cz/reports/1113?lang=enVulnerabilities: summaryhttps://cyberfeed.cesnet.cz/reports/1113?lang=enhttps://cyberfeed.cesnet.cz/reports/1112?lang=enRoundcube fixes multiple vulnerabilities in Roundcube Webmail in versions 1.7.5 and 1.6.20, 1 of which has a published CVE and is described below. Vulnerabilities: Roundcube - intro, Roundcube - command injection (CVE-2026-113386, CVSS 7.1)https://cyberfeed.cesnet.cz/reports/1112?lang=enhttps://cyberfeed.cesnet.cz/reports/1111?lang=enVulnerabilities: summaryhttps://cyberfeed.cesnet.cz/reports/1111?lang=enhttps://cyberfeed.cesnet.cz/reports/1110?lang=enCisco fixes an actively exploited vulnerability in Cisco Secure Email Gateway (AsyncOS) in versions 16.5.0-780 and 15.5.5-014. The fix is also available by updating the Content Scanner Tools package to version 25.3.0.5525. Vulnerabilities: Cisco Secure Email Gateway - arbitrary file write (CVE-2026-76519, CVSS 9.8), Cisco Secure Email Gateway - introhttps://cyberfeed.cesnet.cz/reports/1110?lang=enhttps://cyberfeed.cesnet.cz/reports/1109?lang=enIvanti fixes an actively exploited vulnerability in Ivanti Connect Secure in versions 25.1.1.2, 25.1.3.0, 25.1.3.1 and 22.8R2.5. Vulnerabilities: Ivanti Connect Secure - RCE (CVE-2026-104935, CVSS 8.6), Ivanti Connect Secure - introhttps://cyberfeed.cesnet.cz/reports/1109?lang=enhttps://cyberfeed.cesnet.cz/reports/1108?lang=enFortinet fixes 14 vulnerabilities in 8 products. The most severe vulnerabilities are listed below. FortiSIEM - 7.6.0 FortiOS - 7.6.9, 8.0.1 FortiProxy - 7.6.7 FortiSwitch - 7.6.7 FortiSandbox - 5.2.2, 5.0.7 FortiAnalyzer - 7.6.5, 7.4.8, 7.2.12, 6.4.0 FortiManager - 8.0.1, 7.6.7, 7.4.7, 6.4.0 FortiMail - 7.6.4, 7.4.6, 7.2.9 Vulnerabilities: FortiSIEM - path traversal (CVE-2026-106173, CVSS 9.8), FortiSandbox - authentication bypass (CVE-2026-107656, CVSS 9.8), FortiOS, FortiProxy, FortiSwitch - DoS (CVE-2026-106175, CVSS 2.3), FortiAnalyzer (Cloud), FortiManager (Cloud) - SQL injection (CVE-2025-46773, CVE-2026-23705, CVE-2026-23706, CVE-2026-23707, CVSS 8.8), FortiMail - SQL injection (CVE-2025-57739, CVSS 8.8), Fortinet - introhttps://cyberfeed.cesnet.cz/reports/1108?lang=enhttps://cyberfeed.cesnet.cz/reports/1107?lang=enVulnerabilities: summaryhttps://cyberfeed.cesnet.cz/reports/1107?lang=enhttps://cyberfeed.cesnet.cz/reports/1106?lang=enMikroTik fixes a high-severity vulnerability in RouterOS in version 7.24.5. Vulnerabilities: MikroTik - intro, MikroTik RouterOS - privilege escalation (CVE-2026-103903, CVSS 8.7)https://cyberfeed.cesnet.cz/reports/1106?lang=enhttps://cyberfeed.cesnet.cz/reports/1105?lang=enGitLab fixes 24 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) in versions 19.4.2, 19.3.4 and 19.2.8, one of them critical. The most severe ones are described below; the rest can be found at. Vulnerabilities: GitLab - intro, GitLab CE/EE - RCE (CVE-2026-97229, CVSS 10.0), GitLab CE/EE - XSS (CVE-2026-92883, CVSS 8.7), GitLab CE/EE - improper authorization (CVE-2026-16301, CVSS 8.5)https://cyberfeed.cesnet.cz/reports/1105?lang=enhttps://cyberfeed.cesnet.cz/reports/1104?lang=enCitrix fixes a critical vulnerability in NetScaler ADC and NetScaler Gateway. Only devices using SAML are vulnerable, and the specific affected versions differ depending on whether they are configured as a service provider (SP) or an identity provider (IdP). Details are available at. Products and their fixed versions: Citrix NetScaler ADC - 13.1-37.283 FIPS, 13.1-37.283 NDcPP, 13.1-64.29, 14.1-73.46, 14.1-73.46 FIPS Citrix NetScaler Gateway - 13.1-64.29, 14.1-73.46 Vulnerabilities: Citrix - intro, NetScaler ADC, NetScaler Gateway - RCE (CVE-2026-107406, CVSS 9.5)https://cyberfeed.cesnet.cz/reports/1104?lang=enhttps://cyberfeed.cesnet.cz/reports/1103?lang=enGitea version 28.1.0 fixes 11 vulnerabilities. The most severe of them are described below; you can find the rest at. Vulnerabilities: Gitea - intro, Gitea - XSS (CVE-2026-96594, CVSS 8.5), Gitea - authorization bypass (CVE-2026-97208, CVSS 8.1), Gitea - improper authorization (CVE-2026-86684, CVSS 7.1)https://cyberfeed.cesnet.cz/reports/1103?lang=enhttps://cyberfeed.cesnet.cz/reports/1102?lang=enSonicWall fixes 4 vulnerabilities in the SMA1000 product (models 6210, 7210 and 8200v). The fix is available as a platform-hotfix in versions 12.4.3-03670 and 12.5.0-03082. Vulnerabilities: SonicWall - intro, SonicWall SMA1000 - SSRF (CVE-2026-102255, CVSS 10.0), SonicWall SMA1000 - RCE (CVE-2026-102256, CVSS 7.8), SonicWall SMA1000 - RCE (CVE-2026-102257, CVSS 7.2), SonicWall SMA1000 - XSS (CVE-2026-102258, CVSS 5.5)https://cyberfeed.cesnet.cz/reports/1102?lang=enhttps://cyberfeed.cesnet.cz/reports/1101?lang=enSplunk fixes more than 83 vulnerabilities in Splunk Enterprise, Splunk MCP Server and Splunk Add-on for Amazon Web Services. A large part of them concern third-party components. For four medium-severity vulnerabilities, CVE-2026-76264, CVE-2026-76265, CVE-2026-76272 and CVE-2026-76280, the update alone is not enough; additional steps are required, which Splunk describes at. The most severe vulnerabilities are described below; you can find the rest at. Individual products and their fixed versions: Splunk Enterprise – 10.4.3, 10.2.7, 10.0.10, 9.4.15 Splunk MCP Server – 1.2.1 Splunk Add-on for Amazon Web Services – 8.2.2 Vulnerabilities: Splunk - intro, Splunk Enterprise - RCE (CVE-2026-76268, CVSS 9.8), Splunk Enterprise - privilege escalation (CVE-2026-76266, CVSS 7.7), Splunk Enterprise - SQL injection (CVE-2026-76270, CVSS 6.5)https://cyberfeed.cesnet.cz/reports/1101?lang=enhttps://cyberfeed.cesnet.cz/reports/1099?lang=enHPE fixes 37 vulnerabilities in Networking AOS-Switch and Networking ClearPass Policy Manager. The most severe of them are described below; you can find the rest at. Individual products and their fixed versions: HPE Networking AOS-Switch – 16.11.0032 HPE Networking ClearPass Policy Manager – 6.14.1, 6.11.16 Vulnerabilities: HPE - intro, HPE Networking AOS-Switch - RCE (CVE-2026-76744, CVSS 9.8), HPE Networking AOS-Switch - authentication bypass (CVE-2026-76742, CVSS 9.8), HPE Networking ClearPass Policy Manager - RCE (CVE-2026-76750, CVSS 9.8), HPE Networking AOS-Switch - RCE (CVE-2026-76745, CVSS 9.6), HPE Networking ClearPass Policy Manager - SQL injection (CVE-2026-79798, CVSS 9.9)https://cyberfeed.cesnet.cz/reports/1099?lang=enhttps://cyberfeed.cesnet.cz/reports/1098?lang=enVeeam Backup & Replication version 12.3.2.4934 fixes 3 vulnerabilities, one of them critical. Vulnerabilities: Veeam - intro, Veeam Backup & Replication - RCE (CVE-2025-64393, CVSS 9.4), Veeam Backup & Replication - improper access control (CVE-2026-93026, CVSS 6.1), Veeam Backup Enterprise Manager - XSS (CVE-2025-64392, CVSS 4.8)https://cyberfeed.cesnet.cz/reports/1098?lang=enhttps://cyberfeed.cesnet.cz/reports/1097?lang=enAtlassian fixes a critical vulnerability in various products. Products and their fixed versions: Bitbucket Data Center - 9.4.26, 10.2.8, 10.5.1 Confluence Data Center - 9.2.26, 10.2.19 Jira Service Management Data Center - 5.12.40, 10.3.26, 11.3.12 Jira Software Data Center - 9.12.40, 10.3.26, 11.3.12 Bamboo Data Center - 10.2.24, 12.1.12 Crowd Data Center - 6.3.7, 7.0.3, 7.1.7, 7.2.4 Crucible - 4.9.15 Fisheye - 4.9.15 Vulnerabilities: Atlassian - intro, Atlassian Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye - arbitrary file access (CVE-2026-21589, CVSS 9.3)https://cyberfeed.cesnet.cz/reports/1097?lang=enhttps://cyberfeed.cesnet.cz/reports/1096?lang=enVulnerabilities: summaryhttps://cyberfeed.cesnet.cz/reports/1096?lang=enhttps://cyberfeed.cesnet.cz/reports/1095?lang=enMikroTik fixes a critical vulnerability in RouterOS with version 7.24. Vulnerabilities: MikroTik - intro, MikroTik RouterOS - RCE, DoS (CVE-2026-84411, CVSS 9.3)https://cyberfeed.cesnet.cz/reports/1095?lang=enhttps://cyberfeed.cesnet.cz/reports/1094?lang=enCitrix fixes an actively exploited high-severity vulnerability in NetScaler ACD and NetScaler Gateway. Products and their fixed versions: Citrix NetScaler ADC - 13.1-37.282 FIPS, 13.1-37.282 NDcPP, 13.1-64.28, 14.1-73.41, 14.1-73.41 FIPS Citrix NetScaler Gateway - 13.1-64.28, 14.1-73.41 Vulnerabilities: Citrix - intro, Citrix NetScaler ADC, Citrix NetScaler Gateway - DoS (CVE-2026-88779, CVSS 8.7)https://cyberfeed.cesnet.cz/reports/1094?lang=enhttps://cyberfeed.cesnet.cz/reports/1093?lang=enVulnerabilities: summaryhttps://cyberfeed.cesnet.cz/reports/1093?lang=enhttps://cyberfeed.cesnet.cz/reports/1092?lang=enFortinet warns of an actively exploited vulnerability in FortiMail. The fix will be included in versions 7.4.9, 7.6.7 and 8.0.2, which are not yet available at the time this report was published. Vulnerabilities: Fortinet - intro, FortiMail - writing of arbitrary files (CVE-2026-104286, CVSS 9.8)https://cyberfeed.cesnet.cz/reports/1092?lang=enhttps://cyberfeed.cesnet.cz/reports/1091?lang=enOpenSSL versions 3.4.8, 3.5.9, 3.6.5, 4.0.3 (for customers with premium support also 1.0.2zs, 1.1.1zj, 3.0.23) fix 14 vulnerabilities. The most severe of them are described below. Fixed versions of the library: OpenSSL - 3.4.8, 3.5.9, 3.6.5, 4.0.3 OpenSSL (premium support) - 1.0.2zs, 1.1.1zj, 3.0.23, 3.4.8, 3.5.9, 3.6.5, 4.0.3 Debian releases and their fixed versions: trixie (security) - 3.5.7-1~deb13u3 sid - 3.6.5-1 Ubuntu releases and their fixed versions: 26.04 LTS resolute - libssl3t64 – 3.5.5-1ubuntu3.7 24.04 LTS noble - libssl3t64 – 3.0.13-0ubuntu3.16 22.04 LTS jammy - libssl3 – 3.0.2-0ubuntu1.30 Vulnerabilities: OpenSSL - intro, OpenSSL - DoS (CVE-2026-84782, CVSS 8.2), OpenSSL - DoS (CVE-2026-84783, CVSS 7.5)https://cyberfeed.cesnet.cz/reports/1091?lang=enhttps://cyberfeed.cesnet.cz/reports/1090?lang=enHPE fixes 13 vulnerabilities in its products. The most severe of them are listed below. Products and their fixed versions: HPE Compute Scale-up Server 3200 - 1.76.44 and later HPE Compute Scale-up Server 3250 - 1.02.48 and later HPE Superdome Flex Server - 4.17.03 and later HPE Superdome Flex 280 Server - 2.17.03 and later HPE Unified OSS Console Core - 3.1.23 HPE OneView - 11.40 and later Vulnerabilities: HPE Aruba Networking - intro, HPE Compute Scale-up Server 3200 & 3250, Superdome Flex & Superdome Flex 280 servers - RCE, DoS (CVE-2026-45447, CVSS 8.8), HPE Unified OSS Console Core - MITM (CVE-2026-44494, CVSS 8.7), HPE OneView - XSS (CVE-2026-76719, CVSS 8.2)https://cyberfeed.cesnet.cz/reports/1090?lang=enhttps://cyberfeed.cesnet.cz/reports/1089?lang=enCitrix NetScaler fixes 8 vulnerabilities in its products, two of which have been marked as actively exploited. A selection of the most severe ones can be found below. Products and their fixed versions: NetScaler ADC: 13.1-37.279 FIPS, 13.1-37.279 NDcPP, 13.1-64.23; 14.1-73.37; 14.1-73.37 FIPS NetScaler Gateway: 13.1-64.23, 14.1-73.37 Vulnerabilities: Citrix NetScaler - intro, Citrix NetScaler ADC & Gateway - RCE (CVE-2026-88771, CVSS 9.5), Citrix NetScaler ADC & Gateway - RCE, DoS (CVE-2026-88772, CVSS 9.5), Citrix NetScaler ADC & Gateway - HTTP request smuggling (CVE-2026-88773, CVSS 9.3), Citrix NetScaler ADC & Gateway - DoS (CVE-2026-88775, CVSS 8.8), Citrix NetScaler ADC & Gateway - session hijacking, DoS (CVE-2026-88778, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/1089?lang=enhttps://cyberfeed.cesnet.cz/reports/1088?lang=enVulnerabilities: summaryhttps://cyberfeed.cesnet.cz/reports/1088?lang=enhttps://cyberfeed.cesnet.cz/reports/1087?lang=enOpenStack fixes 6 vulnerabilities in various products. Products and their fixed versions: - Octavia: 16.1.0, 17.0.1, 18.0.1 - Zaqar: 20.1.2, 21.0.2, 22.0.2 - Blazar: 15.1.1, 16.0.1, 17.0.1 - Swift: 2.35.5, 2.36.4, 2.37.4, 2.38.2 Vulnerabilities: OpenStack - intro, OpenStack Octavia - RCE (CVE-2026-94572, CVSS 9.4), OpenStack Octavia - RCE (CVE-2026-94571, CVSS 9.4), OpenStack Zaqar - authentication bypass (CVE-2026-97404, CVSS 9.2), OpenStack Blazar - authorization bypass (CVE-2026-93854, CVSS 7.2), OpenStack Blazar - information disclosure (CVE-2026-93852, CVSS 7.1), OpenStack Swift - information disclosure (CVE-2026-97149, CVSS 5.3)https://cyberfeed.cesnet.cz/reports/1087?lang=enhttps://cyberfeed.cesnet.cz/reports/1086?lang=enWordPress version 7.1.2 fixes a critical, actively exploited vulnerability. Only the 7.1 series is actively maintained, but the fix has also been released for all older branches down to 4.7. Vulnerabilities: WordPress - intro, WordPress - RCE (CVE-2026-87902, CVSS 9.2)https://cyberfeed.cesnet.cz/reports/1086?lang=enhttps://cyberfeed.cesnet.cz/reports/1085?lang=enGitLab versions 19.2.7, 19.3.3 and 19.4.1 fix 11 vulnerabilities in GitLab CE/EE. The most severe of them are listed below. Vulnerabilities: GitLab - intro, GitLab - RCE (CVE-2026-89078, CVSS 9.9), GitLab - RCE (CVE-2026-93577, CVSS 9.9), GitLab - XSS (CVE-2026-84739, CVSS 8.7)https://cyberfeed.cesnet.cz/reports/1085?lang=enhttps://cyberfeed.cesnet.cz/reports/1084?lang=enSolarWinds fixes 3 vulnerabilities in Observability Self-Hosted and Access Rights Manager. Individual products and their fixed versions: SolarWinds Access Rights Manager – 2026.2.1 SolarWinds Observability Self-Hosted – 2026.2.3 Vulnerabilities: SolarWinds - intro, SolarWinds Access Rights Manager - RCE (CVE-2026-28326, CVSS 8.8), SolarWinds Observability Self-Hosted - RCE (CVE-2026-28324, CVSS 9.8), SolarWinds Observability Self-Hosted - RCE (CVE-2026-28325, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/1084?lang=enhttps://cyberfeed.cesnet.cz/reports/1083?lang=enF5 fixes a critical, actively exploited vulnerability in BIG-IP. Vulnerabilities: F5 BIG-IP – intro, F5 BIG-IP – RCE (CVE-2026-94127, CVSS 9.3)https://cyberfeed.cesnet.cz/reports/1083?lang=enhttps://cyberfeed.cesnet.cz/reports/1082?lang=enArista fixes a critical, actively exploited vulnerability in VeloCloud Orchestrator (VCO) On-Prem, a solution for central management of SD-WAN infrastructure. So far, only the 5.2 (version 5.2.3.16) and 6.4 (version 6.4.2.8) trains have been fixed. Fixes for trains 6.1 and 7.0 have not been released yet. Arista had already fixed the hosted and dedicated VCO instances earlier. Vulnerabilities: Arista - intro, VeloCloud Orchestrator - unauthorized access (CVE-2026-93952, CVSS 9.5)https://cyberfeed.cesnet.cz/reports/1082?lang=enhttps://cyberfeed.cesnet.cz/reports/1081?lang=enMikroTik version 7.25beta4 fixes a high-severity vulnerability in RouterOS. Vulnerabilities: MikroTik - intro, MikroTik - DoS (CVE-2026-93345, CVSS 8.7)https://cyberfeed.cesnet.cz/reports/1081?lang=enhttps://cyberfeed.cesnet.cz/reports/1080?lang=enExim version 4.100.1 fixes four vulnerabilities, two of which are high-severity. The most severe ones are described below; all of them can be found at. Vulnerabilities: Exim – intro, Exim – unauthorized read (CVE-2026-94056, CVSS 7.5), Exim – out-of-bounds write, heap corruption (CVE-2026-94054, CVSS 7.0), Exim – SMTP smuggling (CVE-2026-94057, CVSS 4.0)https://cyberfeed.cesnet.cz/reports/1080?lang=enhttps://cyberfeed.cesnet.cz/reports/1079?lang=enCISA warns of a now actively exploited, high-severity vulnerability from 16 June 2026 in the firmware of Zyxel GS1900 series switches. Affected models and their fixed versions: GS1900-8 – 2.90(AAHH.2)C0 GS1900-8HP – 2.90(AAHI.2)C0 GS1900-10HP – 2.90(AAZI.2)C0 GS1900-16 – 2.90(AAHJ.2)C0 GS1900-24 – 2.90(AAHL.2)C0 GS1900-24E – 2.90(AAHK.2)C0 GS1900-24EP – 2.90(ABTO.2)C0 GS1900-24HPv2 – 2.90(ABTP.2)C0 GS1900-48 – 2.90(AAHN.2)C0 GS1900-48HPv2 – 2.90(ABTQ.2)C0 Vulnerabilities: Zyxel – intro, Zyxel GS1900 – buffer overflow, OS command execution (CVE-2026-7273, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/1079?lang=enhttps://cyberfeed.cesnet.cz/reports/1078?lang=enVulnerabilities: summaryhttps://cyberfeed.cesnet.cz/reports/1078?lang=enhttps://cyberfeed.cesnet.cz/reports/1077?lang=enBIND 9 fixes 14 vulnerabilities. Selected high-severity vulnerabilities are described below, the rest can be found at. Products and their fixed versions: BIND 9 - 9.20.29, 9.21.26 BIND Supported Preview Edition - 9.20.29-S1 Debian releases and their fixed versions: trixie (security) - 1:9.20.29-1~deb13u1 (all vulnerabilities except CVE-2026-78301, CVE-2026-19941) sid (unstable) - 1:9.20.29-1 Vulnerabilities: BIND 9 - intro, BIND 9 - DoS (CVE-2026-81736, CVSS 7.5), BIND 9 - DoS (CVE-2026-77692, CVSS 7.5), BIND 9 - DoS (CVE-2026-80274, CVSS 7.5)https://cyberfeed.cesnet.cz/reports/1077?lang=enhttps://cyberfeed.cesnet.cz/reports/1076?lang=enCisco fixes 77 vulnerabilities in Cisco Secure Firewall Management Center Software, Cisco Identity Services Engine, Cisco Identity Services Engine Passive Identity Connector, Cisco Nexus Dashboard, Cisco Secure Firewall Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense, Software, Cisco Secure Firewall Management Center, Cisco ThousandEyes Virtual Appliance and Cisco BroadWorks CommPilot Application Software,. Selected vulnerabilities are described below, and the remaining high-severity and critical vulnerabilities and fixed product versions can be found at. Vulnerabilities: Cisco - intro, Cisco Identity Services Engine, Cisco Identity Services Engine Passive Identity Connector - authentication bypass (CVE-2026-76460, CVSS 10.0), Cisco Identity Services Engine, Cisco Identity Services Engine Passive Identity Connector - authentication bypass (CVE-2026-76423, CVSS 10.0), Cisco Identity Services Engine - RCE, DoS (CVE-2026-20307, CVSS 9.9), Cisco Identity Services Engine - SQL, DoS (CVE-2026-20284, CVSS 9.1), Cisco Secure Firewall Management Center - command execution (CVE-2026-20341, CVSS 9.1), Cisco Secure Firewall Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software - improper neutralization (CVE-2026-20330, CVSS 9.9)https://cyberfeed.cesnet.cz/reports/1076?lang=enhttps://cyberfeed.cesnet.cz/reports/1075?lang=enVulnerabilities: summaryhttps://cyberfeed.cesnet.cz/reports/1075?lang=enhttps://cyberfeed.cesnet.cz/reports/1074?lang=enDocker fixes a critical and a high-severity vulnerability in Docker Sandboxes with version 0.42.0. Vulnerabilities: Docker - intro, Docker Sandboxes (macOS) - unauthorized access, code execution (CVE-2026-77179, CVSS 9.4), Docker Sandboxes - unauthorized access (CVE-2026-79994, CVSS 8.7)https://cyberfeed.cesnet.cz/reports/1074?lang=enhttps://cyberfeed.cesnet.cz/reports/1073?lang=enAcronis fixes a high-severity vulnerability in its backup plugin for cPanel & WHM (1.9.3 HF3) and extension for Plesk (1.8.11) on Linux; active exploitation has been observed for the cPanel & WHM plugin. Vulnerabilities: Acronis - intro, Acronis Backup plugin for cPanel & WHM, Backup extension for Plesk - privilege escalation (CVE-2026-87886, CVSS 7.8)https://cyberfeed.cesnet.cz/reports/1073?lang=enhttps://cyberfeed.cesnet.cz/reports/1072?lang=enFFmpeg versions 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 fix 2 vulnerabilities. In addition to the vulnerabilities described below, 2 low-severity vulnerabilities (CVE-2026-52296, CVE-2026-52297) were disclosed, the fix for which is only in version 9.0. Vulnerabilities: FFmpeg - out-of-bounds read (CVE-2026-90815, CVSS 5.3), FFmpeg - DoS (CVE-2026-90816, CVSS 5.3), FFmpeg - introhttps://cyberfeed.cesnet.cz/reports/1072?lang=enhttps://cyberfeed.cesnet.cz/reports/1071?lang=enZephyr Project version 4.4.2 fixes 9 vulnerabilities in the Zephyr operating system. The most severe vulnerabilities are listed below. Vulnerabilities: Zephyr - intro, Zephyr Project - DoS (CVE-2026-15891, CVSS 7.5), Zephyr Project - DoS, RCE (CVE-2026-14986, CVSS 6.8), Zephyr Project - DoS, RCE (CVE-2026-16147, CVSS 6.8)https://cyberfeed.cesnet.cz/reports/1071?lang=enhttps://cyberfeed.cesnet.cz/reports/1070?lang=enCisco fixes critical and high-severity vulnerabilities in Cisco IOS XR Software, Cisco AsyncOS for Cisco Secure Email Gateway, Cisco Secure Email and Web Manager and Cisco Secure Email Gateway. The most severe vulnerabilities can be found below. Fixed products and their versions: Cisco IOS XR Software - 26.2.2, 26.3.1. The fixed SMUs can be found at. Cisco AsyncOS for Cisco Secure Email Gateway Software - 15.5.5-014, 16.0.4-302, 16.5.0-780 Cisco Secure Email Gateway - 15.5.5-014, 16.5.0-780 Cisco Secure Email and Web Manager - 15.5.5-006, 16.5.0-429 Vulnerabilities: Cisco - intro, Cisco IOS XR Software - DoS (CVE-2026-20274, CVSS 9.8), Cisco AsyncOS for Cisco Secure Email Gateway - privilege escalation, ACE (CVE-2026-76461, CVSS 9.8), Cisco Secure Email Gateway, Secure Email and Web Manager - DoS (CVE-2026-76440, CVSS 9.8), Cisco Secure Email Gateway, Secure Email and Web Manager - DoS (CVE-2026-76441, CVSS 9.8)https://cyberfeed.cesnet.cz/reports/1070?lang=enhttps://cyberfeed.cesnet.cz/reports/1069?lang=enVulnerabilities: summaryhttps://cyberfeed.cesnet.cz/reports/1069?lang=enhttps://cyberfeed.cesnet.cz/reports/1068?lang=enFortinet fixes 11 vulnerabilities in various products. The most severe vulnerabilities are listed below. Individual products and their fixed versions: FortiMonitorOnSight - 7.2.8 FortiPAM - 1.9.1 FortiPAM Chrome Extension - 8.0.1.123 FortiSandbox (including Cloud) - 4.4.10, 5.0.7, 5.2.1 FortiOS - 7.6.7 FortiProxy - 7.6.7 FortiAnalyzer - 7.6.7 FortiSOAR - 7.5.4, 7.6.7 FortiClient Windows - 7.4.8 FortiManager (including Cloud) - 7.4.11, 7.6.5 FortiSIEM - 7.5.2 Vulnerabilities: FortiMonitorOnSight - (CVE-2026-84390, CVSS 9.8), FortiPAM, FortiPAM Chrome Extension - (CVE-2026-84388, CVSS 9.6), FortiSandbox, FortiSandbox Cloud, FortiSandbox PaaS - (CVE-2026-26084, CVSS 9.9), FortiOS, FortiProxy - (CVE-2026-84393, CVSS 8.1), FortiSandbox - (CVE-2026-84387, CVSS 7.2), FortiAnalyzer - (CVE-2026-84391, CVSS 6.5), FortiSOAR PaaS, FortiSOAR on-premise - (CVE-2026-84385, CVSS 5.4), FortiClient Windows - (CVE-2026-84386, CVSS 5.1), FortiManager, FortiManager Cloud - (CVE-2026-22575, CVSS 4.9), FortiSIEM - (CVE-2026-84389, CVSS 3.1), FortiOS, FortiPAM, FortiProxy - (CVE-2026-84392, CVSS 2.7), Fortinet - introhttps://cyberfeed.cesnet.cz/reports/1068?lang=enhttps://cyberfeed.cesnet.cz/reports/1067?lang=enGitLab versions 19.3.2, 19.2.6 and 19.1.8 fix 18 vulnerabilities, 2 of them critical, in GitLab Community Edition (CE) and GitLab Enterprise Edition (EE). The most severe vulnerabilities are listed below. Vulnerabilities: GitLab - intro, GitLab CE/EE - arbitrary file read (CVE-2026-85706, CVSS 10.0), GitLab EE - credential disclosure (CVE-2026-87719, CVSS 9.9), GitLab EE - RCE (CVE-2026-88765, CVSS 8.5), GitLab EE - privilege escalation (CVE-2026-79708, CVSS 8.5)https://cyberfeed.cesnet.cz/reports/1067?lang=enhttps://cyberfeed.cesnet.cz/reports/1066?lang=enPostfix fixes several vulnerabilities in versions 3.11.7, 3.10.14, 3.9.15, 3.8.21, 3.7.23, 3.6.21 and 3.5.28. Vulnerabilities: Postfix - DoS (CVSS 7.5), Postfix - SMTP smuggling (CVSS 7.5), Postfix - introhttps://cyberfeed.cesnet.cz/reports/1066?lang=enhttps://cyberfeed.cesnet.cz/reports/1065?lang=enOpenVPN fixes 8 vulnerabilities in version 2.7.7, 7 of which affect only Windows instances. The most severe vulnerabilities are described below, the rest can be found at. Vulnerabilities: OpenVPN - DoS (CVE-2026-84732, CVSS 8.7), OpenVPN (Windows) - RCE (CVE-2026-84226, CVSS 8.5), OpenVPN (Windows) - command injection (CVE-2026-84256, CVSS 7.7), OpenVPN (Windows) - buffer overread (CVE-2026-78221, CVSS 5.9), OpenVPN - introhttps://cyberfeed.cesnet.cz/reports/1065?lang=enhttps://cyberfeed.cesnet.cz/reports/1064?lang=enAdobe has released an out-of-band hotfix VULN-39341 for a critical, actively exploited vulnerability in Adobe Commerce, Adobe Commerce B2B and Magento Open Source. Deploying the hotfix alone is not sufficient; Adobe requires subsequent rotation of the encryption key and all access credentials. Known IoCs can be found at. Vulnerabilities: Adobe - intro, Adobe Commerce & Magento Open Source - arbitrary code execution (CVE-2026-75650, CVSS 10.0)https://cyberfeed.cesnet.cz/reports/1064?lang=enhttps://cyberfeed.cesnet.cz/reports/1063?lang=enMikroTik fixes 6 vulnerabilities in RouterOS in versions 7.24.2, 7.23.4 and 6.49.21, 3 of which (described below) can be chained and exploited to take complete control of the machine. According to MikroTik, these chainable vulnerabilities are being actively exploited. The remaining vulnerabilities can be found at. If the machine has been accessed without authorization, it may be marked by the "Flagged" mechanism - more details at. This mechanism alone cannot be relied upon, and other possible signs of compromise must also be checked, e.g. reviewing logs for suspicious strings and unknown changes in the file system. Known IoCs can be found at. If updating is not possible, as a temporary mitigation it is possible to restrict access to the device's publicly accessible ports to trusted IP addresses only, not to create TLS connections from non-updated devices, and not to use the built-in SSH client. Vulnerabilities: MikroTik - authentication bypass (CVE-2026-67279, CVSS 6.9), MikroTik - SSH key falsification (CVE-2026-67276, CVSS 9.2), MikroTik - privilege escalaiton (CVE-2026-86060, CVSS 9.2), MikroTik - introhttps://cyberfeed.cesnet.cz/reports/1063?lang=enhttps://cyberfeed.cesnet.cz/reports/1062?lang=enBroadcom fixes 2 vulnerabilities in VMware Workstation and VMware Fusion with version 26H1u1, one of them critical. Vulnerabilities: VMware Workstation & Fusion - intro, VMware Workstation & Fusion - RCE (CVE-2026-59346, CVSS 9.3), VMware Workstation & Fusion - RCE (CVE-2026-59347, CVSS 8.1)https://cyberfeed.cesnet.cz/reports/1062?lang=enhttps://cyberfeed.cesnet.cz/reports/1061?lang=enVulnerabilities: summaryhttps://cyberfeed.cesnet.cz/reports/1061?lang=enhttps://cyberfeed.cesnet.cz/reports/1060?lang=enCisco fixes 9 vulnerabilities in its products, 3 of them critical in Cisco IOS XR and Cisco Nexus 9000 Series. The vulnerability in Cisco Nexus 9000 is described below; the remaining vulnerabilities can be found at. Products and their fixes: Cisco IOS XR - SMUs available: 7.3.2, 7.9.2, 7.9.21, 7.10.2, 7.11.2, 7.11.21, 24.2.2, 24.2.21, 24.4.2, 25.2.21, 25.4.1, 25.4.2, 26.1.2, 26.2.1 - SMUs in preparation: 24.1.2, 24.3.2, 25.1.2, 25.2.2 - first fixed releases without the need for an SMU: 26.2.2, 26.3.1 (future release) Cisco SIP Software - 5.0(1), 14.4(1)SR3, 14.4(1)SR4, 11.0(6)SR8 Cisco Nexus 9000 Series Switches - fix availability can be verified using the Cisco Software Checker tool Vulnerabilities: Cisco - intro, Cisco Nexus 9000 - RCE (CVE-2026-20212, CVSS 9.8)https://cyberfeed.cesnet.cz/reports/1060?lang=enhttps://cyberfeed.cesnet.cz/reports/1059?lang=enHPE Aruba Networking fixes 86 vulnerabilities in its products. The most severe vulnerabilities are listed below. Products and their fixed versions: HPE Networking Fabric Composer - 7.4.0, 7.3.4 HPE Aruba Networking AOS-CX - 10.18.1002, 10.17.1030, 10.16.1060, 10.13.1190, 10.10.1181 Vulnerabilities: HPE Aruba Networking - intro, HPE Networking Fabric Composer - authentication bypass (CVE-2026-76657, CVSS 10.0), HPE Networking Fabric Composer - RCE (CVE-2026-76658, CVSS 10.0), HPE Aruba Networking AOS-CX - RCE (CVE-2026-73749, CVSS 9.8), HPE Networking Fabric Composer - arbitrary code execution (CVE-2026-19766, CVSS 9.6), HPE Networking Fabric Composer - RCE (CVE-2026-73701, CVSS 9.0)https://cyberfeed.cesnet.cz/reports/1059?lang=enhttps://cyberfeed.cesnet.cz/reports/1058?lang=enSonicWall fixes two vulnerabilities in SMA1000 via hotfixes 12.4.3-03526 and 12.5.0-02952. The affected models are SMA1000 6210, 7210 and 8200v; SSL-VPN on SonicWall firewalls and the SMA 100 series are not affected. SonicWall is aware of active exploitation, and CISA has already added the vulnerabilities to its list of actively exploited vulnerabilities. Vulnerabilities: SonicWall - intro, SonicWall SMA1000 - SSRF (CVE-2026-83548, CVSS 10.0), SonicWall SMA1000 - RCE (CVE-2026-83549, CVSS 7.8)https://cyberfeed.cesnet.cz/reports/1058?lang=enhttps://cyberfeed.cesnet.cz/reports/1057?lang=enMozilla fixes over 30 vulnerabilities in various products. The most severe vulnerabilities are listed below. Individual products and their fixed versions: Firefox - 155 Firefox ESR - 115.40, 140.15, 153.2 Firefox for iOS - 155.0 Thunderbird - 140.15, 153.2, 155 Vulnerabilities: Mozilla Firefox - intro, Mozilla Firefox, Firefox ESR, Thunderbird - sandbox escape (CVE-2026-84119, CVSS 9.6), Mozilla Firefox, Firefox ESR, Thunderbird - sandbox escape (CVE-2026-84121, CVSS 9.6), Mozilla Firefox ESR, Thunderbird - sandbox escape (CVE-2026-75874, CVSS 10.0), Mozilla Firefox, Firefox ESR - privilege escalation (CVE-2026-84123, CVSS 8.8), Mozilla Firefox - privilege escalation (CVE-2026-84117, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/1057?lang=enhttps://cyberfeed.cesnet.cz/reports/1024?lang=enGitLab versions 19.3.1, 19.2.5 and 19.1.7 fix 7 vulnerabilities in GitLab Community Edition (CE) and GitLab Enterprise Edition (EE). The most severe vulnerabilities are listed below. Vulnerabilities: GitLab CE/EE - intro, GitLab EE - arbitrary command execution (CVE-2026-18252, CVSS 7.3), GitLab CE/EE - DoS (CVE-2026-77801, CVSS 6.5), GitLab EE - DoS (CVE-2025-10903, CVSS 6.5)https://cyberfeed.cesnet.cz/reports/1024?lang=enhttps://cyberfeed.cesnet.cz/reports/1023?lang=enAs part of its August patches, VMware Spring fixes 91 vulnerabilities in various products. Selected vulnerabilities are described below. The full list of vulnerabilities, including fixed versions, can be found at by expanding the individual advisories. Vulnerabilities: VMware Spring - intro, Spring Security - LDAP Directory Flaw (CVE-2026-59270, CVSS 9.4), Spring Authorization Server - XSS (CVE-2026-59316, CVSS 8.2), Spring Integration - information disclosure, reply mis-routing (CVE-2026-59324, CVSS 8.2), Spring for GraphQL - RCE (CVE-2026-59285, CVSS 8.1), Spring AI - privilege escalation (CVE-2026-59318, CVSS 6.5)https://cyberfeed.cesnet.cz/reports/1023?lang=enhttps://cyberfeed.cesnet.cz/reports/1022?lang=enVulnerabilities: summaryhttps://cyberfeed.cesnet.cz/reports/1022?lang=enhttps://cyberfeed.cesnet.cz/reports/1021?lang=enCisco fixes 15 vulnerabilities in its products, 9 of them critical in the products Secure Workload and Crosswork, which it published grouped by class of flaw, without further details on the individual flaws. The most severe of the other vulnerabilities are described below, the rest can be found at. Products and their fixed versions: Cisco Secure Workload – 3.10.9.1, 4.0.4.16 Cisco Crosswork – 7.2.1-SP Cisco BroadWorks – RI.2026.07 Cisco Packaged Contact Center Enterprise, Cisco Unified Contact Center Enterprise – 15.0(1)ES202607 Cisco RoomOS – 11.32.7.0, 11.40.1.1, 26.7.2.2, 26.7.1.12 Cisco Industrial Ethernet 1000 Series Switches – 1.9.6 Cisco Unified Intelligence Center – 12.6(2) ES08, 15.0(1) SU2 *For Cisco Secure Workload, the Cluster, Agent and Connector software must all be updated. For SaaS deployments, Cisco has already updated the Cluster and customers only need to update the Agent and Connector. Vulnerabilities: Cisco - intro, Cisco BroadWorks - information disclosure (CVE-2026-20320, CVSS 7.5), Cisco Unified Intelligence Center - SQL injection (CVE-2026-20327, CVSS 6.5), Cisco RoomOS - RCE (CVE-2026-20302, CVSS 6.1)https://cyberfeed.cesnet.cz/reports/1021?lang=enhttps://cyberfeed.cesnet.cz/reports/1020?lang=enOracle fixes over 900 vulnerabilities in its products as part of the Critical Security Patch Update. The most severe vulnerabilities are described below; the rest, as well as instructions for applying the fix, can be found at. Vulnerabilities: Oracle - intro, Oracle Database Server - RCE (CVE-2026-71063, CVE-2026-71064, CVSS 9.6), Oracle Database Server - unauthorized data modification (CVE-2026-71102, CVSS 9.1), Oracle Database Server - RCE (CVE-2026-71062, CVSS 8.5), Oracle MySQL Cluster - DoS (CVE-2026-60592, CVSS 8.2)https://cyberfeed.cesnet.cz/reports/1020?lang=enhttps://cyberfeed.cesnet.cz/reports/1019?lang=enMozilla fixes 58 vulnerabilities in various products. The most severe vulnerabilities are listed below. Individual products and their fixed versions: Firefox - 154 Firefox ESR - 153.1, 140.14, 115.39 Thunderbird - 154 Thunderbird ESR - 153.1, 140.14 Vulnerabilities: Mozilla Firefox, Firefox ESR, Thunderbird, Thunderbird ESR - intro, Mozilla Firefox, Thunderbird - sandbox escape (CVE-2026-75874, CVSS 10.0), Mozilla Firefox, Firefox ESR, Thunderbird, Thunderbird ESR - privilege escalation (CVE-2026-74946, CVSS 8.8), Mozilla Firefox, Firefox ESR, Thunderbird, Thunderbird ESR - privilege escalation (CVE-2026-74947, CVSS 8.8), Mozilla Firefox, Firefox ESR, Thunderbird, Thunderbird ESR - privilege escalation (CVE-2026-74949, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/1019?lang=enhttps://cyberfeed.cesnet.cz/reports/1018?lang=enGitLab fixes 2 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) in versions 19.2.4, 19.1.6, 19.0.8 and 18.11.11. The most severe of them are described below, the rest can be found at. Vulnerabilities: GitLab - intro, GitLab CE/EE - code Injection (CVE-2026-19478, CVSS 9.4), GitLab CE/EE - CSRF (CVE-2026-19650, CVSS 7.1)https://cyberfeed.cesnet.cz/reports/1018?lang=enhttps://cyberfeed.cesnet.cz/reports/1017?lang=enElastic fixes 48 vulnerabilities in its products. The most severe of them are described below, the rest can be found at. Products and their fixed versions: Elasticsearch - 8.19.20, 9.3.8, 9.4.5, 9.5.1 Elastic Kibana - 8.19.20, 9.3.8, 9.4.5, 9.5.1 Fleet Server - 8.19.20, 9.4.5, 9.5.1 Elastic Cloud on Kubernetes - 3.5.0 Vulnerabilities: Elastic - intro, Elasticsearch - RCE (CVE-2026-72642, CVSS 8.8), Elastic Kibana - unauthorized access (CVE-2026-72665, CVSS 8.1), Elastic Fleet Server - server-side code injection (CVE-2026-72676, CVSS 6.5), Elastic Cloud on Kubernetes - cross-namespace secret disclosure (CVE-2026-72640, CVSS 6.5)https://cyberfeed.cesnet.cz/reports/1017?lang=enhttps://cyberfeed.cesnet.cz/reports/1016?lang=enVulnerabilities: summaryhttps://cyberfeed.cesnet.cz/reports/1016?lang=enhttps://cyberfeed.cesnet.cz/reports/1015?lang=enCisco fixes 8 vulnerabilities in its products. The most severe of them are described below; the rest can be found at the referenced links. One vulnerability is already being actively exploited, and a PoC has been published for two others. Fixed versions of individual products: ClamAV - 1.5.4, 1.4.6 Secure Firewall Adaptive Security Appliance (ASA) Software - the specific hotfix can be found at Secure Firewall Threat Defense (FTD) Software - the specific hotfix can be found at Secure Endpoint Connector Linux/macOS/Windows* - available in the Cisco Secure Endpoint portal; exact version numbers have not been published yet. *The Secure Endpoint Private Cloud infrastructure is not vulnerable. However, it must be used to distribute the fixed connectors to endpoints; for more details see. Vulnerabilities: Cisco - intro, Cisco Secure Endpoint Connector, ClamAV - DoS (CVE-2026-20337, CVSS 7.5), Cisco Secure Endpoint Connector, ClamAV - DoS (CVE-2026-20339, CVSS 7.5), Cisco Secure Endpoint Connector, ClamAV - DoS (CVE-2026-20346, CVSS 7.5), Cisco Secure Firewall ASA & Secure FTD Software - DoS (CVE-2026-20349, CVSS 8.6)https://cyberfeed.cesnet.cz/reports/1015?lang=enhttps://cyberfeed.cesnet.cz/reports/1013?lang=enLinux Kernel fixes the high-severity "SCTPhantom" vulnerability affecting the SCTP (Stream Control Transmission Protocol) subsystem. The vulnerability affects the kernel since version 2.6.25, or more precisely since commit 42e30bf3463c; the fix is in commit 74e8f3e7114f, which is a backport of upstream commit 9b2854f86f0b. Debian has released a fix in version 6.12.101-1 for trixie and 7.1.7-1 for forky/sid. Neither Ubuntu nor Red Hat has released a fix yet. Vulnerabilities: Linux - intro, Linux Kernel (SCTP) - LPE (CVE-2026-64564, CVSS 8.5)https://cyberfeed.cesnet.cz/reports/1013?lang=enhttps://cyberfeed.cesnet.cz/reports/1012?lang=enVulnerabilities: summaryhttps://cyberfeed.cesnet.cz/reports/1012?lang=enhttps://cyberfeed.cesnet.cz/reports/1011?lang=enLinux Kernel fixes 2 vulnerabilities affecting the KVM subsystem and the Open vSwitch module. KVM is affected by the vulnerability described below from Kernel version 5.9, or from versions where the code from commit f95eec9bed76 was backported, and the fix is in commit 2abd5287f083. Debian has released a fix in 6.12.101-1 for trixie (security), in 7.1.6-1 for forky and in 7.1.7-1 for sid. Available fixes for Red Hat products can be found at. Open vSwitch is affected by the vulnerability described below from versions 5.15.180, 6.1.135, 6.6.90, 6.12.20, 6.18.1, 7.1.0 (commit a1e64addf3ff) and the fix is in versions 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5 (commit 3f1f75536668). Ubuntu does not yet have a fix for releases 22.04 - 26.04; the other releases are not affected by the vulnerability. Available fixes for Red Hat products can be found at. Individual Debian releases and their fixed versions (CVE-2026-64531): bullseye (security 6.1) - 6.1.180-1~deb11u1 bookworm (security) - 6.1.180-1 bookworm (security 6.12) - 6.12.100-1~deb12u1 trixie (security) - 6.12.101-1 forky - 7.1.6-1 sid - 7.1.7-1 Vulnerabilities: Linux Kernel (KVM) - guest-to-host escape (CVE-2026-64561, CVSS 7.0), Linux Kernel (KVM, Open vSwitch) - Intro, Linux Kernel (Open vSwitch) - LPE (CVE-2026-6453, CVSS 7.8)https://cyberfeed.cesnet.cz/reports/1011?lang=enhttps://cyberfeed.cesnet.cz/reports/1010?lang=enGitHub fixes a high-severity vulnerability in GitHub Enterprise Server in versions 3.21.4, 3.20.6, 3.19.10, 3.18.13 and 3.17.19. Vulnerabilities: GitHub Enterprise Server - arbitrary file deletion (CVE-2026-17556, CVSS 8.8), GitHub Enterprise Server - introhttps://cyberfeed.cesnet.cz/reports/1010?lang=enhttps://cyberfeed.cesnet.cz/reports/1009?lang=enCisco fixes 16 vulnerabilities in 6 products. The most severe vulnerabilities are listed below, the remaining ones affect only Cisco IOS XE and can be found at. Cisco Integrated Management Controller (IMC) - fixed versions for the individual products containing Cisco IMC can be found at Cisco RoomOS - 26.7.2.2 Cisco Catalyst SD-WAN Manager - 20.9.10, 20.12.8, 20.15.6, 20.18.4, 26.1.2, 26.2.1 Cisco IOS and IOS XE - fix availability can be checked with the Cisco Software Checker tool Vulnerabilities: Cisco Integrated Management Controller - XSS (CVE-2026-20198, CVSS 4.8), Cisco RoomOS - sensitive information disclosure (CVE-2026-20289, CVSS 5.0), Cisco Catalyst SD-WAN Manager - sensitive information disclosure (CVE-2026-20294, CVSS 6.5), Cisco Integrated Management Controller - command injection (CVE-2026-20200, CVSS 8.8), Cisco IOS XE - command injection (CVE-2026-20272, CVSS 9.8), Cisco IOS (XE) - DoS (CVE-2026-20301, CVSS 8.6), Cisco - introhttps://cyberfeed.cesnet.cz/reports/1009?lang=enhttps://cyberfeed.cesnet.cz/reports/1008?lang=enVeeam fixes 10 vulnerabilities in 2 products, 3 of which are critical. The fix for Veeam Service Provider Console is in version 9.3.0.35057 and for Veeam ONE in version 13.1.0.7034. The most severe vulnerabilities are listed below. Vulnerabilities: Veeam Service Provider Console - agent impersonation (CVE-2026-58073, CVSS 9.5), Veeam Service Provider Console - RCE (CVE-2026-58072, CVSS 9.0), Veeam ONE - RCE (CVE-2026-64633, CVSS 10.0), Veeam - introhttps://cyberfeed.cesnet.cz/reports/1008?lang=enhttps://cyberfeed.cesnet.cz/reports/1007?lang=enNode.js fixes 11 vulnerabilities in versions 22.23.2, 24.18.1 and 26.5.1. The most severe ones are described below; the rest can be found at. Vulnerabilities: Node.js - intro, Node.js - remote memory exhaustion (CVE-2026-56846, CVSS 7.5), Node.js - out-of-bounds read/write (CVE-2026-58043, CVSS 7.5), Node.js - heap-use-after-free (CVE-2026-56848, CVSS 7.5)https://cyberfeed.cesnet.cz/reports/1007?lang=enhttps://cyberfeed.cesnet.cz/reports/1006?lang=enSynology fixes a high-severity vulnerability in Synology Assistant (Windows) in version 7.0.7-50095. Vulnerabilities: Synology Assistant (Windows) - file access, DoS (CVE-2026-4793, CVSS 7.3), Synology Assistant - introhttps://cyberfeed.cesnet.cz/reports/1006?lang=enhttps://cyberfeed.cesnet.cz/reports/1005?lang=enMicrosoft fixes a high-severity vulnerability in MS Excel, Office and 365. The fix for MS Excel is in build 16.0.5561.1001, and the fixed MS Office and 365 builds can be checked at. Vulnerabilities: Microsoft Excel, Office, 365 - RCE (CVE-2026-62870, CVSS 8.8), Microsoft Excel, Office, 365 - introhttps://cyberfeed.cesnet.cz/reports/1005?lang=enhttps://cyberfeed.cesnet.cz/reports/1004?lang=enZyxel fixes 3 vulnerabilities in specific firmware versions of the following products: - ATP - USG FLEX - USG FLEX 50(W)/USG20(W)-VPN - AP - FWA7 - Security Routers A clear table of all fixed versions and the corresponding devices can be found at. Vulnerabilities: Zyxel - intro, Zyxel ATP, USG FLEX - command execution (CVE-2026-14818, CVSS 7.2), Zyxel APs, FWA7, Security Routers - command injection (CVE-2026-6837, CVSS 7.2), Zyxel APs, FWA7, Security Routers - authentication bypass (CVE-2026-8508, CVSS 6.5)https://cyberfeed.cesnet.cz/reports/1004?lang=enhttps://cyberfeed.cesnet.cz/reports/1003?lang=enVulnerabilities: summaryhttps://cyberfeed.cesnet.cz/reports/1003?lang=enhttps://cyberfeed.cesnet.cz/reports/1002?lang=enBroadcom fixes five vulnerabilities in VMware ESX, vCenter, Workstation, Fusion, vSphere Foundation, Cloud Foundation, Telco Cloud Platform and Telco Cloud Infrastructure, three of which are critical and one is important. Another, less severe vulnerability (CVE-2026-41709) was also fixed and its details are available at. The 4 more severe vulnerabilities are listed below. Fixed versions: VMware vCenter - 8.0 U3k, 9.0.2.0100, 9.1.0.0300 VMware ESX - 8.0 U3k, 9.0.2.0100, 9.1.0.0200 VMware vSphere Foundation - 9.0.2.0100, 9.1.0.0300, VMware Workstation - 26H1 VMware Fusion - 26H1 VMware Cloud Foundation - 5.2.4 with the patch applied, 9.0.2.0100, 9.1.0.0300 VMware Telco Cloud Platform - KB449886 VMware Telco Cloud Infrastructure - KB449886 Vulnerabilities: vmware - intro, VMware ESX, vCenter, Workstation & Fusion - authentication bypass (CVE-2026-59309, CVSS 9.8), VMware ESX, vCenter, Workstation & Fusion - directory traversal (CVE-2026-59310, CVSS 9.8), VMware ESX, vCenter, Workstation & Fusion - code execution (CVE-2026-47876, CVSS 9.3), VMware ESX, vCenter, Workstation & Fusion - out of bounds read (CVE-2026-41703, CVSS 7.6)https://cyberfeed.cesnet.cz/reports/1002?lang=enhttps://cyberfeed.cesnet.cz/reports/1001?lang=enCisco is urgently fixing 2 vulnerabilities in Secure Firewall Management Center (FMC). The specific impact on a given product version can be verified using the Cisco Software Checker tool. Fixes for individual releases: 7.0 - Cisco_Firepower_Mgmt_Center_Hotfix_GB-7.0.9.1-3.sh.REL.tar 7.2 - Cisco_Secure_FW_Mgmt_Center_Hotfix_HL-7.2.11.1-4.sh.REL.tar 7.4 - Cisco_Secure_FW_Mgmt_Center_Hotfix_HG-7.4.7.1-3.sh.REL.tar 7.6 - Cisco_Secure_FW_Mgmt_Center_Hotfix_CY-7.6.5.1-2.sh.REL.tar 7.7 - Cisco_Secure_FW_Mgmt_Center_Hotfix_AM-7.7.12.1-2.sh.REL.tar 10.0 - Cisco_Secure_FW_Mgmt_Center_Hotfix_P-10.0.1.1-2.sh.REL.tar Vulnerabilities: Cisco Secure FMC Software - intro, Cisco Secure FMC Software - authentication bypass, OS command execution, privilege escalation - (CVE-2026-20079, CVSS 10.0), Cisco Secure FMC Software - authentication bypass (CVE-2026-20316, CVSS 5.3)https://cyberfeed.cesnet.cz/reports/1001?lang=enhttps://cyberfeed.cesnet.cz/reports/1000?lang=enGitLab fixes 13 vulnerabilities in GitLab Community Edition (CE) and GitLab Enterprise Edition (EE) in versions 19.2.1, 19.1.3, 19.0.5. The most severe vulnerabilities are listed below. Vulnerabilities: GitLab - intro, GitLab - sensitive information disclosure (CVE-2026-6267, CVSS 8.5), GitLab - unauthorized configuration modification (CVE-2026-12436, CVSS 8.4), GitLab - DoS (CVE-2026-15975, CVSS 7.5)https://cyberfeed.cesnet.cz/reports/1000?lang=enhttps://cyberfeed.cesnet.cz/reports/999?lang=enApache fixes 34 vulnerabilities in Apache Traffic Server (ATS) in versions 9.2.15 and 10.1.4. Selected critical vulnerabilities are described below; the others can be found at. Vulnerabilities: Apache Traffic Server - intro, Apache Traffic Server - request smuggling, metadata injection (CVE-2026-33267, CVSS 10.0), Apache Traffic Server - downgrade request smuggling (CVE-2026-58150, CVSS 10.0), Apache Traffic Server - request smuggling, policy bypass (CVE-2026-58155, CVSS 9.3)https://cyberfeed.cesnet.cz/reports/999?lang=enhttps://cyberfeed.cesnet.cz/reports/998?lang=enApache Tomcat fixes a high-severity vulnerability in versions 11.0.25 and 10.1.58 (and in version 9.0.121 once released). Debian releases and their fixed versions: bullseye (security) - 9.0.118-0+deb11u1 bookworm - 9.0.70-2 trixie - 9.0.95-1 forky, sid - 9.0.118-1 Vulnerabilities: apache tomcat - intro, Apache Tomcat - DoS (CVE-2026-66299, CVSS 7.5)https://cyberfeed.cesnet.cz/reports/998?lang=enhttps://cyberfeed.cesnet.cz/reports/996?lang=enSamba fixes 6 vulnerabilities in versions 4.24.5, 4.23.10 and 4.22.11. The most severe vulnerabilities are described below; the rest can be found at. Debian releases and their fixed versions: trixie (security) - 2:4.22.10+dfsg-0+deb13u2 sid - 2:4.24.5+dfsg-1 Vulnerabilities: Samba - intro, Samba AD DC - privilege escalation (CVE-2026-58221, CVSS 8.8), Samba AD DC - domain compromise, privilege escalation (CVE-2026-58222, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/996?lang=enhttps://cyberfeed.cesnet.cz/reports/995?lang=enIn TeamCity On-Premises, JetBrains fixes a critical vulnerability with versions 2026.1.3, 2025.11.7 or a security patch plugin that addresses it. Vulnerabilities: jetbrains teamcity - intro, JetBrains TeamCity - OS command execution (CVE-2026-63077, CVSS 9.8)https://cyberfeed.cesnet.cz/reports/995?lang=enhttps://cyberfeed.cesnet.cz/reports/994?lang=enArista fixes two critical and one high-severity vulnerability in VeloCloud Orchestrator (VCO) On-Prem in versions 5.2.3.14, 6.1.3.4 and 6.4.2.4. If an immediate update to a fixed version is not possible, the risk can be temporarily mitigated by restricting access to the VCO web interface to trusted networks only. It is also recommended to monitor for unusual network traffic and recent administrator activity. Vulnerabilities: Arista - intro, Arista - OS Command Execution (CVE-2026-16812, CVSS 10.0), Arista - SQLi, SSRF (CVE-2026 -17191, CVSS 9.1), Arista - SSRF (CVE-2026-17192, CVSS 8.5)https://cyberfeed.cesnet.cz/reports/994?lang=enhttps://cyberfeed.cesnet.cz/reports/993?lang=enRedis has released versions 8.8.1, 8.6.5, 8.4.5 and 8.2.8 containing fixes for two vulnerabilities. The first one is described below; the second one, which affects the RedisBloom/TDigest module and allows writing outside the bounds of allocated memory, has not yet been assigned a CVE identifier. According to a public PoC, there is also a third vulnerability in RedisBloom/TopK, for which no fix has been released yet. In addition to updating to the highest fixed version for the deployed branch, given the absence of a fix for the third vulnerability, a temporary mitigation is also recommended: removing the RESTORE permission from accounts that do not strictly require it and restricting network access to Redis to trusted sources only; see the temporary fix procedure for the similar vulnerability CVE-2026-25243. Vulnerabilities: Redis - intro, Redis - RCE (CVE-2026-66373, CVSS 7.5)https://cyberfeed.cesnet.cz/reports/993?lang=enhttps://cyberfeed.cesnet.cz/reports/991?lang=enVulnerabilities: summaryhttps://cyberfeed.cesnet.cz/reports/991?lang=enhttps://cyberfeed.cesnet.cz/reports/990?lang=enExim version 4.99.5 fixes 2 vulnerabilities. Vulnerabilities: Exim - intro, Exim - LPE (CVE-2026-66140, CVSS 8.4), Exim - LPE (CVE-2026-66141, CVSS 7.4)https://cyberfeed.cesnet.cz/reports/990?lang=enhttps://cyberfeed.cesnet.cz/reports/989?lang=enSolarWinds fixes 16 vulnerabilities in Serv-U version 2026.3. The most severe selected ones are described below; the others can be found at. Vulnerabilities: SolarWinds Serv-U - intro, SolarWinds Serv-U - RCE (CVE-2026-28304, CVSS 9.1), SolarWinds Serv-U - privilege escalation (CVE-2026-28306, CVSS 9.1), SolarWinds Serv-U - account takeover (CVE-2026-28314, CVSS 9.1)https://cyberfeed.cesnet.cz/reports/989?lang=enhttps://cyberfeed.cesnet.cz/reports/988?lang=enBIND 9 fixes 9 vulnerabilities in BIND 9 and BIND Supported Preview Edition. A selection of the most severe vulnerabilities is described below; the rest can be found at. Products and their fixed versions: BIND 9 - 9.20.26, 9.21.24 BIND Supported Preview Edition - 9.20.26-S1 Debian releases and their fixed versions: trixie (security) - 1:9.20.26-1~deb13u1 Vulnerabilities: BIND 9 - intro, BIND 9 - DNSSEC validation bypass (CVE-2026-13321, CVSS 8.6), BIND 9 - RPZ policy bypass, service crash (CVE-2026-11331, CVSS 8.2), BIND 9 - cache poisoning (CVE-2026-11721, CVSS 7.5)https://cyberfeed.cesnet.cz/reports/988?lang=enhttps://cyberfeed.cesnet.cz/reports/987?lang=enCheck Point fixes three vulnerabilities in Security Management, Multi-Domain Security Management and Security Gateway, two of which are critical. Vulnerability CVE-2026-16232 is being actively exploited and has therefore been added to the CISA KEV catalog. A list of observed IoCs (IP addresses) can be found at. Fixes are available as part of the Jumbo Hotfix Accumulator: - for R82.10 from Take 36 - for R82 from Take 118 - for R81.20 from Take 158 If an immediate update to a fixed version is not possible, the risk can be temporarily mitigated according to the procedures at. Vulnerabilities: Check Point - intro, Check Point Security Management & Multi-Domain Security Management Server - authentication bypass (CVE-2026-16232, CVSS 9.1), Check Point Security Management & Multi-Domain Security Management Server - authentication bypass (CVE-2026-62144, CVSS 9.1), Check Point Security Management & Multi-Domain Security Management - LPE (CVE-2026-62145, CVSS 7.5)https://cyberfeed.cesnet.cz/reports/987?lang=enhttps://cyberfeed.cesnet.cz/reports/986?lang=enGitleaks fixes 1 high-severity vulnerability in version 8.30.1. The fix is available in the standard distribution and in the official Docker images tagged v8.30.1. Vulnerabilities: Gitleaks - intro, Gitleaks - secret exfiltration (CVE-2026-63728, CVSS 8.1)https://cyberfeed.cesnet.cz/reports/986?lang=enhttps://cyberfeed.cesnet.cz/reports/985?lang=enVeeam has released Veeam Updater version 12.3.0.65, which fixes a high-severity vulnerability in this component of Veeam Backup & Replication. The vulnerability does not affect Windows versions of the Veeam Backup & Replication server, but it may also affect remote components that use the Veeam Infrastructure Appliance. Vulnerabilities: Veeam Updater - Intro, Veeam Updater - LPE (CVE-2026-56844, CVSS 8.4)https://cyberfeed.cesnet.cz/reports/985?lang=enhttps://cyberfeed.cesnet.cz/reports/984?lang=enSnapd fixes 2 high-severity and 1 medium-severity vulnerability in version 2.76.1. Debian lists its releases (bullseye, bookworm, trixie and sid) as vulnerable, but has not yet provided security fixes. Red Hat has not yet released fixes. Ubuntu releases and their fixed versions: resolute - 2.76+ubuntu26.04.3 noble - 2.76+ubuntu24.04.1 jammy - 2.76+ubuntu22.04.1 focal - 2.67.1+20.04ubuntu1~esm3 bionic - 2.61.4ubuntu0.18.04.1+esm4 xenial - 2.61.4ubuntu0.16.04.1+esm4 Vulnerabilities: Snapd - intro, Snapd - confinement bypass (CVE-2026-15226, CVSS 8.4), Snapd - LPE (CVE-2026-8933, CVSS 7.8), Snapd - information disclosure (CVE-2024-5300, CVSS 5.6)https://cyberfeed.cesnet.cz/reports/984?lang=enhttps://cyberfeed.cesnet.cz/reports/983?lang=enZyxel fixes a high-severity vulnerability in the firmware of DSL/Ethernet CPE, Fiber ONTs and Wireless Extenders devices. The fixed versions of the individual products can be found in a clear table at. Vulnerabilities: Zyxel - intro, Zyxel DSL/Ethernet CPE, Fiber ONTs and Wireless Extenders - OS command execution (CVE-2026-6952, CVSS 7.2)https://cyberfeed.cesnet.cz/reports/983?lang=enhttps://cyberfeed.cesnet.cz/reports/982?lang=enMicrosoft fixes 1 critical vulnerability in the Windows DHCP Server service. The vulnerability affects Windows 10 client systems (versions 1607 and 1809) and Windows Server operating systems in versions 2012, 2012 R2, 2016, 2019, 2022 and 2025 (including Server Core installations). Security fixes for all of these releases have been made available as part of the standard cumulative updates. Vulnerabilities: Windows DHCP Server - intro, Windows DHCP Server - RCE (CVE-2026-56159, CVSS 9.8)https://cyberfeed.cesnet.cz/reports/982?lang=enhttps://cyberfeed.cesnet.cz/reports/981?lang=enWordPress fixes two vulnerabilities, collectively referred to as wp2shell, in versions 6.9.5 and 7.0.2. According to various sources, they are already being actively exploited. Chaining these vulnerabilities allows an unauthenticated remote attacker to execute arbitrary code via the WordPress REST API Batch endpoint, which may even lead to server compromise. Due to the high severity, WordPress is forcing the updates on systems where they are not installed automatically. However, this may not take effect in some configurations, so it is strongly recommended to verify the version. If an immediate update to the fixed version is not possible, the risk can be temporarily mitigated by following the procedure described at. The same link also allows you to check whether your instance is vulnerable. A PoC for the vulnerability is available at. Vulnerabilities: WordPress Core - intro, WordPress Core - SQL injection (CVE-2026-60137, CVSS 5.9), WordPress Core - route confusion (CVE-2026-63030, CVSS 9.8)https://cyberfeed.cesnet.cz/reports/981?lang=enhttps://cyberfeed.cesnet.cz/reports/980?lang=enApache Tomcat fixes 1 critical vulnerability in versions 11.0.24, 10.1.57 and 9.0.120. It also draws attention to an error in the documentation. For stable Debian releases, security fixes have been issued only in the tomcat9 package, in version 9.0.118-0+deb11u1 for bullseye (security) and in version 9.0.70-2 for bookworm. Red Hat and Ubuntu have not yet provided fixes, or their releases are not affected by the vulnerability. The Gentoo distribution has fixed versions available in testing for the amd64 and arm64 architectures. Vulnerabilities: Apache Tomcat - intro, Apache Tomcat - security bypass (CVE-2026-59083, CVSS 9.1)https://cyberfeed.cesnet.cz/reports/980?lang=enhttps://cyberfeed.cesnet.cz/reports/979?lang=enVulnerabilities: OpenSSL HollowByte - introhttps://cyberfeed.cesnet.cz/reports/979?lang=enhttps://cyberfeed.cesnet.cz/reports/978?lang=enVMware fixes 7 vulnerabilities in its Avi Load Balancer product in versions 32.1.2, 31.2.2-2p3 and 30.2.7. The most severe vulnerabilities are listed below; the others can be found at. Vulnerabilities: VMware Avi Load Balancer - intro, VMware Avi Load Balancer - authentication bypass (CVE-2026-47865, CVSS 9.8), VMware Avi Load Balancer - RCE (CVE-2026-47867, CVE-2026-47869, CVSS 8.7), VMware Avi Load Balancer - path traversal (CVE-2026-47871, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/978?lang=enhttps://cyberfeed.cesnet.cz/reports/977?lang=enF5 Networks fixes a critical vulnerability in NGINX. Fixed versions of the individual products: NGINX Plus - 37.0.3.1, R36 P7 NGINX Open Source - 1.31.3, 1.30.4 F5 WAF for NGINX - 5.13.4 NGINX Gateway Fabric - 2.6.7 NGINX Ingress Controller - 5.5.3, 2026-lts-r4 Vulnerabilities: F5 NGINX - intro, F5 NGINX - DoS, RCE (CVE-2026-42533, CVSS 9.2)https://cyberfeed.cesnet.cz/reports/977?lang=enhttps://cyberfeed.cesnet.cz/reports/976?lang=enLinux fixes an LPE vulnerability in the kernel. The fix was released in the form of a patch at. The kernel vulnerability has been present since commit 14a4696bc311 and at least since version 5.14, but due to backporting the vulnerability may also be present in older versions. Vulnerabilities: Linux Kernel - LPE (CVSS 7.8), Linux Kernel - introhttps://cyberfeed.cesnet.cz/reports/976?lang=enhttps://cyberfeed.cesnet.cz/reports/975?lang=enVulnerabilities: summaryhttps://cyberfeed.cesnet.cz/reports/975?lang=enhttps://cyberfeed.cesnet.cz/reports/974?lang=enSonicWall fixes 2 chainable vulnerabilities in the SMA1000 product (models 6210, 7210 and 8200v) in versions 12.4.3-03453 and 12.5.0-02835. SonicWall is aware of active exploitation of the vulnerabilities, and CISA has added the vulnerabilities to its list of actively exploited vulnerabilities. SonicWall has also published IoCs that can be searched for in logs. Vulnerabilities: SonicWall SMA1000 - SSRF (CVE-2026-15409, CVSS 10.0), SonicWall SMA1000 - OS command injection (CVE-2026-15410, CVSS 7.2), SonicWall - introhttps://cyberfeed.cesnet.cz/reports/974?lang=enhttps://cyberfeed.cesnet.cz/reports/973?lang=enZoom fixes 4 vulnerabilities in its products, one of them critical. Products and their fixed versions: Zoom Workplace for Windows – 7.0.5 Zoom Workplace VDI Client for Windows – 7.0.10, 6.6.15, 6.5.18 Zoom Workplace VDI Plugin for Windows – 6.6.14, 6.5.17 Zoom Rooms for Windows – 7.1.0 Remote Control for Zoom Contact Center for Windows – 7.0.0 Vulnerabilities: Zoom - intro, Zoom Workplace / VDI Client for Windows - account takeover (CVE-2026-53412, CVSS 9.8), Zoom Clients for Windows - privilege escalation (CVE-2026-53410, CVSS 7.0), Zoom Rooms for Windows - privilege escalation (CVE-2026-53409, CVSS 7.8), Zoom Workplace VDI Plugin for Windows - privilege escalation (CVE-2026-53411, CVSS 7.8)https://cyberfeed.cesnet.cz/reports/973?lang=enhttps://cyberfeed.cesnet.cz/reports/972?lang=enCisco fixes 7 vulnerabilities in 2 products. The most severe vulnerabilities are listed below. Individual products and their fixed versions: Cisco ISE - 3.3 Patch 12, 3.4 Patch 7, 3.5 Patch 4 (available September 2026) or a hot patch Cisco RoomOS - 11.32.6.0, 26.5.2.2 Vulnerabilities: Cisco ISE - unauthorized file access (CVE-2026-20146, CVSS 5.5), Cisco RoomOS - improper access control (CVE-2026-20150, CVSS 8.8), Cisco - introhttps://cyberfeed.cesnet.cz/reports/972?lang=enhttps://cyberfeed.cesnet.cz/reports/971?lang=enSplunk fixes 3 vulnerabilities in 2 products. Individual products and their fixed versions: Splunk Enterprise - 10.4.1, 10.2.5, 10.0.8, 9.4.13, 9.3.14 Splunk Cloud Platform - 10.5.2605.0, 10.4.2604.7, 10.3.2512.16, 10.2.2510.18, 10.1.2507.24 Vulnerabilities: Splunk - intro, Splunk Enterprise, Cloud Platform - CSRF (CVE-2026-20296, CVSS 8.3), Splunk Enterprise, Cloud Platform - path traversal (CVE-2026-20297, CVSS 7.2), Splunk Enterprise, Cloud Platform - sensitive information disclosure (CVE-2026-20298, CVSS 5.3)https://cyberfeed.cesnet.cz/reports/971?lang=enhttps://cyberfeed.cesnet.cz/reports/970?lang=enCitrix fixes 2 vulnerabilities in version 26.6.1.20 of Citrix Secure Access Client (Windows) and in version 26.5.1.7 of Citrix Endpoint Analysis Client (Windows). Vulnerabilities: Citrix Secure Access Client, Endpoint Analysis Client (Windows) - LPE (CVE-2026-53565, CVSS 8.5), Citrix Secure Access Client, Endpoint Analysis Client (Windows) - Out-of-bounds memory read (CVE-2026-53566, CVSS 6.8), Citrix - introhttps://cyberfeed.cesnet.cz/reports/970?lang=enhttps://cyberfeed.cesnet.cz/reports/969?lang=enFortinet fixes 11 vulnerabilities in various products. The most severe vulnerabilities are listed below. Individual products and their fixed versions: FortiOS - 7.6.7 FortiPAM - 1.8.3 FortiProxy - 7.4.14, 7.6.6 FortiSIEMWindowsAgent - 7.4.2 FortiSandbox (FSA-500G, FSA-1500G) - 4.4.9, 5.0.3 FortiSIEM - 7.2.7, 7.3.5, 7.4.1 FortiClientEMS - 7.4.6 FortiAuthenticator - 6.5.8, 6.6.3 Vulnerabilities: FortiAuthenticator - sensitive information leak (CVE-2025-53379, CVSS 7.5), FortiClientEMS - entity impersonation (CVE-2026-59836, CVSS 7.5), FortiSIEM - XSS (CVE-2026-59838, CVSS 5.9), FortiSandbox - unauthorized access (CVE-2026-59835, CVSS 8.6), FortiSIEMWindowsAgent - RCE (CVE-2026-59841, CVSS 7.5), FortiOS, FortiPAM, FortiProxy - (CVE-2026-23573, CVSS 6.1), Fortinet - introhttps://cyberfeed.cesnet.cz/reports/969?lang=enhttps://cyberfeed.cesnet.cz/reports/968?lang=enAs part of the July Patch Tuesday, Microsoft released fixes for more than 600 vulnerabilities, 2 of which are actively exploited. The most severe of them are described below; the remaining ones, including available fixes, are listed at. Vulnerabilities: Microsoft - intro, Microsoft SharePoint Server - privilege escalation (CVE-2026-56164, CVSS 5.3), Active Directory Federation Services - privilege escalation (CVE-2026-56155, CVSS 7.8), Microsoft Windows VMSwitch - privilege escalation (CVE-2026-57092, CVSS 9.9), Microsoft SharePoint Server - security feature bypass (CVE-2026-55040, CVSS 9.1), Microsoft Exchange Server - XSS (CVE-2026-55008, CVSS 9.6)https://cyberfeed.cesnet.cz/reports/968?lang=enhttps://cyberfeed.cesnet.cz/reports/966?lang=enVim fixes 1 vulnerability in version 9.2.0736. Debian released a fix only for the unstable sid release (2:9.2.0782-1) and Red Hat released a fix for Red Hat Hardened Images. Vulnerabilities: Vim - ACE (CVE-2026-59856, CVSS 8.4), Vim - introhttps://cyberfeed.cesnet.cz/reports/966?lang=enhttps://cyberfeed.cesnet.cz/reports/965?lang=enZimbra fixes 1 vulnerability in version 10.1.19. Details on applying the fix can be found at. Users upgrading from versions 10.0.x, 9.0.x and 8.8.15 to the fixed version who previously applied the SNMP mitigation steps must reapply the updated steps. Vulnerabilities: Zimbra - XSS (CVSS 6.1), Zimbra - introhttps://cyberfeed.cesnet.cz/reports/965?lang=enhttps://cyberfeed.cesnet.cz/reports/964?lang=enVulnerabilities: summaryhttps://cyberfeed.cesnet.cz/reports/964?lang=enhttps://cyberfeed.cesnet.cz/reports/963?lang=enUbiquiti fixes 25 vulnerabilities in various UniFi products; the critical vulnerabilities are described below. Individual products and their fixed versions: UniFi Connect Application - 3.4.20 UniFi Talk Application - 5.2.2 UniFi Access Application - 4.2.29 UniFi OS - 5.1.19 (a list of the specific affected devices is available at) UniFi Network Application - 10.4.57 UniFi Protect Application - 7.1.83 UniFi Protect Floodlight - 1.13.6 Vulnerabilities: UniFi Connect Application - command injection (CVE-2026-50746, CVSS 10.0), UniFi Talk Application - privilege escalation (CVE-2026-50747, CVSS 9.9), UniFi Access Application - command injection (CVE-2026-50748, CVSS 9.9), UniFi OS - command injection (CVE-2026-54402, CVSS 9.9), UniFi Protect Application - privilege escalation (CVE-2026-55115, CVSS 9.9), UniFi - introhttps://cyberfeed.cesnet.cz/reports/963?lang=enhttps://cyberfeed.cesnet.cz/reports/961?lang=enX.Org Foundation fixes 5 vulnerabilities with xwayland 24.1.13, xorg-server 21.1.24 and libXfont2-2.0.8. Debian has released a fixed unstable version sid 1:2.0.8-1 (CVE-2026-56001, CVE-2026-56002, CVE-2026-56003). Vulnerabilities: X.org - intro, X.Org - DoS, ACE (CVE-2026-55999, CVSS 7.8), X.Org - DoS, ACE (CVE-2026-56000, CVSS 7.8), X.Org - DoS, ACE (CVE-2026-56001, CVSS 8.8), X.Org - DoS, ACE (CVE-2026-56002, CVSS 8.5), X.Org - DoS, ACE (CVE-2026-56003, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/961?lang=enhttps://cyberfeed.cesnet.cz/reports/960?lang=enGitLab fixes 8 vulnerabilities in GitLab Community Edition (CE) and GitLab Enterprise Edition (EE) with versions 19.1.2, 19.0.4, 18.11.7. The most severe vulnerabilities are listed below. Vulnerabilities: GitLab - intro, GitLab - XSS (CVE-2026-6896, CVSS 8.7), GitLab - XSS (CVE-2026-13320, CVSS 7.3)https://cyberfeed.cesnet.cz/reports/960?lang=enhttps://cyberfeed.cesnet.cz/reports/959?lang=enLinux fixes a high-severity vulnerability in the Linux kernel named "GhostLock", which affects all major distributions since 2011. To remediate the vulnerability, it is recommended to merge upstream commit 3bfdc63936dd or upgrade to the fixed version of your distribution release, if available. All systems with upstream kernel versions from v2.6.39-rc1 up to v7.1-rc1 are vulnerable. Red Hat has not yet released any fixes; Ubuntu has released an update for the resolute release (7.0.0-27.27). Debian releases and their fixed versions: bullseye (security) - 6.1.176-1~deb11u1 bookworm (security) - 6.1.176-1 trixie - 6.12.86-1 trixie (security) - 6.12.95-1 forky - 7.0.13-1 sid - 7.1.3-1 Vulnerabilities: Linux kernel - intro, Linux kernel - LPE (CVE-2026-43499, CVSS 7.8)https://cyberfeed.cesnet.cz/reports/959?lang=enhttps://cyberfeed.cesnet.cz/reports/958?lang=enownCloud fixes 2 vulnerabilities in version 10.15.3. This version also fixes 3 vulnerabilities in ownCloud extensions (ownCloud App), namely in Anti-Virus, SharePoint and DrawIO Vulnerabilities: ownCloud - intro, ownCloud - RCE (CVE-2025-53827, CVSS 9.1), ownCloud - RCE (CVE-2025-53829, CVSS 8.0)https://cyberfeed.cesnet.cz/reports/958?lang=enhttps://cyberfeed.cesnet.cz/reports/957?lang=enLinux fixes a high-severity vulnerability named "Bad Epoll", which affects Linux servers, desktops and the Android operating system. To remediate the vulnerability, it is recommended to merge upstream commit a6dc643c6931 or install a backport for your distribution, if available. All systems with upstream kernel versions from 6.4 up to the fixing commit at are vulnerable; however, because the vulnerable code has also been backported to older systems, it is apparently not currently possible to determine all affected distribution versions, and moreover, routine testing with the public exploit on a low number of CPUs may yield false negative results. Ubuntu has not yet released any fixes, Debian has released a fix for all releases except trixie, Red Hat has released a fix for NVIDIA for RHEL 10 and RHEL 10, and AlmaLinux has released patches for AlmaLinux 9 and AlmaLinux 10. Vulnerabilities: Linux kernel - intro, Linux kernel - LPE, DoS (CVE-2026-46242, CVSS 7.8)https://cyberfeed.cesnet.cz/reports/957?lang=enhttps://cyberfeed.cesnet.cz/reports/956?lang=enLinux fixes two vulnerabilities in the KVM module of the Linux kernel for the x86 platform. The vulnerability (CVE-2026-53359), referred to as "Januscape", has been present in the kernel since 2010 (since version 2.6.36) and was demonstrated as a 0-day in Google kvmCTF. For the vulnerability (CVE-2026-53359), a fix is already available in the official stable branches of the Linux kernel (including the 7.1, 6.18, 6.12, 6.6, 6.1, 5.15 and 5.10 series) or in the Debian distribution (testing version trixie and unstable version sid). If an update is not possible, a workaround is to disable nested virtualization on the host by adding the parameters kvm_intel.nested=0 (for Intel) or kvm_amd.nested=0 (for AMD) to the kernel module configuration. Debian releases and their fixed versions (CVE-2026-53360): bullseye - 5.10.223-1 bullseye (security) - 5.10.259-1 bookworm - 6.1.170-3 bookworm (security) - 6.1.176-1 trixie (security) - 6.12.95-1 forky - 7.0.13-1 sid - 7.1.3-1 Vulnerabilities: Linux kernel (KVM) - intro, Linux kernel (KVM) - LPE, DoS, ACE (CVE-2026-53359, CVSS 8.8), Linux kernel (KVM) - (CVE-2026-53360, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/956?lang=enhttps://cyberfeed.cesnet.cz/reports/954?lang=enThe Expat XML parser fixes 13 vulnerabilities in version 2.8.2. Red Hat has released a fixed version of Red Hat Hardened Images for CVE-2026-56132, and Debian has released a fix for the unstable sid and testing forky releases. Selected vulnerabilities are described below, the others at. Vulnerabilities: libexpat - intro, libexpat - DoS (CVE-2026-56132, CVSS 6.9), libexpat - DoS, ACE (CVE-2026-56411, CVSS 6.9), libexpat - DoS, ACE (CVE-2026-56406, CVSS 6.9)https://cyberfeed.cesnet.cz/reports/954?lang=enhttps://cyberfeed.cesnet.cz/reports/953?lang=enGitHub fixes 2 vulnerabilities in GitHub Enterprise Server in versions 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, 3.16.20. Vulnerabilities: GitHub Enterprise Server - XSS (CVE-2026-10585, CVSS 6.3), GitHub Enterprise Server - incorrect access check (CVE-2026-14340, CVSS 5.3), GitHub Enterprise Server - introhttps://cyberfeed.cesnet.cz/reports/953?lang=enhttps://cyberfeed.cesnet.cz/reports/952?lang=enF5 fixes 6 vulnerabilities in NGINX products. The most severe of them are listed below, the rest at. Currently fixed versions of the individual products: NGINX Open Source - 1.31.2, 1.30.3 NGINX Plus - 37.0.2.1, R36 P6 NGINX Gateway Fabric - 2.6.4 Vulnerabilities: F5 NGINX - intro, F5 NGINX - DoS, RCE (CVE-2026-42530, CVSS 9.2), F5 NGINX - DoS, RCE (CVE-2026-42055, CVSS 9.2)https://cyberfeed.cesnet.cz/reports/952?lang=enhttps://cyberfeed.cesnet.cz/reports/950?lang=en6 vulnerabilities have been reported in libssh2. The most severe vulnerabilities are described below, the rest at. Debian releases and their fixed versions (CVE-2026-55200, CVE-2025-15661, CVE-2026-55199, CVE-2026-7598): trixie (security) - 1.11.1-1+deb13u1 forky, sid - 1.11.1-4 Red Hat releases and their fixed versions can be found at. Ubuntu releases and their fixed versions (CVE-2025-15661, CVE-2026-55199, CVE-2026-55200 and CVE-2026-7598): resolute - 1.11.1-1ubuntu0.26.04.2 questing - 1.11.1-1ubuntu0.25.10.2 noble - 1.11.0-4.1ubuntu0.24.04.2 Vulnerabilities: libssh2 - intro, libssh2 - RCE (CVE-2026-55200, CVSS 9.2), libssh2 - DoS (CVE-2025-15661, CVSS 8.3), libssh2 - DoS, CPU exhaustion (CVE-2026-55199, CVSS 8.2), libssh2 - DoS, RCE (CVE-2026-58050, CVSS 8.3)https://cyberfeed.cesnet.cz/reports/950?lang=enhttps://cyberfeed.cesnet.cz/reports/948?lang=enOracle fixes a critical vulnerability in Oracle E-Business Suite. The fix was released as part of the May 2026 Critical Security Patch Update. Vulnerabilities: Oracle E-Business Suite - intro, Oracle E-Business Suite - account takeover (CVE-2026-46817, CVSS 9.8)https://cyberfeed.cesnet.cz/reports/948?lang=enhttps://cyberfeed.cesnet.cz/reports/947?lang=enGitea (an open-source self-hosted Git service for repository management) fixes 2 vulnerabilities in version 1.26.3. Vulnerabilities: Gitea - intro, Gitea - authentication bypass (CVE-2026-20896, CVSS 9.8), Gitea - SSRF (CVE-2026-22874, CVSS 9.6)https://cyberfeed.cesnet.cz/reports/947?lang=enhttps://cyberfeed.cesnet.cz/reports/946?lang=enSynology fixes 3 vulnerabilities in Synology MailPlus Server in versions 4.0.1-31663 (for DSM 7.3) and 4.0.1-21663 (for DSM 7.2.2 and 7.2.1). Vulnerabilities: Synology - intro, Synology MailPlus Server - arbitrary file read/write (CVE-2026-13136, CVSS 10.0), Synology MailPlus Server - arbitrary file read/write (CVE-2025-15660, CVSS 9.6), Synology MailPlus Server - information disclosure (CVE-2026-13135, CVSS 5.3)https://cyberfeed.cesnet.cz/reports/946?lang=enhttps://cyberfeed.cesnet.cz/reports/945?lang=enFFmpeg (a multimedia framework used by popular applications such as VLC Media Player and OBS Studio) fixes a high-severity vulnerability in the MagicYUV decoder in version 9.0. Debian released a fix for trixie in version 7:7.1.5-0+deb13u1 and for forky/sid in version 7:8.1.2-2. Whether a build contains the vulnerable decoder can be verified with the command "ffmpeg -decoders 2>/dev/null | grep magicyuv" (a vulnerable build prints "VFS..D magicyuv"). If an update is not immediately possible, the vulnerable decoder can be disabled at build time with "--disable-decoder=magicyuv". Vulnerabilities: FFmpeg - intro, FFmpeg - out-of-bounds write (CVE-2026-8461, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/945?lang=enhttps://cyberfeed.cesnet.cz/reports/944?lang=enJenkins warns of 30 vulnerabilities in its plugins. The most severe of them are described below; the rest can be found at. Plugins and their fixed versions (where available): Active Directory Plugin – 2.41.2 Assembla Plugin – no fix available at the time of publication Bitbucket Push and Pull Request Plugin – 3.3.9 Contrast Continuous Application Security Plugin – 3.12 EC2 Fleet Plugin – 4.2.3.540.va_6eedb_7b_c112 External Workspace Manager Plugin – 1.4.0 FitNesse Plugin – no fix available at the time of publication Git client Plugin – 6.6.1 Git Parameter Plugin – 462.463.v496a_59f698e5 Gitee Plugin – 1292.v2559f2f3f2c0 GitHub Branch Source Plugin – 1967.1970.vd86979736546 Job Configuration History Plugin – 1367.vc8fa_b_15101dc MCP Server Plugin – 0.178.vffe5a_e770f3b_ OWASP ZAP Plugin – no fix available at the time of publication Pipeline: Groovy Plugin – 4331.4333.v50a_b_076c5199 Priority Sorter Plugin – 936.937.v5581d0b_2ccb_a_ Script Security Plugin – 1402.1405.vc96e74964250 Zowe zDevOps Plugin – no fix available at the time of publication Vulnerabilities: Jenkins - intro, Jenkins Script Security Plugin - Sandbox bypass (CVE-2026-57280, CVSS 8.8), Jenkins External Workspace Manager Plugin - RCE (CVE-2026-57296, CVSS 8.8), Jenkins Script Security Plugin - sandbox bypass (CVE-2026-57281, CVSS 7.5)https://cyberfeed.cesnet.cz/reports/944?lang=enhttps://cyberfeed.cesnet.cz/reports/943?lang=enGitLab fixes 13 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) in versions 19.1.1, 19.0.3 and 18.11.6. The most severe of them are described below; the rest can be found at. Vulnerabilities: GitLab - intro, GitLab EE - XSS (CVE-2026-10086, CVSS 8.7), GitLab CE/EE - XSS (CVE-2026-10712, CVSS 8.0), GitLab EE - information disclosure (CVE-2026-12053, CVSS 7.7)https://cyberfeed.cesnet.cz/reports/943?lang=enhttps://cyberfeed.cesnet.cz/reports/942?lang=enArista fixes 6 vulnerabilities in Arista EOS and Streaming Telemetry Agent (TerminAttr) products. The most severe of them are described below; the others can be found at. Individual products and their fixed versions: Streaming Telemetry Agent (TerminAttr) - 1.31.16, 1.34.13, 1.37.11, 1.40.10, 1.43.6, 1.44.1, 1.45.0 Arista EOS - 4.33.9M, 4.34.8M, 4.35.6M, 4.36.1F The fixed EOS versions 4.33.9M, 4.34.8M and 4.35.6M were not yet available when the advisory was released. Until they are released, the recommended fix is to upgrade the TerminAttr agent. Vulnerabilities: Arista - intro, Arista EOS, TerminAttr - data tampering (CVE-2026-11705, CVSS 9.0), Arista EOS, TerminAttr - improper certificate validation (CVE-2026-52896, CVSS 8.2), Arista EOS, TerminAttr - privilege escalation (CVE-2026-52897, CVSS 6.3)https://cyberfeed.cesnet.cz/reports/942?lang=enhttps://cyberfeed.cesnet.cz/reports/941?lang=enGoogle fixes 33 vulnerabilities in Google Chrome and in other Chromium-based web browsers. Google fixed the vulnerabilities in version 149.0.7827.155 for Chrome on Linux and in version 149.0.7827.155/156 for Chrome on Windows/Mac. Selected vulnerabilities are described below; the remaining ones can be found at. Vulnerabilities: Google Chrome - intro, Google Chrome - use after free (CVE-2026-12439, CVE-2026-12441, CVE-2026-12442, CVE-2026-12443, CVSS 8.8), Google Chrome - use after free (CVE-2026-12437, CVE-2026-12440, CVSS 8.3), Google Chrome - sandbox escape (CVE-2026-12438, CVSS 8.3)https://cyberfeed.cesnet.cz/reports/941?lang=enhttps://cyberfeed.cesnet.cz/reports/939?lang=enSquid fixes 2 vulnerabilities in version 7.6. Vulnerabilities: Squid - intro, Squid - out-of-bounds read (CVE-2026-47729, CVSS 6.5), Squid - heap buffer overflow (CVE-2026-50012, CVSS 5.5)https://cyberfeed.cesnet.cz/reports/939?lang=enhttps://cyberfeed.cesnet.cz/reports/938?lang=enAtlassian fixes 45 vulnerabilities in various products. Atlassian assessed the critical third-party vulnerabilities present as non-critical, given the way they are implemented in its products. The most severe vulnerabilities are described below; the remaining ones can be found at by clicking through the individual advisories. Fixed versions can be found in the links next to each vulnerability. Vulnerabilities: Atlassian - intro, Bamboo Data Center and Server - SSRF (CVE-2026-44492, CVSS 8.6), Confluence Data Center - DoS (CVE-2026-26996, CVSS 8.7), Bamboo Data Center - information disclosure (CVE-2026-44487, CVSS 8.2), Jira Software Data Center, Jira Service Management Data Center - RCE (CVE-2026-42211, CVSS 8.1)https://cyberfeed.cesnet.cz/reports/938?lang=enhttps://cyberfeed.cesnet.cz/reports/936?lang=enSonatype Nexus Repository 3.93.0 fixes a medium-severity vulnerability. Vulnerabilities: Sonatype Nexus Repository Manager - intro, Sonatype Nexus Repository Manager - credentials disclosure (CVE-2026-10741, CVSS 5.9)https://cyberfeed.cesnet.cz/reports/936?lang=enhttps://cyberfeed.cesnet.cz/reports/935?lang=enCisco fixes 5 vulnerabilities in its products. Products and their fixed versions: Cisco Identity Services Engine - 3.3 Patch 11, 3.4 Patch 6, 3.5 Patch 4 (August 2026) Cisco Umbrella Virtual Appliance - 3.8.5 Cisco Crosswork Network Controller - 7.1.3, 7.2.1 Cisco Webex App - fixed in the cloud service Vulnerabilities: Cisco - intro, Cisco Identity Services Engine - RCE, DoS (CVE-2026-20182, CVSS 9.1), Cisco Identity Services Engine - information disclosure (CVE-2026-20190, CVSS 7.5), Cisco Crosswork Network Controller - server-side template injection (CVE-2026-20220, CVSS 6.3), Cisco Umbrella Virtual Appliance - privilege escalation (CVE-2026-20246, CVSS 6.0), Cisco Webex App - open redirect (CVE-2026-20178, CVSS 4.3)https://cyberfeed.cesnet.cz/reports/935?lang=enhttps://cyberfeed.cesnet.cz/reports/933?lang=enSplunk fixes 2 vulnerabilities in Splunk AI Toolkit with version 5.7.4. Vulnerabilities: Splunk - intro, Splunk AI Toolkit - OS command injection (CVE-2026-20266, CVSS 9.1), Splunk AI Toolkit - SSRF (CVE-2026-20265, CVSS 4.3)https://cyberfeed.cesnet.cz/reports/933?lang=enhttps://cyberfeed.cesnet.cz/reports/932?lang=enFortinet warns of 3 vulnerabilities in various products, described below. According to the threat intelligence company Defused, attackers are actively attempting to exploit the critical vulnerability (CVE-2026-25089) in FortiSandbox. In addition, security experts warn of the compromise of tens of thousands of Fortinet firewalls and VPN gateways as part of the FortiBleed campaign. More information about the campaign, including a link to the database of affected domains and the recommended course of action, can be found below. Latest fixed versions of individual products: FortiOS - 8.0.0, 7.6.7, 7.4.12, 7.2.11 FortiPortal - 7.4.11, 7.2.9 FortiProxy - 7.6.6, 7.4.11, 7.2.16 FortiSandbox - 5.2.0, 5.0.6, 4.4.9 The Defused notice also reports exploitation attempts against two previously reported vulnerabilities in FortiSandbox. Apart from the above vulnerabilities, we would like to draw attention to the recently uncovered massive compromise of credentials for more than 75,000 Fortinet firewalls and VPN gateways in 194 countries, which occurred as part of the FortiBleed attack campaign. According to available information, the attackers combined large-scale attacks with mass cracking of login hashes. Detailed technical information about the campaign can be found at. You can check whether your domain is on the list of affected domains at. Subsequently, an immediate change of all passwords related to Fortinet VPN and the administration interface, as well as the activation of MFA, is strongly recommended, as successful exploitation potentially gives attackers full remote access to the organization's entire network. Vulnerabilities: Fortinet - intro, FortiSandbox - OS command execution (CVE-2026-25089, CVSS 9.8), FortiOS, FortiProxy - Lua script execution (CVE-2025-67862, CVSS 6.7), FortiPortal - data disclosure (CVE-2026-49938, CVSS 6.5)https://cyberfeed.cesnet.cz/reports/932?lang=enhttps://cyberfeed.cesnet.cz/reports/931?lang=enCISA has added the critical vulnerability (CVE-2026-48907) in Joomla Content Editor (JCE) to its catalog of actively exploited vulnerabilities. A PoC script can be found at. Products and their fixed versions: JCE - 2.9.99.5 - fixes CVE-2026-48907 JCE - 2.9.99.6 - includes general codebase hardening If you cannot update the JCE software module, it is recommended to uninstall it. Vulnerabilities: JCE - intro, JCE - PHP code upload and execution (CVE-2026-48907, CVSS 10.0)https://cyberfeed.cesnet.cz/reports/931?lang=enhttps://cyberfeed.cesnet.cz/reports/930?lang=enApache fixes 13 vulnerabilities in Apache HTTP Server with version 2.4.68. The most severe vulnerabilities are described below, the remaining ones can be found at. The CVE-2026-49975 vulnerability has already been reported in the past and its description can be found at. Debian releases fixing the CVE-2026-49975 vulnerability: bookworm (security) - 2.4.67-1~deb12u3 trixie (security) - 2.4.67-1~deb13u3 Debian releases fixing the other vulnerabilities: bullseye (security) - 2.4.67-1~deb11u3 forky, sid - 2.4.68-1 Red Hat releases fixing CVE-2026-49975 can be found at Vulnerabilities: Apache HTTP - intro, Apache HTTP - DoS (CVE-2026-42535, CVSS 8.1), Apache HTTP - DoS, RCE (CVE-2026-44631, CVSS 9.8), Apache HTTP - DoS, RCE (CVE-2026-29167, CVSS 9.8)https://cyberfeed.cesnet.cz/reports/930?lang=enhttps://cyberfeed.cesnet.cz/reports/929?lang=enQNAP fixes 17 vulnerabilities in its products. Selected vulnerabilities are described below, the remaining ones can be found at. Products and their fixed versions: QuMagie - 2.9.1, 2.10.0 License Center - 2.0.42 QVP - 2.8.0 QTS - 5.2.10 QuTS cloud - C5.2.9 QuTS hero - h5.2.9 Vulnerabilities: QNAP - intro, QuMagie - information disclosure (CVE-2026-44083, CVSS 9.8), QuMagie - information disclosure (CVE-2026-26236, CVSS 7.5), QuMagie - information disclosure (CVE-2026-26237, CVSS 7.5), QTS, QuTS hero, QuTS cloud, QVP - command injection (CVE-2025-66273, CVSS 7.2), QTS, QuTS hero, QuTS cloud, QVP - command injection (CVE-2025-66279, CVSS 7.2)https://cyberfeed.cesnet.cz/reports/929?lang=enhttps://cyberfeed.cesnet.cz/reports/927?lang=enMozilla fixes over 40 vulnerabilities in various products. Selected vulnerabilities are listed below, the remaining ones can be found at by expanding the individual advisories. Individual products and their fixed versions: Firefox - 152 Firefox for iOS - 152.0 Firefox ESR 115.37, 140.12 Thunderbird - 152 Thunderbird ESR - 140.12 Vulnerabilities: Mozilla Firefox - intro, Mozilla Firefox, Firefox ESR, Thunderbird, Thunderbird ESR - privilege escalation (CVE-2026-12289, CVSS 8.8), Mozilla Firefox, Firefox ESR, Thunderbird, Thunderbird ESR - sandbox escape (CVE-2026-12294, CVSS 7.5), Mozilla Firefox, Firefox ESR, Thunderbird, Thunderbird ESR - use-after-free (CVE-2026-12291, CVSS 7.5), Mozilla Firefox, Firefox ESR, Thunderbird, Thunderbird ESR - arbitrary code execution (CVE-2026-12328, CVSS 8.1), Mozilla Firefox for iOS - arbitrary cookies injection (CVE-2026-53900, CVSS 4.3)https://cyberfeed.cesnet.cz/reports/927?lang=enhttps://cyberfeed.cesnet.cz/reports/926?lang=enGrafana Operator fixes 1 medium-severity vulnerability with version 5.24.0. Vulnerabilities: Grafana Operator - intro, Grafana Operator - path traversal (CVE-2026-11769, CVSS 6.4)https://cyberfeed.cesnet.cz/reports/926?lang=enhttps://cyberfeed.cesnet.cz/reports/925?lang=enWith versions 20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1 and 26.1.1.2, Cisco fixes a medium-severity vulnerability in Cisco Catalyst SD-WAN Manager, which, based on evidence of active exploitation, has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. In addition to updating, administrators are advised to check their systems for the indicators of compromise (IoC) that Cisco lists in its report. Vulnerabilities: Cisco Catalyst SD-WAN Manager - intro, Cisco Catalyst SD-WAN Manager - arbitrary file write (CVE-2026-20262, CVSS 6.5)https://cyberfeed.cesnet.cz/reports/925?lang=enhttps://cyberfeed.cesnet.cz/reports/924?lang=enWith versions 10.6.27, 10.11.18, 11.4.12, 11.8.8 and 12.3.2, MariaDB Server fixes 3 vulnerabilities, 1 of them critical. Vulnerabilities: MariaDB Server - intro, MariaDB Server - shell command execution (CVE-2026-49261, CVSS 10.0), MariaDB Server - shell command execution (CVE-2026-48165, CVSS 8.0), MariaDB Server - shell command execution (CVE-2026-48163, CVSS 8.0)https://cyberfeed.cesnet.cz/reports/924?lang=enhttps://cyberfeed.cesnet.cz/reports/923?lang=enZoom fixes 3 vulnerabilities in its products. Products and their fixed versions: Zoom Workplace Mobile Clients - 7.0.4 (Android), 7.0.3 (iOS) Remote Control for Zoom Contact Center (Windows) - 7.0.0 Vulnerabilities: Zoom - intro, Zoom Workplace Mobile Clients - privilege escalation (CVE-2026-53407, CVE-2026-53408, CVSS 8.1), Zoom Contact Center - privilege escalation (CVE-2026-53406, CVSS 7.8)https://cyberfeed.cesnet.cz/reports/923?lang=enhttps://cyberfeed.cesnet.cz/reports/921?lang=enIvanti fixes 3 vulnerabilities in Ivanti Sentry and Ivanti Endpoint Manager Mobile. Based on evidence of active exploitation, the CVE-2026-10520 vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. Products and their fixed versions: Ivanti Sentry - 10.5.2, 10.6.2, 10.7.1 Ivanti Endpoint Manager Mobile - 12.9.0.1, 12.8.0.3, 12.7.0.2 Vulnerabilities: Ivanti - intro, Ivanti Sentry - RCE (CVE-2026-10520, CVSS 10.0), Ivanti Sentry - authentication bypass (CVE-2026-10523, CVSS 10.0), Ivanti Endpoint Manager Mobile - arbitrary command execution (CVE-2026-10727, CVSS 7.2)https://cyberfeed.cesnet.cz/reports/921?lang=enhttps://cyberfeed.cesnet.cz/reports/920?lang=enGoogle has released security updates for the Google Chrome web browser that fix a total of 74 vulnerabilities. Among them is the high-severity vulnerability CVE-2026-11645 in the V8 JavaScript engine, which has already been observed being actively exploited. To ensure optimal protection, users are advised to update without delay to versions 149.0.7827.102/.103 (Windows, Apple macOS) and to version 149.0.7827.102 (Linux). Vulnerabilities: Chrome V8 - intro, Google Chrome - RCE (CVE-2026-11645, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/920?lang=enhttps://cyberfeed.cesnet.cz/reports/919?lang=enWith versions 16.10.17, 17.4.10, 17.10.4 and 18.1.0-rc-1, XWiki Platform fixes 1 vulnerability. Vulnerabilities: XWiki - intro, XWiki Platform - privilege escalation (CVE-2026-53966, CVSS 7.1)https://cyberfeed.cesnet.cz/reports/919?lang=enhttps://cyberfeed.cesnet.cz/reports/918?lang=enAs part of its June patches released so far, VMware Spring fixes 67 vulnerabilities in various products. The most severe of them are described below. The complete list of vulnerabilities, including fixed versions, can be found at by expanding the individual advisories. Vulnerabilities: VMware Spring - intro, Spring Web Services - SSRF (CVE-2026-40999, CVSS 8.6), Spring Web Services - XXE (CVE-2026-40998, CVSS 8.2), Spring Data REST - authorization bypass (CVE-2026-41728, CVSS 7.5), Spring Framework - class deserialization (CVE-2026-41855, CVSS 8.1), Spring for GraphQL - RCE (CVE-2026-41699, CVSS 8.1)https://cyberfeed.cesnet.cz/reports/918?lang=enhttps://cyberfeed.cesnet.cz/reports/917?lang=enSplunk fixes 12 vulnerabilities in various products. The most severe of them are described below, the others can be found at. Individual products and their fixed versions: Splunk SOAR – 8.5.0 Splunk Enterprise – 10.4.0, 10.2.4, 10.0.7, 9.4.12, 9.3.13 Splunk Cloud Platform – 10.4.2604.0, 10.4.2604.3, 10.3.2512.11, 10.3.2512.12, 10.3.2512.13, 10.2.2510.14, 10.2.2510.15, 10.1.2507.22, 10.1.2507.23, 10.0.2503.14, 9.3.2411.131, 9.3.2411.132 Splunk Secure Gateway – 3.10.6, 3.9.20, 3.8.67 Vulnerabilities: Splunk - intro, Splunk Enterprise, Splunk Cloud Platform - missing authentication (CVE-2026-20253, CVSS 9.8), Splunk Enterprise, Splunk Cloud Platform - SSRF (CVE-2026-20252, CVSS 7.6), Splunk Enterprise, Splunk Cloud Platform, Splunk Secure Gateway - RCE (CVE-2026-20251, CVSS 8.8), Splunk Enterprise, Splunk Cloud Platform - stored XSS (CVE-2026-20258, CVSS 7.1)https://cyberfeed.cesnet.cz/reports/917?lang=enhttps://cyberfeed.cesnet.cz/reports/916?lang=enGitLab versions 19.0.2, 18.11.5 and 18.10.8 fix 12 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE). The most severe ones are listed below, the rest can be found at. Vulnerabilities: GitLab CE/EE - intro, GitLab EE - improper access control (CVE-2026-6552, CVSS 8.7), GitLab EE - XSS (CVE-2026-10087, CVSS 8.7), GitLab CE/EE - DoS (CVE-2026-7250, CVSS 7.5), GitLab EE - HTML injection (CVE-2026-8589, CVSS 7.3), GitLab CE/EE - DoS (CVE-2026-1500, CVSS 6.5), GitLab CE/EE - improper access control (CVE-2026-6269, CVSS 5.4)https://cyberfeed.cesnet.cz/reports/916?lang=enhttps://cyberfeed.cesnet.cz/reports/915?lang=enAs part of the June “Patch Tuesday”, Microsoft released fixes for more than 200 vulnerabilities. The most severe ones are described below; a complete overview of all vulnerabilities, including the available fixes, is provided at in the details of the individual entries. Vulnerabilities: Microsoft - intro, Windows HTTP.sys - RCE (CVE-2026-47291, CVSS 9.8), Windows Kernel - RCE (CVE-2026-45657, CVSS 9.8), Windows DHCP Client Service - RCE (CVE-2026-44815, CVSS 9.8), Remote Desktop Client - RCE (CVE-2026-42985, CVSS 8.8), Windows HTTP.sys - DoS (CVE-2026-49160, CVSS 7.5), Windows Collaborative Translation Framework - privilege escalation (CVE-2026-45586, CVSS 7.8), Windows BitLocker - security feature bypass (CVE-2026-50507, CVSS 6.8), Windows Active Directory Domain Services - RCE (CVE-2026-45648, CVSS 8.8), Microsoft Outlook, Microsoft Word - RCE (CVE-2026-45456, CVSS 8.4), Azure Kubernetes Service - RCE (CVE-2026-32193, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/915?lang=enhttps://cyberfeed.cesnet.cz/reports/914?lang=enZephyr Project warns of a critical vulnerability in the Zephyr operating system, specifically in the HTTP server path for upgrading to WebSocket. At the time of the announcement, the vendor does not list a released fixed version; however, source code fixes are available in the main branch and in a backport for v4.3. Vulnerabilities: Zephyr Project - intro, Zephyr RTOS - out-of-bounds read/write, DoS, RCE (CVE-2026-5067, CVSS 9.8)https://cyberfeed.cesnet.cz/reports/914?lang=enhttps://cyberfeed.cesnet.cz/reports/913?lang=enOpenVPN versions 2.6.20 and 2.7.2 fix 1 vulnerability. Vulnerabilities: OpenVPN - intro, OpenVPN - DoS (CVE-2026-35058, CVSS 6.9)https://cyberfeed.cesnet.cz/reports/913?lang=enhttps://cyberfeed.cesnet.cz/reports/912?lang=enVMware fixes 3 vulnerabilities in its products that contain the VMware Cloud Foundation Operations and VMware Aria Operations components. For VMware Telco Cloud Platform, follow KB443138. Products and their fixed versions: VMware Cloud Foundation - 9.1.0.0, 9.0.2.0 EP2, 8.18.7, VMware vSphere Foundation - 9.1.0.0, 9.0.2.0 EP2, VMware Aria Operations - 8.18.7. Vulnerabilities: VMware VCF - intro, VMware Cloud Foundation Operations, VMware Aria Operations - XSS (CVE-2026-41722, CVE-2026-41723, CVE-2026-41724, CVSS 8.0)https://cyberfeed.cesnet.cz/reports/912?lang=enhttps://cyberfeed.cesnet.cz/reports/911?lang=enGoogle fixes 429 vulnerabilities in Google Chrome and other Chromium-based web browsers. Google fixed the vulnerabilities in version 149.0.7827.53 for Chrome on Linux and in version 149.0.7827.53/54 for Chrome on Windows/Mac. Selected vulnerabilities are described below; the remaining ones can be found at. Microsoft released Edge version 149.0.4022.52, which contains the latest security fixes. The list of related vulnerabilities has not yet been published. Vulnerabilities: Google Chrome - intro, Google Chrome - out of bounds read/write (CVE-2026-10881, CVE-2026-10886, CVE-2026-10892, CVSS 9.3), Google Chrome – use after free (CVE-2026-10882, CVE-2026-10885, CVE-2026-10893, CVE-2026-10895, CVE-2026-10896, CVSS 8.8), Google Chrome - use after free (CVE-2026-10884, CVE-2026-10889, CVE-2026-10894, CVE-2026-10898, CVSS 8.3)https://cyberfeed.cesnet.cz/reports/911?lang=enhttps://cyberfeed.cesnet.cz/reports/910?lang=enIvanti fixes a high-severity vulnerability in Ivanti Neurons for ITSM. Customers using on-premises deployments can remediate this vulnerability by updating to one of the fixed versions of Ivanti ITSM, namely 2025.4 Patch 1, 2025.3 Patch 1 or 2025.2 Patch 1. For cloud solutions, the vulnerability has been addressed through service updates in versions 2026.1 Patch 9 and 2026.2 Patch 1, and no further action is required on the part of customers. Vulnerabilities: Ivanti Neurons - intro, Ivanti Neurons for ITSM - privilege escalation (CVE-2026-9614, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/910?lang=enhttps://cyberfeed.cesnet.cz/reports/909?lang=enNVIDIA fixes 36 vulnerabilities (since May 2026) in various products. The most severe ones are described below, the rest can be found in the vendor's official security bulletin. NVIDIA NVTabular - 08e0633 Isaac Launchable - 1.2 NVIDIA Merlin Transformers4Rec - any commit in the main branch after 11 March 2026 Triton Inference Server (Linux) - r26.03 Triton Inference Server (DALI Backend) - r26.03 TensorRT-LLM - v1.2.1 NVIDIA GPU Display Drivers - a list of fixed versions can be found at TensorRT - v10.16.1 DGX Spark - OTA0 BioNeMo Framework (Linux) - any code branch that includes commit dfd83a7 Vulnerabilities: NVIDIA - intro, NVIDIA Triton Inference Server - RCE, DoS, data tampering (CVE-2026-24207, CVSS 9.8), NVIDIA BioNeMo Framework - RCE, DoS, data tampering (CVE-2026-24217, CVSS 8.8), NVIDIA GPU Display Drivers - DoS, PE, RCE, data tampering (CVE-2026-24187, CVSS 8.8), NVIDIA DGX Spark - RCE, DoS, EoP, data tampering (CVE-2026-24218, CVSS 8.1), NVIDIA TensorRT - Data tampering, DoS (CVE-2026-24188, CVSS 8.2)https://cyberfeed.cesnet.cz/reports/909?lang=enhttps://cyberfeed.cesnet.cz/reports/908?lang=enX.Org X server version 21.1.23 and Xwayland version 24.1.12 fix 9 vulnerabilities. The most severe ones are listed below. The fixes are also available as commits, a list of which can be found at. Among operating systems, fixes have been released, for example, by Slackware in SSA:2026-154-04 and by Debian for sid in version 2:21.1.23-1 (xorg-server) and for forky, sid in version 2:24.1.12-1 (xwayland). Vulnerabilities: X.Org X server and Xwayland - intro, X.Org X server and Xwayland - DoS, LPE (CVE-2026-50256, CVSS 7.8), X.Org X server and Xwayland - DoS, LPE (CVE-2026-50257, CVSS 7.8), X.Org X server and Xwayland - DoS, LPE (CVE-2026-50260, CVSS 7.8), X.Org X server and Xwayland - DoS, LPE (CVE-2026-50264, CVSS 7.8)https://cyberfeed.cesnet.cz/reports/908?lang=enhttps://cyberfeed.cesnet.cz/reports/906?lang=enCisco has observed limited exploitation of the high-severity vulnerability CVE-2026-20245, leading to configuration changes on end devices. Neither a direct fix nor a mitigation is available yet. Cisco therefore recommends updating to the fixed software version listed in the Catalyst SD-WAN security advisory for CVE-2026-20182 and verifying the configuration of end devices. On 9 June 2026, a fix was released in version 20.18.3.1. We recommend updating without delay. Vulnerabilities: Cisco Catalyst SD-WAN Manager - intro, Cisco Catalyst SD-WAN Manager - authenticated privilege escalation (CVE-2026-20245, CVSS 7.8)https://cyberfeed.cesnet.cz/reports/906?lang=enhttps://cyberfeed.cesnet.cz/reports/905?lang=enSynology fixes 3 vulnerabilities in Synology Chat Server with version 2.4.5-22148. Vulnerabilities: Synology - intro, Synology Chat Server - arbitrary file read/write, DoS (CVE-2026-40541, CVSS 9.0), Synology Chat Server - arbitrary file read/write, DoS (CVE-2026-9548, CVSS 6.5), Synology Chat Server - information disclosure (CVE-2026-9491, CVSS 4.3)https://cyberfeed.cesnet.cz/reports/905?lang=enhttps://cyberfeed.cesnet.cz/reports/904?lang=enAcronis fixes 4 high-severity vulnerabilities by releasing Acronis DeviceLock DLP 9.0 Update 7 for Windows systems. Vulnerabilities: Acronis - intro, Acronis DeviceLock DLP (Windows) - EXE hijacking, LPE (CVE-2026-44609, CVSS 7.3), Acronis DeviceLock DLP (Windows) - DLL hijacking, LPE (CVE-2026-44682, CVE-2026-50033, CVSS 7.3), Acronis DeviceLock DLP (Windows) - LPE (CVE-2026-42061, CVSS 7.3)https://cyberfeed.cesnet.cz/reports/904?lang=enhttps://cyberfeed.cesnet.cz/reports/903?lang=enPostgreSQL versions 18.4, 17.10, 16.14, 15.18 and 14.23 fix 11 vulnerabilities. The most severe ones are described below, the rest can be found at. Vulnerabilities: PostgreSQL - intro, PostgreSQL - SQL injection (CVE-2026-6637, CVSS 8.8), PostgreSQL - stack memory overwrite (CVE-2026-6477, CVSS 8.8), PostgreSQL - file overwrite (CVE-2026-6475, CVSS 8.8), PostgreSQL - integer wraparound (CVE-2026-6473, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/903?lang=enhttps://cyberfeed.cesnet.cz/reports/901?lang=enSolarWinds fixes a high-severity vulnerability in Serv-U with version 15.5.4 HF1. Vulnerabilities: SolarWinds Serv-U - intro, SolarWinds Serv-U - DoS (CVE-2026-28318, CVSS 7.5)https://cyberfeed.cesnet.cz/reports/901?lang=enhttps://cyberfeed.cesnet.cz/reports/900?lang=enCisco fixes 3 vulnerabilities in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Webex Meetings and Cisco Finesse. Fixed versions of the individual products: Cisco Unified CM and Unified CM SME - 14SU6, 15SU5 (September 2026) or COP Cisco Webex Meetings - fixed in the cloud service Cisco Finesse - 15.0(1)SU1 Vulnerabilities: Cisco - intro, Cisco Unified Communications Manager - SSRF (CVE-2026-20230, CVSS 8.6), Cisco Webex Meetings - XSS (CVE-2026-20233, CVSS 6.1), Cisco Finesse - remote file inclusion (CVE-2026-20175, CVSS 6.1)https://cyberfeed.cesnet.cz/reports/900?lang=enhttps://cyberfeed.cesnet.cz/reports/899?lang=ena newly published vulnerability named HTTP/2 Bomb poses a critical risk to the availability of most of the commonly used web servers. The vulnerability is officially registered under the Apache project, but in the default HTTP/2 configuration it also affects NGINX, Microsoft IIS, Envoy and Cloudflare Pingora servers. Status of web server fixes: nginx - 1.29.8 and later; a temporary mitigation is to disable HTTP/2 completely using http2 off;. Apache httpd - mod_http2 v2.0.41; available in httpd trunk and in standalone mod_http2 releases, not yet available in the 2.4.x branch; a temporary mitigation is to disable HTTP/2 using Protocols http/1.1. Envoy - 1.35.11, 1.36.7, 1.37.3, 1.38.1 (validation of effectiveness is in progress). Microsoft IIS (including Microsoft Server 2025), Cloudflare Pingora - currently not available. Vulnerabilities: NGINX, Apache httpd, Microsoft IIS, Envoy, Cloudflare Pingora - intro, NGINX, Apache httpd, Microsoft IIS, Envoy, Cloudflare Pingora - DoS (CVE-2026-49975, CVSS 9.2)https://cyberfeed.cesnet.cz/reports/899?lang=enhttps://cyberfeed.cesnet.cz/reports/897?lang=enThe Apache Software Foundation warns of a vulnerability in Apache Solr. The fix will be included in the not yet released versions 9.11.0 and 10.1.0. Until they are released, it is recommended as a temporary measure to remove the template users (superadmin, admin, search and index) from the security.json file, or to change their passwords. Vulnerabilities: Apache Solr - intro, Apache Solr - unauthorized administrative access (CVE-2026-44825, CVSS 8.1)https://cyberfeed.cesnet.cz/reports/897?lang=enhttps://cyberfeed.cesnet.cz/reports/896?lang=enrsync version 3.4.3 fixes 6 vulnerabilities affecting both the client and the server side, the most severe of which are described below. Red Hat systems do not offer a fix yet, Debian has provided fixes (except for CVE-2026-45232) for all security releases. Ubuntu fixes all vulnerabilities in the resolute, questing, noble and jammy releases and all except the one mentioned above also in the focal, bionic, xenial and trusty releases. Gentoo has an update available for the most common architectures. Individual OS releases and their fixed versions: Debian: bullseye (security) - 3.2.3-4+deb11u4 bookworm (security) - 3.2.7-1+deb12u5 trixie (security) - 3.4.1+ds1-5+deb13u3 forky, sid - 3.4.3+ds1-2 Ubuntu: resolute - 3.4.1+ds1-7ubuntu0.2 questing - 3.4.1+ds1-5ubuntu1.2 noble - 3.2.7-1ubuntu1.4 jammy - 3.2.7-0ubuntu0.22.04.6 focal - 3.1.3-8ubuntu0.9+esm1 bionic - 3.1.2-2.1ubuntu1.6+esm3 xenial - 3.1.1-3ubuntu1.3+esm5 trusty - 3.1.0-2ubuntu0.4+esm3 Gentoo - 3.4.3 Vulnerabilities: rsync - intro, rsync - information disclosure (CVE-2026-43618, CVSS 8.1), rsync - privilege escalation (CVE-2026-29518, CVSS 7.8)https://cyberfeed.cesnet.cz/reports/896?lang=enhttps://cyberfeed.cesnet.cz/reports/895?lang=enSolarWinds fixes a high-severity vulnerability in Web Help Desk with version 2026.2. Vulnerabilities: SolarWinds Web Help Desk - intro, SolarWinds Web Help Desk - DoS (CVE-2026-28299, CVSS 8.2)https://cyberfeed.cesnet.cz/reports/895?lang=enhttps://cyberfeed.cesnet.cz/reports/894?lang=enMozilla fixes 2 vulnerabilities in Firefox for iOS with version 151.2. Vulnerabilities: Mozilla Firefox - intro, Mozilla Firefox - arbitrary code execution (CVE-2026-9308, CVSS 5.4), Mozilla Firefox - arbitrary code execution (CVE-2026-9309, CVSS 5.4)https://cyberfeed.cesnet.cz/reports/894?lang=enhttps://cyberfeed.cesnet.cz/reports/893?lang=enElastic fixes 10 vulnerabilities in Kibana with versions 8.19.16, 9.2.8, 9.3.5 and 9.4.2. The most severe vulnerabilities are described below, the remaining ones can be found at. Vulnerabilities: Elastic Kibana - intro, Elastic Kibana - SSRF (CVE-2026-42398, CVSS 7.7), Elastic Kibana - Privilege escalation, unauthorized read/write (CVE-2026-49095, CVSS 6.5)https://cyberfeed.cesnet.cz/reports/893?lang=enhttps://cyberfeed.cesnet.cz/reports/892?lang=enThe Apache Software Foundation fixes 2 vulnerabilities in Apache ActiveMQ products (Classic, All, Broker) with versions 5.19.7 and 6.2.6. Vulnerabilities: Apache ActiveMQ, ActiveMQ All & Broker - intro, Apache ActiveMQ - privilege escalation (CVE-2026-49157, CVSS 8.8), Apache ActiveMQ, ActiveMQ All & Broker - sensitive information exposure (CVE-2026-49270, CVSS 5.9)https://cyberfeed.cesnet.cz/reports/892?lang=enhttps://cyberfeed.cesnet.cz/reports/891?lang=enBIND 9 fixes 6 vulnerabilities in BIND 9 and BIND Supported Preview Edition. The most severe of them are described below. Products and their fixed versions: BIND 9 - 9.20.26, 9.21.24 BIND Supported Preview Edition - 9.20.26-S1 Debian releases and their fixed versions: trixie (security) - 1:9.20.26-1~deb13u1 Ubuntu releases and their fixed versions: resolute - 1:9.20.18-1ubuntu2.1 questing - 1:9.20.11-1ubuntu2.4 noble - 1:9.18.39-0ubuntu0.24.04.5 jammy - 1:9.18.39-0ubuntu0.22.04.4 Vulnerabilities: BIND 9 - intro, BIND 9 - Missing reference (CVE-2026-3039, CVSS 7.5), BIND 9 - Use After Free (CVE-2026-3593, CVSS 7.4), BIND 9 - Multiple Flaws (CVE-2026-5946, CVSS 7.5), BIND 9 - Use After Free, Race Condition (CVE-2026-5947, CVSS 7.5)https://cyberfeed.cesnet.cz/reports/891?lang=enhttps://cyberfeed.cesnet.cz/reports/890?lang=enMicrosoft has released updates for Microsoft Defender that fix a total of 3 vulnerabilities. According to CISA, two of them (CVE-2026-41091 and CVE-2026-45498) are already being actively exploited. Vulnerabilities: Microsoft Defender - intro, Microsoft Defender - RCE (CVE-2026-45584, CVSS 8.1), Microsoft Defender - privilege escalation (CVE-2026-41091, CVSS 7.8), Microsoft Defender - DoS (CVE-2026-45498, CVSS 4.0)https://cyberfeed.cesnet.cz/reports/890?lang=enhttps://cyberfeed.cesnet.cz/reports/889?lang=enF5 Networks fixes over 50 vulnerabilities in various products. Selected vulnerabilities are described below, the remaining ones can be found at. Latest fixed versions of individual products: BIG-IP (all modules) - 21.0.0.2, 17.5.1.6, 17.1.3.2 BIG-IQ Centralized Management - 8.4.2 BIG-IP Next SPK - 2.0.3, 1.7.17 BIG-IP Next CNF - 2.0.3, 1.4.1 BIG-IP Next for Kubernetes - 2.2.0 NGINX Plus - 37.0.1.1, R36 P5, R32 P7 NGINX Open Source - 1.31.1, 1.30.2 NGINX Gateway Fabric - 2.6.2 NGINX Ingress Controller - 5.4.3 F5 WAF for NGINX - 5.13.0 F5 DoS for NGINX - 4.9.0 NGINX JavaScript (njs) - 0.9.9 Vulnerabilities: F5 - intro, NGINX (CVE-2026-9256) - DoS, RCE (CVSS 9.2), NGINX JavaScript (CVE-2026-8711) - DoS, RCE (CVSS 9.2), BIG-IP & BIG-IQ Centralized Management (CVE-2026-41957) - command execution, unauthorized operations (CVSS 8.7)https://cyberfeed.cesnet.cz/reports/889?lang=enhttps://cyberfeed.cesnet.cz/reports/887?lang=enOpenVPN Connect for macOS version 3.8.2 fixes 1 critical vulnerability. Vulnerabilities: OpenVPN Connect - intro, OpenVPN Connect - arbitrary command execution (CVE-2026-9560, CVSS 9.4)https://cyberfeed.cesnet.cz/reports/887?lang=enhttps://cyberfeed.cesnet.cz/reports/886?lang=enPalo Alto Networks fixes an actively exploited vulnerability in PAN-OS. Individual fixed versions of the product: PAN-OS 12.1 - 12.1.4-h6, 12.1.7 PAN-OS 11.2 - 11.2.4-h17, 11.2.7-h14, 11.2.10-h7, 11.2.12 PAN-OS 11.1 - 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, 11.1.15 PAN-OS 10.2 - 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, 10.2.18-h6 Prisma Access* - 11.2.0 - 11.2.7-h13 Prisma Access* - 10.2.0 - 10.2.10-h36 *The Prisma Access cloud service is updated continuously for all customers according to a planned schedule. Vulnerabilities: Palo Alto Networks PAN-OS - intro, Palo Alto Networks PAN-OS - authentication bypass (CVE-2026-0257, CVSS 7.8)https://cyberfeed.cesnet.cz/reports/886?lang=enhttps://cyberfeed.cesnet.cz/reports/885?lang=enGoogle fixes 151 vulnerabilities in the Google Chrome browser and other browsers based on the Chromium engine. The fix has been released for Windows (148.0.7778.216/217), macOS (148.0.7778.215/216) and Linux (148.0.7778.215). Selected vulnerabilities are described below, the remaining ones can be found at. The fix for the Microsoft Edge browser is available in version 150.0.4078.83. Details of the vulnerabilities have not yet been published, probably in accordance with responsible disclosure policies. Vulnerabilities: Google Chrome - intro, Google Chrome - out-of-bounds write (CVE-2026-9872, CVE-2026-9879, CVSS 9.6), Google Chrome - use after free (CVE-2026-9873, CVE-2026-9874, CVE-2026-9876, CVE-2026-9877, CVE-2026-9878, CVE-2026-9881, CVE-2026-9883, CVE-2026-9884, CVE-2026-9886, CVE-2026-9887, CVE-2026-9888, CVE-2026-9890, CVE-2026-9891, CVE-2026-9893, CVSS 9.6)https://cyberfeed.cesnet.cz/reports/885?lang=enhttps://cyberfeed.cesnet.cz/reports/884?lang=enMozilla fixes 36 vulnerabilities in various products. The most severe vulnerabilities are listed below. Individual products and their fixed versions: Firefox - 151 Firefox ESR - 140.11, 115.36 Firefox for iOS - 151, 151.1 Thunderbird - 151 Thunderbird ESR - 140.11 Vulnerabilities: Mozilla Firefox, Firefox ESR, Thunderbird - intro, Mozilla Firefox, Firefox ESR, Thunderbird - out-of-bounds write (CVE-2026-8946, CVSS 7.5), Mozilla Firefox, Firefox ESR, Thunderbird - DoS (CVE-2026-8947, CVSS 7.3), Mozilla Firefox, Firefox ESR, Thunderbird - RCE (CVE-2026-8975, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/884?lang=enhttps://cyberfeed.cesnet.cz/reports/883?lang=enVeeam fixes 3 vulnerabilities in Veeam Service Provider Console and Veeam Backup & Replication. Individual products and their fixed versions: Veeam Service Provider Console - 9.2.1.33875 Veeam Backup & Replication - 13.0.2.29 Vulnerabilities: Veeam - intro, Veeam Service Provider Console - RCE (CVE-2026-32998, CVSS 9.4), Veeam Backup & Replication - arbitrary file write (CVE-2026-32997, CVSS 8.6), Veeam Backup & Replication - privilege escalation (CVE-2026-32996, CVSS 7.3)https://cyberfeed.cesnet.cz/reports/883?lang=enhttps://cyberfeed.cesnet.cz/reports/882?lang=enGitLab fixes 7 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) with versions 19.0.1, 18.11.4 and 18.10.7. The most severe of them can be found below, the remaining ones at. Vulnerabilities: GitLab CE/EE - intro, GitLab EE - user impersonation (CVE-2026-4868, CVSS 8.2), GitLab CE/EE - DoS (CVE-2026-1402, CVSS 6.5), GitLab CE/EE - private projects enumeration (CVE-2026-6713, CVSS 5.3)https://cyberfeed.cesnet.cz/reports/882?lang=enhttps://cyberfeed.cesnet.cz/reports/881?lang=enMicrosoft fixes a high-severity vulnerability in SharePoint. Product fixes (build number): Microsoft SharePoint Server Subscription Edition - 16.0.19725.20280 Microsoft SharePoint Server 2019 - 16.0.10417.20128 Microsoft SharePoint Enterprise Server 2016 - 16.0.5552.1002 Vulnerabilities: Microsoft SharePoint Server - intro, Microsoft SharePoint Server - RCE (CVE-2026-45659, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/881?lang=enhttps://cyberfeed.cesnet.cz/reports/880?lang=enSamba fixes 6 vulnerabilities, 1 of them critical, with versions 4.24.2, 4.23.7 and 4.22.9. The most severe of them are described below, the remaining ones can be found at. Individual Debian and Ubuntu releases and their fixed versions: Debian: bookworm - 2:4.17.12+dfsg-0+deb12u4 trixie - 2:4.22.8+dfsg-0+deb13u2 Ubuntu: resolute - 2:4.23.6+dfsg-1ubuntu2.1 questing - 2:4.22.3+dfsg-4ubuntu2.4 noble - 2:4.19.5+dfsg-4ubuntu9.6 jammy - 2:4.15.13+dfsg-0ubuntu1.12 Vulnerabilities: Samba - intro, Samba - RCE (CVE-2026-4408, CVSS 10.0), Samba - RCE (CVE-2026-4480, CVSS 8.5), Samba - communication spoofing (CVE-2026-3012, CVSS 8.0)https://cyberfeed.cesnet.cz/reports/880?lang=enhttps://cyberfeed.cesnet.cz/reports/879?lang=enCisco fixes 9 vulnerabilities in its products. The most severe of them are described below; the rest can be found at. Based on evidence of active exploitation, CVE-2026-20182 has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. Fixed versions of individual products: Cisco ThousandEyes Virtual Appliance - 0.262.0 Cisco Secure Workload - 3.10.8.3, 4.0.3.17 Cisco Catalyst SD-WAN - 20.9.9.1, 20.12.7.1, 20.12.5.4, 20.12.6.2, 20.15.4.4, 20.15.5.2, 20.18.2.2, 26.1.1.1 The availability of a fix for Cisco NX-OS Software can be verified using the Cisco Software Checker tool. Vulnerabilities: Cisco - intro, Cisco Catalyst SD-WAN Controller - authentication bypass (CVE-2026-20182, CVSS 10.0), Cisco Catalyst SD-WAN Manager - XXE (CVE-2026-20224, CVSS 8.6), Cisco Secure Workload - unauthorized API access (CVE-2026-20223, CVSS 10.0)https://cyberfeed.cesnet.cz/reports/879?lang=enhttps://cyberfeed.cesnet.cz/reports/878?lang=enPalo Alto fixes 8 vulnerabilities in PAN-OS (PA-Series and VM-Series firewalls). The most severe vulnerabilities are described below; the rest can be found at. Some of the fixes are expected to be released on 28 May 2026, see. Fixed versions of the product: PAN-OS 12.1 - 12.1.4-h5, 12.1.7 PAN-OS 11.2 - 11.2.4-h17, 11.2.7-h13, 11.2.10-h6, 11.2.12 PAN-OS 11.1 - 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, 11.1.15 PAN-OS 10.2 - 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, 10.2.18-h6 Vulnerabilities: Palo Alto Networks - intro, Palo Alto Networks PAN-OS - authentication bypass (CVE-2026-0265, CVSS 7.2), Palo Alto Networks PAN-OS - RCE (CVE-2026-0264, CVSS 7.2), Palo Alto Networks PAN-OS - RCE (CVE-2026-0263, CVSS 7.2)https://cyberfeed.cesnet.cz/reports/878?lang=enhttps://cyberfeed.cesnet.cz/reports/877?lang=enGitLab fixes 25 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) with versions 18.11.3, 18.10.6 and 18.9.7. The most severe of them can be found below, the rest at. Vulnerabilities: GitLab - intro, GitLab - XSS (CVE-2026-7481, CVSS 8.7), GitLab - XSS (CVE-2026-6073, CVSS 8.7), GitLab - XSS (CVE-2026-7377, CVSS 8.7)https://cyberfeed.cesnet.cz/reports/877?lang=enhttps://cyberfeed.cesnet.cz/reports/876?lang=enNGINX fixes 6 vulnerabilities in various products. The most severe vulnerabilities are described below. The remaining vulnerabilities can be found at,,. Products and their fixed versions: NGINX Open Source - 1.31.0, 1.30.1 NGINX Plus - 37.0.0, R36 P4, R32 P6 Vulnerabilities: NGINX - intro, NGINX - RCE (CVE-2026-42945, CVSS 9.2), NGINX - Memory Allocation (CVE-2026-42946, CVSS 8.3), NGINX - Use After Free (CVE-2026-40701, CVSS 6.3)https://cyberfeed.cesnet.cz/reports/876?lang=enhttps://cyberfeed.cesnet.cz/reports/875?lang=enHPE Aruba Networking fixes 33 vulnerabilities in various products. The most severe vulnerabilities are listed below. The vulnerability CVE-2025-35991 originally concerns Intel processors. Several AOS-10 and AOS-8 versions (the list is available at) are affected by the vulnerabilities but will not receive a fix because they are EoM. Affected products and their fixed versions: Mobility Conductors AOS - 10.8.0.1, 10.7.2.3, 10.4.1.11, 8.13.1.2, 8.12.0.7, 8.10.0.22 Mobility Controllers AOS - 10.8.0.1, 10.7.2.3, 10.4.1.11, 8.13.1.2, 8.12.0.7, 8.10.0.22 WLAN Gateways AOS (managed via HPE Aruba Networking Central) - 10.8.0.1, 10.7.2.3, 10.4.1.11, 8.13.1.2, 8.12.0.7, 8.10.0.22 SD-WAN Gateways AOS (managed via HPE Aruba Networking Central) - 10.8.0.1, 10.7.2.3, 10.4.1.11, 8.13.1.2, 8.12.0.7, 8.10.0.22 Access Points AOS-10, AOS-8 Instant - 10.8.0.1, 10.7.2.3, 10.4.1.11, 8.13.1.2, 8.12.0.7, 8.10.0.22 Alletra 4110, 4120, 4140 - 2.80_01-29-2026 ProLiant Gen11 DL110, DL380a, DL560, ML110 - 2.80_01-29-2026 ProLiant Gen11 Server DL320, DL360, DL380, ML350 - 2.80_01-29-2026 Synergy Gen11 480 - 2.80_01-29-2026 Compute Edge Server e930t - 2.80_01-29-2026 Vulnerabilities: HPE Aruba Mobility Conductors/Controllers, WLAN and SD-WAN Gateways - RCE and DoS (CVE-2026-23827, CVSS 9.8), HPE Aruba Access Points - command injection (CVE-2026-23820, CVSS 7.2), HPE Aruba ProLiant DL/ML, Alletra, Synergy, and Edgeline Servers - Information disclosure (CVE-2025-35991, CVSS 5.3), HPE Aruba - intro, HPE Aruba Access Points - XSS (CVE-2026-23819, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/875?lang=enhttps://cyberfeed.cesnet.cz/reports/874?lang=enFortinet fixes 11 vulnerabilities in various products. The most severe of them are listed below. The advisory also includes the vulnerability CVE-2026-31431 (Copy Fail), which we have reported on previously. Fortinet is currently investigating its possible impact on its products, and so far it has not been confirmed in any of them. Individual products and their fixed versions: FortiNDR: 7.6.3, 7.4.10 FortiMail: 7.6.4, 7.4.6, 7.2.9 FortiOS: 7.6.4, 7.4.9, 7.2.12 FortiTokenAndroid: 6.4.0 FortiAP: 7.6.3, 7.4.6 FortiAP-U: 7.0.6 FortiAP-W2: 7.4.5, 7.2.6 FortiSandbox: 5.0.2, 4.4.9 FortiSandbox Cloud: 5.0.6 FortiSandbox PaaS: 5.0.2, 4.4.9 FortiAuthenticator: 8.0.3, 6.6.9, 6.5.7 FortiClientWindows: 7.4.3 FortiAnalyzer: 7.6.5, 7.4.9 FortiManager: 7.6.5, 7.4.9 FortiDeceptor: 6.3.0, 6.2.0, 6.1.0 Vulnerabilities: Fortinet - intro, FortiSandbox, FortiSandbox Cloud and FortiSandbox PaaS - RCE (CVE-2026-26083, CVSS 9.8), FortiAuthenticator - RCE (CVE-2026-44277, CVSS 9.8), FortiOS - RCE (CVE-2025-53844, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/874?lang=enhttps://cyberfeed.cesnet.cz/reports/872?lang=enMozilla fixes 5 vulnerabilities in various products. The most severe vulnerabilities are listed below. Individual products and their fixed versions: Firefox - 150.0.2 Firefox ESR - 140.10.2, 115.35.2 Thunderbird - 150.0.2 Thunderbird ESR - 140.10.2 Vulnerabilities: Mozilla Firefox, Firefox ESR, Thunderbird - intro, Mozilla Firefox, Firefox ESR, Thunderbird - incorrect memory handling (CVE-2026-8092, CVSS 8.1), Mozilla Firefox, Firefox ESR, Thunderbird - use-after-free (CVE-2026-8090, CVSS 7.3)https://cyberfeed.cesnet.cz/reports/872?lang=enhttps://cyberfeed.cesnet.cz/reports/871?lang=enIvanti fixes 5 vulnerabilities in Ivanti Endpoint Manager Mobile with versions 12.6.1.1, 12.7.0.1 and 12.8.0.1, one of which is being actively exploited. Vulnerabilities: Ivanti Endpoint Manager Mobile - intro, Ivanti Endpoint Manager Mobile - RCE (CVE-2026-6973, CVSS 7.2), Ivanti Endpoint Manager Mobile - improper certificate validation (CVE-2026-5787, CVSS 8.9), Ivanti Endpoint Manager Mobile - improper access control (CVE-2026-5786, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/871?lang=enhttps://cyberfeed.cesnet.cz/reports/870?lang=enFortinet fixes 27 vulnerabilities in various products. The most severe of them are described below. Fixed versions of individual products: FortiAnalyzer- 7.6.5, 7.4.9 FortiAnalyzer Cloud - 7.6.5, 7.4.9 FortiClientEMS - 7.4.6, 7.2.13 FortiDDoS-F - 7.2.3 FortiManager - 7.6.5, 7.4.9 FortiManager Cloud - 7.6.5, 7.4.9 FortiNAC-F - 7.6.6 FortiNDR - 7.6.1, 7.4.9 FortiOS - 7.6.5, 7.4.10 FortiPAM - 1.7.1 FortiProxy - 7.6.5, 7.4.12 FortiSandbox - 5.0.6, 4.4.9 FortiSandbox Cloud - fixed in the cloud FortiSandbox PaaS - 5.0.6, 4.4.9 FortiSOAR PaaS - 7.6.5, 7.5.3 / FortiSOAR File Content Extraction Connector Version 1.3.1 FortiSOAR on-premise - 7.6.5, 7.5.3 / FortiSOAR File Content Extraction Connector Version 1.3.1 FortiSwitchManager - 7.2.8, 7.0.7 FortiVoice - 7.0.2 FortiWeb - 8.0.4, 7.6.7 Vulnerabilities: Fortinet - intro, FortiSandbox - privilege escalation (CVE-2026-39813, CVSS 9.8), FortiSandbox - OS command execution (CVE-2026-39808, CVSS 9.8), FortiDDoS-F - command execution (CVE-2026-39815, CVSS 8.8), FortiAnalyzer Cloud, FortiManager Cloud - command execution, RCE (CVE-2026-22828, CVSS 8.1)https://cyberfeed.cesnet.cz/reports/870?lang=enhttps://cyberfeed.cesnet.cz/reports/869?lang=enGitHub fixes 6 vulnerabilities in GitHub Enterprise Server with versions 3.21, 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21 and 3.14.26. Vulnerabilities: GitHub Enterprise Server - intro, GitHub Enterprise Server - improper authorization (CVE-2026-5845, CVSS 7.2), GitHub Enterprise Server - SSRF (CVE-2026-5921, CVSS 8.9), GitHub Enterprise Server - command injection (CVE-2026-4821, CVSS 8.1)https://cyberfeed.cesnet.cz/reports/869?lang=enhttps://cyberfeed.cesnet.cz/reports/868?lang=enApache fixes 11 vulnerabilities in Apache HTTP Server with version 2.4.67. Debian releases fixing the vulnerability CVE-2026-23918: bullseye - 2.4.62-1~deb11u1 bullseye (security) - 2.4.66-1~deb11u1 bookworm (security) - 2.4.67-1~deb12u2 trixie - 2.4.66-1~deb13u2 trixie (security) - 2.4.67-1~deb13u2 forky - 2.4.66-8 sid - 2.4.67-1 Debian releases fixing the other vulnerabilities: bookworm (security) - 2.4.67-1~deb12u2 trixie (security) - 2.4.67-1~deb13u2 Ubuntu releases and their fixed releases: resolute - 2.4.66-2ubuntu2.1 questing - 2.4.64-1ubuntu3.4 noble - 2.4.58-1ubuntu8.12 jammy - 2.4.52-1ubuntu4.20 Vulnerabilities: Apache HTTP - heap buffer over-read (CVE-2026-23918, CVSS 8.8), Apache HTTP - DoS (CVE-2026-33007, CVSS 5.3), Apache HTTP - timing discrepancy attack (CVE-2026-33006, CVSS 4.8), Apache HTTP - introhttps://cyberfeed.cesnet.cz/reports/868?lang=enhttps://cyberfeed.cesnet.cz/reports/867?lang=enCisco fixes 15 vulnerabilities in its products. The most severe of them are described below; the rest can be found at. Fixed versions of individual products: Cisco Identity Services Engine (ISE) - 3.3 Patch 11, 3.4 Patch 6, 3.5 Patch 3 Cisco ISE Passive Identity Connector (ISE-PIC) - 3.3 Patch 11, 3.4 Patch 6, 3.5 Patch 3 Cisco AsyncOS Software for Cisco Secure Web Appliance - 15.2.5-013 Cisco ThousandEyes Enterprise Agent - 1.234.0 Cisco Unity Connection - 15SU4, 14SU6 Cisco Webex Services - fixed in the cloud Vulnerabilities: Cisco - intro, Cisco ISE & ISE-PIC - RCE, privilege escalation, DoS (CVE-2026-20147, CVSS 9.9), Cisco ISE - OS commands execution, privilege escalation, DoS (CVE-2026-20180, CVE-2026-20186, CVSS 9.9), Cisco Webex Services - unauthorized access (CVE-2026-20184, CVSS 9.8)https://cyberfeed.cesnet.cz/reports/867?lang=enhttps://cyberfeed.cesnet.cz/reports/866?lang=enPalo Alto fixes a critical, actively exploited vulnerability in PAN-OS (PA-Series and VM-Series firewalls). The relevant fixes are expected to be released on 13 and 28 May 2026, see. Fixed versions of the product: PAN-OS 12.1 - 12.1.4-h5, 12.1.7 PAN-OS 11.2 - 11.2.4-h17, 11.2.7-h13, 11.2.10-h6, 11.2.12 PAN-OS 11.1 - 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, 11.1.15 PAN-OS 10.2 - 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, 10.2.18-h6 Vulnerabilities: Palo Alto PAN-OS - intro, Palo Alto PAN-OS - privilege escalation, RCE (CVE-2026-0300, CVSS 9.3)https://cyberfeed.cesnet.cz/reports/866?lang=enhttps://cyberfeed.cesnet.cz/reports/864?lang=enUbiquiti fixes 5 vulnerabilities in UniFi Play PowerAmp and UniFi Play Audio Port. The most severe of them are described below; the rest can be found at. Fixed versions of individual products: UniFi Play PowerAmp - 1.0.38 UniFi Play Audio Port - 1.1.9 Vulnerabilities: Ubiquiti UniFi Play PowerAmp & Audio Port - intro, Ubiquiti UniFi Play PowerAmp & Audio Port - RCE (CVE-2026-22562, CVSS 9.8), Ubiquiti UniFi Play PowerAmp & Audio Port - command injection (CVE-2026-22563, CVSS 9.8), Ubiquiti UniFi Play PowerAmp & Audio Port - unauthorized system modification (CVE-2026-22564, CVSS 9.8)https://cyberfeed.cesnet.cz/reports/864?lang=enhttps://cyberfeed.cesnet.cz/reports/861?lang=enExim fixes 4 vulnerabilities in version 4.99.2. The most severe of them are described below; the rest can be found at. Vulnerabilities: Exim - intro, Exim - out-of-bounds write (CVE-2026-40685, CVSS 9.8), Exim - out-of-bounds write/read (CVE-2026-40687, CVSS 9.1)https://cyberfeed.cesnet.cz/reports/861?lang=enhttps://cyberfeed.cesnet.cz/reports/860?lang=enOpenSSH version 10.3 fixes 5 vulnerabilities. The most severe of them is described below. Neither Debian nor Red Hat has provided fixes yet. Gentoo has the fixed version 10.3_p1 available as a testing package. Vulnerabilities: OpenSSH - intro, OpenSSH - privilege escalation (CVE-2026-35414, CVSS 8.1)https://cyberfeed.cesnet.cz/reports/860?lang=enhttps://cyberfeed.cesnet.cz/reports/858?lang=enPackageKit, an abstraction for tools such as APT and DNF, fixes a high-severity vulnerability with version 1.3.5. A fix has also been released by Debian and Ubuntu. Red Hat has not yet released a fix for its RHEL systems and recommends blocking PackageKit with the command "systemctl mask packagekit.service". Individual Debian and Ubuntu releases and their fixed versions: Debian: bullseye (security) - 1.2.2-2+deb11u1 bookworm (security) - 1.2.6-5+deb12u1 trixie (security) - 1.3.1-1+deb13u1 forky, sid - 1.3.5-1 Ubuntu: resolute - 1.3.4-3ubuntu1 questing - 1.3.1-1ubuntu1.1 noble - 1.2.8-2ubuntu1.5 jammy - 1.2.5-2ubuntu3.1 Vulnerabilities: PackageKit - privilege escalation (CVE-2026-41651, CVSS 8.8), PackageKit - introhttps://cyberfeed.cesnet.cz/reports/858?lang=enhttps://cyberfeed.cesnet.cz/reports/857?lang=enMozilla fixes 41 vulnerabilities in various products. The most severe of them are listed below. Individual products and their fixed versions: Firefox - 150 Firefox ESR - 140.10, 115.35 Thunderbird - 150, 140.10 Vulnerabilities: Mozilla Firefox, Firefox ESR, Thunderbird - intro, Mozilla Firefox, Firefox ESR, Thunderbird - use after free (CVE-2026-6746, CVSS 7.5), Mozilla Firefox, Firefox ESR, Thunderbird - RCE (CVE-2026-6748, CVSS 9.8), Mozilla Firefox, Firefox ESR, Thunderbird - privilege escalation (CVE-2026-6750, CVSS 9.8)https://cyberfeed.cesnet.cz/reports/857?lang=enhttps://cyberfeed.cesnet.cz/reports/856?lang=enGitLab fixes 11 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) with versions 18.11.1, 18.10.4 and 18.9.6. The most severe vulnerabilities are listed below. Vulnerabilities: GitLab - intro, GitLab CE/EE - CSRF (CVE-2026-4922, CVSS 8.1), GitLab CE/EE - XSS (CVE-2026-5816, CVSS 8.0), GitLab CE/EE - XSS (CVE-2026-5262, CVSS 8.0)https://cyberfeed.cesnet.cz/reports/856?lang=enhttps://cyberfeed.cesnet.cz/reports/855?lang=enThe Apache Software Foundation fixes 4 vulnerabilities in Apache ActiveMQ products (Classic, All, Broker, Client, MQTT) with versions 5.19.5 and 6.2.4. The most severe of them are described below, with CVE-2026-34197 already being actively exploited. Vulnerabilities: Apache ActiveMQ, ActiveMQ All & Broker - intro, Apache ActiveMQ, ActiveMQ All & Broker - RCE (CVE-2026-34197, CVSS 8.8), Apache ActiveMQ, ActiveMQ Broker & Client - DoS (CVE-2026-39304, CVSS 7.5), Apache ActiveMQ, ActiveMQ All & MQTT - DoS (CVE-2026-40046, CVSS 7.5)https://cyberfeed.cesnet.cz/reports/855?lang=enhttps://cyberfeed.cesnet.cz/reports/854?lang=enThe Linux kernel fixes a high-severity vulnerability in versions 6.1.167, 6.6.130, 6.12.77, 6.18.17 and 6.19.7. Information on the individual commits containing the fix can be found at. For common Linux distributions such as Debian, Ubuntu or Red Hat and their stable releases, fixes have not been released yet, or the given system is not affected by the vulnerability. Vulnerabilities: Linux kernel - intro, Linux kernel - out-of-bounds read/write (CVE-2026-23317, CVSS 7.8)https://cyberfeed.cesnet.cz/reports/854?lang=enhttps://cyberfeed.cesnet.cz/reports/852?lang=enMicrosoft fixes an actively exploited vulnerability in SharePoint Server. Product fixes (build number): Microsoft SharePoint Server Subscription Edition - 16.0.19725.20210 Microsoft SharePoint Server 2019 - 16.0.10417.20114 Microsoft SharePoint Enterprise Server 2016 - 16.0.5548.1003 Vulnerabilities: Microsoft SharePoint Server - intro, Microsoft SharePoint Server - content spoofing (CVE-2026-32201, CVSS 6.5)https://cyberfeed.cesnet.cz/reports/852?lang=enhttps://cyberfeed.cesnet.cz/reports/851?lang=enBased on evidence of active exploitation, CISA has added a critical vulnerability in F5 BIG-IP APM to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability CVE-2025-53521 was originally classified as a DoS, but according to the latest analyses it allows RCE with the possibility of full system takeover. If the malware c05d5254 is successfully deployed on a BIG-IP system, indicators of compromise (IoCs) may appear; a detailed list is available at. We recommend updating immediately to the fixed versions 17.5.1.3, 17.1.3, 16.1.6.1 and 15.1.10.8, or to the latest available release. Vulnerabilities: F5 BIG-IP - intro, F5 BIG-IP APM - RCE (CVE-2025-53521, CVSS 9.3)https://cyberfeed.cesnet.cz/reports/851?lang=enhttps://cyberfeed.cesnet.cz/reports/850?lang=enApache fixes 12 vulnerabilities in various products. The most severe of them can be found below. Products and their fixed versions: Apache Tomcat - 11.0.21, 10.1.54, 9.0.117 Apache Tomcat Native - 1.3.7, 2.0.14 Apache Airflow - 3.2.0 Vulnerabilities: Apache - intro, Apache Tomcat - unauthorized access (CVE-2026-29145, CVSS 9.1), Apache Tomcat - Information disclosure (CVE-2026-34487, CVSS 7.5), Apache Tomcat - HTTP request smuggling (CVE-2026-24880, CVSS 7.5), Apache Airflow - Session hijacking (CVE-2025-57735, CVSS 9.1)https://cyberfeed.cesnet.cz/reports/850?lang=enhttps://cyberfeed.cesnet.cz/reports/849?lang=enAcronis fixes 1 vulnerability in Acronis True Image (build 42902) and Acronis True Image OEM (build 42571). Vulnerabilities: Acronis - intro, Acronis True Image, True Image OEM - local privilege escalation (CVE-2026-33092, CVSS 7.8)https://cyberfeed.cesnet.cz/reports/849?lang=enhttps://cyberfeed.cesnet.cz/reports/848?lang=enAdobe fixes a high-severity, actively exploited vulnerability in Acrobat products. Fixed versions of the individual products: Acrobat DC - 26.001.21411 Acrobat Reader DC - 26.001.21411 Acrobat 2024 (Windows) - 24.001.30362 Acrobat 2024 (macOS) - 24.001.30360 Vulnerabilities: Adobe Acrobat Reader - intro, Adobe Acrobat DC, Acrobat Reader DC, Acrobat 2024 - RCE (CVE-2026-34621, CVSS 8.6)https://cyberfeed.cesnet.cz/reports/848?lang=enhttps://cyberfeed.cesnet.cz/reports/847?lang=enSonatype fixes 2 vulnerabilities in Nexus Repository 3 with version 3.91.0. Vulnerabilities: Sonatype Nexus Repository - intro, Sonatype Nexus Repository - RCE (CVE-2026-3199, CVSS 9.4), Sonatype Nexus Repository - XSS (CVE-2026-3438, CVSS 5.1)https://cyberfeed.cesnet.cz/reports/847?lang=enhttps://cyberfeed.cesnet.cz/reports/846?lang=enGitLab fixes 12 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) with versions 18.10.3, 18.9.5 and 18.8.9. The most severe vulnerabilities are listed below. Vulnerabilities: GitLab - Intro, GitLab - improper access control (CVE-2026-5173, CVSS 8.5), GitLab - DoS (CVE-2026-1092, CVSS 7.5), GitLab - DoS (CVE-2025-12664 , CVSS 7.5)https://cyberfeed.cesnet.cz/reports/846?lang=enhttps://cyberfeed.cesnet.cz/reports/845?lang=enXWiki fixes a high-severity vulnerability in versions 17.4.8 and 17.10.1. Vulnerabilities: XWiki - intro, XWiki Platform - RCE (CVE-2026-33229, CVSS 8.6)https://cyberfeed.cesnet.cz/reports/845?lang=enhttps://cyberfeed.cesnet.cz/reports/844?lang=enMozilla fixes 5 vulnerabilities in various products. Products and their fixed versions: Firefox - 149.0.2 Firefox ESR - 115.34.1, 140.9.1 Thunderbird - 149.0.2, 140.9.1 Among operating systems, the vulnerabilities CVE-2026-5731, CVE-2026-5732 and CVE-2026-5734 have been fixed by, for example, Debian and Slackware. Debian releases and fixed versions: bookworm - 140.9.1esr-1~deb12u1 trixie - 140.9.1esr-1~deb13u1 Vulnerabilities: Mozilla Firefox and Thunderbird - intro, Mozilla Firefox, Firefox ESR, Thunderbird - arbitrary code execution (CVE-2026-5731, CVE-2026-5735, CVSS 9.8), Mozilla Firefox, Firefox ESR, Thunderbird - arbitrary code execution (CVE-2026-5734, CVSS 9.8), Mozilla Firefox, Thunderbird - incorrect boundary conditions (CVE-2026-5733, CVSS 8.8), Mozilla Firefox, Firefox ESR, Thunderbird - integer overflow (CVE-2026-5732, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/844?lang=enhttps://cyberfeed.cesnet.cz/reports/842?lang=enGoogle fixes 1 high-severity, actively exploited vulnerability in Google Chrome and other browsers based on the Chromium engine. The latest fix was released for Windows/macOS (versions 146.0.7680.177 and 146.0.7680.178) and Linux (version 146.0.7680.177). Vulnerabilities: Google Chrome - intro, Google Chrome - use after free (CVE-2026-5281, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/842?lang=enhttps://cyberfeed.cesnet.cz/reports/841?lang=enCisco fixes 2 critical vulnerabilities found in Integrated Management Controller and Smart Software Manager On-Prem. Version 9-202601 is available for SSM On-Prem; for IMC, the fixed versions are listed separately for each affected product. Vulnerabilities: Cisco - intro, Cisco Integrated Management Controller - authentication bypass (CVE-2026-20093, CVSS 9.8), Cisco Smart Software Manager - arbitrary command execution (CVE-2026-20160, CVSS 9.8)https://cyberfeed.cesnet.cz/reports/841?lang=enhttps://cyberfeed.cesnet.cz/reports/840?lang=enFortinet fixes a critical, actively exploited vulnerability in FortiClientEMS. The full fix will be part of the upcoming version 7.4.7; as a temporary fix for the current versions 7.4.5 and 7.4.6, the patches available at and must be installed. Vulnerabilities: FortiClientEMS - intro, FortiClientEMS - RCE, command execution (CVE-2026-35616, CVSS 9.8)https://cyberfeed.cesnet.cz/reports/840?lang=enhttps://cyberfeed.cesnet.cz/reports/839?lang=enAcronis fixes 3 vulnerabilities in Acronis True Image. The fixed versions can be found in the links next to the individual vulnerabilities. Vulnerabilities: Acronis - intro, Acronis True Image - local privilege escalation (CVE-2026-33271, CVSS 6.7), Acronis True Image - local privilege escalation (CVE-2026-28728, CVE-2026-27774, CVSS 6.7)https://cyberfeed.cesnet.cz/reports/839?lang=enhttps://cyberfeed.cesnet.cz/reports/838?lang=enHPE Aruba fixes 6 vulnerabilities in Mobility Conductors, Mobility Controllers, Mobility Gateways and Access Points (AOS-10 and AOS-8) with versions 10.8.0.1, 10.7.2.3, 10.4.1.11, 8.13.1.2, 8.12.0.7 and 8.10.0.22. In addition, version 7.5.1 fixes 1 vulnerability in HPE Telco Network Function Virtualization Orchestrator. The most severe vulnerabilities are described below; the remaining ones can be found at. Vulnerabilities: HPE Aruba Networking - intro, HPE Telco Network Function Virtualization Orchestrator - system compromitation (CVE-2025-12543, CVSS 9.6), HPE Aruba Networking AOS - traffic spoofing, client compromise (CVE-2026-23601, CVSS 5.4), HPE Aruba Networking AOS - client isolation bypass (CVE-2026-23808, CVSS 5.4)https://cyberfeed.cesnet.cz/reports/838?lang=enhttps://cyberfeed.cesnet.cz/reports/837?lang=enF5 fixes 6 vulnerabilities in NGINX Plus and NGINX Open Source. The most severe of them are described below; the remaining ones can be found at. Fixed versions of the individual products: NGINX Plus - R36 P3, R35 P2, R32 P5 NGINX Open Source - 1.29.7, 1.28.3 Vulnerabilities: F5 NGINX Plus, NGINX Open Source - intro, NGINX Plus, NGINX Open Source - DoS, file name modification (CVE-2026-27654, CVSS 8.8), NGINX Plus, NGINX Open Source - DoS (CVE-2026-27651, CVSS 8.7), NGINX Plus, NGINX Open Source - DoS, RCE (CVE-2026-32647, CVSS 8.5)https://cyberfeed.cesnet.cz/reports/837?lang=enhttps://cyberfeed.cesnet.cz/reports/836?lang=enVim fixes a high-severity vulnerability in version 9.2.0172. Vulnerabilities: Vim - intro, Vim - OS command execution (CVE-2026-34714, CVSS 8.2)https://cyberfeed.cesnet.cz/reports/836?lang=enhttps://cyberfeed.cesnet.cz/reports/835?lang=enCitrix fixes 2 vulnerabilities in various products. Individual products and their fixes: NetScaler ADC and NetScaler Gateway - 14.1-60.58, 14.1-66.59, 13.1-62.23 NetScaler ADC FIPS and NDcPP - 13.1-37.262 Vulnerabilities: Citrix - intro, NetScaler ADC, NetScaler Gateway, NetScaler ADC FIPS and NDcPP - memory overread (CVE-2026-3055, CVSS 9.3), NetScaler ADC, NetScaler Gateway - user session mixup (CVE-2026-4368, CVSS 7.7)https://cyberfeed.cesnet.cz/reports/835?lang=enhttps://cyberfeed.cesnet.cz/reports/834?lang=enSquid fixes 3 vulnerabilities, 1 of them critical, in version 7.5. Vulnerabilities: Squid - intro, Squid - DoS (CVE-2026-33526, CVSS 9.2), Squid - DoS (CVE-2026-32748, CVSS 9.2), Squid - sensitive information disclosure (CVE-2026-33515, CVSS 6.9)https://cyberfeed.cesnet.cz/reports/834?lang=enhttps://cyberfeed.cesnet.cz/reports/833?lang=enGitLab fixes 12 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) with versions 18.10.1, 18.9.3 and 18.8.7. The most severe vulnerabilities are listed below; the remaining ones can be found at. Vulnerabilities: GitLab CE/EE - intro, GitLab CE/EE - authorization bypass (CVE-2026-2370, CVSS 8.1), GitLab CE/EE - CSRF (CVE-2026-3857, CVSS 8.1), GitLab EE - HTML injection (CVE-2026-2995, CVSS 7.7), GitLab CE/EE - DoS (CVE-2026-3988, CVSS 7.5)https://cyberfeed.cesnet.cz/reports/833?lang=enhttps://cyberfeed.cesnet.cz/reports/832?lang=enVMware Spring fixes 8 vulnerabilities found in various products. The most severe vulnerabilities are described below; the remaining ones can be found at by clicking through the individual advisories. Products and their fixed versions: Spring Security - 5.7.22, 5.8.24, 6.3.15, 6.4.15, 6.5.9, 7.0.4 Spring AI - 1.0.4, 1.1.3 Spring Cloud Config - 3.1.13, 4.1.9, 4.2.6, 4.3.2, 5.0.2 Spring Framework - 5.3.47, 6.1.26, 6.2.17, 7.0.6 Spring Boot - 2.7.32, 3.3.18, 3.4.15, 3.5.12, 4.0.4 Vulnerabilities: VMware Spring - intro, Spring Security - sensitive data exposure (CVE-2026-22732, CVSS 9.1), Spring AI - SQL injection (CVE-2026-22730, CVSS 8.8), Spring AI - JSONPath injection (CVE-2026-22729, CVSS 8.6), Spring Cloud Config - SSRF (CVE-2026-22739, CVSS 8.6)https://cyberfeed.cesnet.cz/reports/832?lang=enhttps://cyberfeed.cesnet.cz/reports/831?lang=enAtlassian fixes 15 vulnerabilities in various products. The most severe vulnerabilities are described below; the remaining ones can be found at by clicking through the individual advisories. The fixed versions can be found in the links next to the individual vulnerabilities. Vulnerabilities: Atlassian - intro, Jira Software Data Center, Jira Service Management Data Center - path traversal (CVE-2026-23950, CVSS 8.8), Bamboo Data Center - RCE (CVE-2026-21570, CVSS 8.6), Crowd Data Center - XSS (CVE-2026-21884, CVSS 8.2), Jira Data Center, Jira Service Management Data Center – file inclusion (CVE-2026-23745, CVSS 8.2)https://cyberfeed.cesnet.cz/reports/831?lang=enhttps://cyberfeed.cesnet.cz/reports/829?lang=enElastic fixes 4 vulnerabilities in various products. Products and their fixed versions: Metricbeat - 8.19.13, 9.2.5 Kibana - 8.19.13, 9.2.7, 9.3.2 Packetbeat - 8.19.4, 9.2.4 Vulnerabilities: Elastic Metricbeat - DoS (CVE-2026-26931, CVSS 5.7), Elastic Kibana - unauthorized configuration (CVE-2026-26939, CVSS 6.5), Elastic Kibana - DoS (CVE-2026-26940, CVSS 6.5), Elastic Packetbeat - DoS (CVE-2026-26933, CVSS 5.7), Elastic - introhttps://cyberfeed.cesnet.cz/reports/829?lang=enhttps://cyberfeed.cesnet.cz/reports/828?lang=enMongoDB fixes 3 vulnerabilities in MongoDB Server with versions 7.0.31, 8.0.20 and 8.2.6. Vulnerabilities: MongoDB - intro, MongoDB Server - use-after-free (CVE-2026-4148, CVSS 8.7), MongoDB Server - stack memory disclosure (CVE-2026-4147, CVSS 7.1), MongoDB Server - double-free (CVE-2026-4358, CVSS 6.1)https://cyberfeed.cesnet.cz/reports/828?lang=enhttps://cyberfeed.cesnet.cz/reports/827?lang=enThe snapd package fixes a high-severity vulnerability with version 2.75.1. Affected Ubuntu releases and their fixed versions: questing - 2.73+ubuntu25.10.1 noble - 2.73+ubuntu24.04.2 jammy - 2.73+ubuntu22.04.1 focal - 2.67.1+20.04ubuntu1~esm1 bionic - 2.61.4ubuntu0.18.04.1+esm2 xenial - 2.61.4ubuntu0.16.04.1+esm2 Vulnerabilities: snapd - (CVE-2026-3888, CVSS 7.8), snapd - introhttps://cyberfeed.cesnet.cz/reports/827?lang=enhttps://cyberfeed.cesnet.cz/reports/826?lang=enCisco fixes 6 vulnerabilities in various products. Individual products and their fixed versions: Cisco IOS - 25.2.21, 25.4.2 Cisco Unified Intelligence Center - 15.0(1)ES202511 Cisco Finesse - 15.0(1)ES202511 Cisco Unified CCX Release - 15.0 ES02 Vulnerabilities: Cisco IOS XR - OS command injection (CVE-2026-20040, CVE-2026-20046, CVSS 8.8), Cisco IOS XR - DoS (CVE-2026-20118, CVSS 6.8), Cisco Unified Intelligence Center, Finesse, Unified CCX Release - (CVE-2026-20116, CVE-2026-20117, CVSS 6.1), Cisco IOS XR - DoS (CVE-2026-20074, CVSS 7.4), Cisco - introhttps://cyberfeed.cesnet.cz/reports/826?lang=enhttps://cyberfeed.cesnet.cz/reports/825?lang=enGoogle fixes 2 high-severity, actively exploited vulnerabilities in the Google Chrome browser and other browsers based on the Chromium engine. The latest fix has been released for Windows/macOS (version 146.0.7680.80) and Linux (146.0.7680.80). The latest fix for the Microsoft Edge browser has been released in version 146.0.3856.62. Vulnerabilities: Google Chrome - intro, Google Chrome - out-of-bounds write, RCE (CVE-2026-3909, CVSS 8.8), Google Chrome - RCE (CVE-2026-3910, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/825?lang=enhttps://cyberfeed.cesnet.cz/reports/824?lang=encURL fixes 4 vulnerabilities with version 8.19.0. Vulnerabilities: cURL - use-after-free (CVE-2026-3805, CVSS 7.5), cURL - authenticated connection reuse (CVE-2026-1965, CVSS 6.5), cURL - OAuth2 token leak (CVE-2026-3783, CVSS 5.3), cURL - authenticated proxy reuse (CVE-2026-3784, CVSS 6.5), cURL - introhttps://cyberfeed.cesnet.cz/reports/824?lang=enhttps://cyberfeed.cesnet.cz/reports/823?lang=enGitHub fixes 4 vulnerabilities in GitHub Enterprise Server with versions 3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6 and 3.19.3. Vulnerabilities: GitHub Enterprise Server - intro, GitHub Enterprise Server - RCE (CVE-2026-3854, CVSS 8.7), GitHub Enterprise Server - XSS (CVE-2026-2266, CVSS 7.4), GitHub Enterprise Server - improper authorization (CVE-2026-3306, CVSS 5.3), GitHub Enterprise Server - improper authorization (CVE-2026-3582, CVSS 5.3)https://cyberfeed.cesnet.cz/reports/823?lang=enhttps://cyberfeed.cesnet.cz/reports/822?lang=enFortinet fixes 11 vulnerabilities in various products. The most severe are described below; the remaining ones can be found in the attached links. Products and their fixes: FortiSwitchAXFixed - 1.0.2 FortiManager - 7.0.15, 7.2.11, 7.6.5, 7.4.9, 7.2.11 FortiAnalyzer - 7.0.15, 7.2.11, 7.6.5, 7.4.9 FortiSandbox Cloud - 4.4.8, 5.0.5 FortiAnalyzer Cloud - 7.0.15, 7.2.11, 7.6.5, 7.4.8 FortiManager Cloud - 7.0.15, 7.2.11, 7.6.5, 7.4.8 FortiAnalyzer-BigData - 7.6.1, 7.4.5 Vulnerabilities: Fortinet - intro, Fortinet FortiSwitchAXFixed - RCE (CVE-2026-22627, CVSS 8.8), Fortinet FortiManager - command execution (CVE-2025-54820, CVSS 8.1), Fortinet FortiAnalyzer, FortiManager - authentication bypass (CVE-2026-22572, CVSS 7.2), Fortinet FortiSandbox Cloud - OS command injection (CVE-2026-25836, CVSS 7.2)https://cyberfeed.cesnet.cz/reports/822?lang=enhttps://cyberfeed.cesnet.cz/reports/821?lang=enVeeam Backup & Replication fixes 8 vulnerabilities, 5 of them critical, in versions 12.3.2.4465 and 13.0.1.2067. The most severe ones are described below; the others can be found at. Vulnerabilities: Veeam Backup & Replication - intro, Veeam Backup & Replication - RCE (CVE-2026-21666, CVE-2026-21667, CVSS 9.9), Veeam Backup & Replication - RCE (CVE-2026-21708, CVSS 9.9), Veeam Backup & Replication - RCE (CVE-2026-21669 , CVSS 9.9), Veeam Backup & Replication - RCE (CVE-2026-21671, CVSS 9.1)https://cyberfeed.cesnet.cz/reports/821?lang=enhttps://cyberfeed.cesnet.cz/reports/820?lang=enIvanti fixes a high-severity vulnerability in Ivanti Desktop and Server Management with version 2026.1.1. Vulnerabilities: Ivanti - intro, Ivanti DSM - privilege escalation (CVE-2026-3483, CVSS 7.8)https://cyberfeed.cesnet.cz/reports/820?lang=enhttps://cyberfeed.cesnet.cz/reports/819?lang=enGitLab fixes 15 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) with versions 18.9.2, 18.8.6 and 18.7.6. The most severe vulnerabilities are listed below. Vulnerabilities: GitLab - intro, GitLab CE/EE - XSS (CVE-2026-1090, CVSS 8.7), GitLab CE/EE - DoS (CVE-2026-1069, CVSS 7.5), GitLab CE/EE - DoS (CVE-2025-13929, CVSS 7.5), GitLab CE/EE - DoS (CVE-2025-14513, CVSS 7.5)https://cyberfeed.cesnet.cz/reports/819?lang=enhttps://cyberfeed.cesnet.cz/reports/818?lang=enHPE Aruba fixes 5 vulnerabilities in HPE Aruba Networking AOS-CX with versions 10.17.1001, 10.16.1030, 10.13.1161 and 10.10.1180. The most severe ones are described below, the others can be found at. Vulnerabilities: HPE Aruba Networking - Intro, HPE Aruba Networking AOS-CX - authentication bypass (CVE-2026-23813, CVSS 9.8), HPE Aruba Networking AOS-CX - command injection (CVE-2026-23814, CVSS 8.8), HPE Aruba Networking AOS-CX - command injection (CVE-2026-23815, CVSS 7.2)https://cyberfeed.cesnet.cz/reports/818?lang=enhttps://cyberfeed.cesnet.cz/reports/817?lang=enKubernetes fixes 1 vulnerability in ingress-nginx with versions 1.13.8, 1.14.4, 1.15.0. The presence of ingress-nginx in a cluster can be verified with the command "kubectl get pods --all-namespaces --selector app.kubernetes.io/name=ingress-nginx". Vulnerabilities: Kubernetes - intro, Kubernetes ingress-nginx – RCE (CVE-2026-3288, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/817?lang=enhttps://cyberfeed.cesnet.cz/reports/816?lang=enZephyr Project warns of a high-severity vulnerability in the Zephyr operating system. At the time of publication of the advisory, no fixed version had yet been released, but the vendor has provided temporary mitigation measures according to the recommendations at. Vulnerabilities: Zephyr Project - intro, Zephyr Project - DoS, RCE (CVE-2026-1678, CVSS 9.4)https://cyberfeed.cesnet.cz/reports/816?lang=enhttps://cyberfeed.cesnet.cz/reports/815?lang=enAcronis fixes 24 vulnerabilities in Acronis Cyber Protect 17 and Acronis Cyber Protect Cloud Agent. The most severe vulnerabilities are described below; the remaining ones can be found at by clicking through the individual advisories. The fixed versions can be found in the links next to each vulnerability. Vulnerabilities: Acronis - intro, Acronis Cyber Protect 17 - information disclosure (CVE-2026-28710, CVSS 8.1), Acronis Cyber Protect 17, Acronis Cyber Protect Cloud Agent - privilege escalation (CVE-2026-28727, CVSS 7.8), Acronis Cyber Protect 17 - privilege escalation (CVE-2026-28721, CVE-2026-28722, CVSS 7.3), Acronis Cyber Protect Cloud Agent - privilege escalation (CVE-2025-11792 , CVSS 7.3)https://cyberfeed.cesnet.cz/reports/815?lang=enhttps://cyberfeed.cesnet.cz/reports/814?lang=enCisco fixes 57 vulnerabilities in various products. The most severe vulnerabilities are described below; the remaining ones can be found at. Products and their fixed versions: Cisco Catalyst SD-WAN Manager - 20.9.8.2, 20.12.5.3, 20.12.6.1, 20.15.4.2, 20.18.2.1 Snort 3 - 3.6.3.0, 3.9.2.0, 3.9.3.0, 3.9.5.0, 3.9.6.0, 3.9.7.0 Cisco IOS XE Software - 17.12.7, 17.15.5, 17.18.3, 26.1.1 Cisco Cyber Vision - 5.3.3 Secure Endpoint Connector (Linux) - 1.28.1 Secure Endpoint Connector (Mac) - 1.27.2 Secure Endpoint Connector (Windows) - 8.6.0 Secure Endpoint Private Cloud - 4.2.7 The availability of a fix for Cisco Secure Firewall ASA, Secure FMC and Secure FTD Software can be verified using the Cisco Software Checker tool. Vulnerabilities: Cisco - intro, Cisco Secure Firewall Management Center Software - authentication bypass (CVE-2026-20079, CVSS 10.0), Cisco Secure Firewall Management Center Software - RCE (CVE-2026-20131, CVSS 10.0), Cisco Catalyst SD-WAN - command execution (CVE-2026-20129, CVSS 9.8), Cisco Secure Firewall Management Center Software - SQL injection (CVE-2026-20002, CVSS 8.1), Cisco Secure Firewall ASA Software and Secure FTD Software - DoS (CVE-2026-20101, CVSS 8.6)https://cyberfeed.cesnet.cz/reports/814?lang=enhttps://cyberfeed.cesnet.cz/reports/813?lang=enXWiki Blog Application version 9.15.7 fixes a high-severity vulnerability. The implementation of the fix is also available in commit cca87f0. Vulnerabilities: XWiki Blog Application - intro, XWiki Blog Application - XSS (CVE-2025-66024, CVSS 8.6)https://cyberfeed.cesnet.cz/reports/813?lang=enhttps://cyberfeed.cesnet.cz/reports/812?lang=enVMware fixes 3 vulnerabilities in its products that include the VMware Aria Operations component. For VMware Telco Cloud Platform and VMware Telco Cloud Infrastructure, follow KB428241. Products and their fixed versions: VMware Cloud Foundation - 9.0.2.0, 5.2.3, VMware vSphere Foundation - 9.0.2.0, VMware Aria Operations - 8.18.6. Vulnerabilities: VMware - intro, VMware Aria Operations - RCE (CVE-2026-22719, CVSS 8.1), VMware Aria Operations - XSS (CVE-2026-22720, CVSS 7.3), VMware Aria Operations - privilege escalation (CVE-2026-22721, CVSS 6.2)https://cyberfeed.cesnet.cz/reports/812?lang=enhttps://cyberfeed.cesnet.cz/reports/811?lang=enElastic fixes 6 vulnerabilities in its products. Products and their fixed versions: Kibana - 8.19.12, 9.2.6, 9.3.1, Packetbeat - 8.19.11, 9.2.5. Vulnerabilities: Elastic - intro, Elastic Kibana - SSRF (CVE-2026-26938, CVSS 7.7), Elastic - DoS (CVE-2026-26934, CVSS 6.5), Elastic Packetbeat - DoS (CVE-2026-26932, CVSS 5.7)https://cyberfeed.cesnet.cz/reports/811?lang=enhttps://cyberfeed.cesnet.cz/reports/810?lang=enAs part of its Patch Tuesday, Microsoft released fixes for a high-severity vulnerability in the MSHTML framework. According to new findings by Akamai, this vulnerability may have been exploited by a Russia-linked state-sponsored actor known as APT28. The vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog. Vulnerabilities: Microsoft MSHTML Framework - intro, Microsoft Windows MSHTML Framework - security feature bypass (CVE-2026-21513, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/810?lang=enhttps://cyberfeed.cesnet.cz/reports/809?lang=enJuniper Networks fixes a high-severity vulnerability in Junos OS Evolved. Fixed product versions: 25.4R1-S1-EVO, 25.4R2-EVO (future release), 26.2R1-EVO (future release). Vulnerabilities: Juniper Networks Junos OS - intro, Juniper Networks Junos OS - RCE (CVE-2026-21902, CVSS 9.3)https://cyberfeed.cesnet.cz/reports/809?lang=enhttps://cyberfeed.cesnet.cz/reports/808?lang=enGitLab fixes 9 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) with versions 18.9.1, 18.8.5 and 18.7.5. The most severe ones are listed below. Vulnerabilities: GitLab CE/EE - intro, GItLab CE/EE - XSS (CVE-2026-0752 , CVSS 8.0), GitLab CE/EE - DoS (CVE-2025-14511, CVSS 7.5), GitLab CE/EE - DoS (CVE-2026-1662, CVSS 7.5), GitLab CE/EE - DoS (CVE-2026-1388 , CVSS 7.5)https://cyberfeed.cesnet.cz/reports/808?lang=enhttps://cyberfeed.cesnet.cz/reports/807?lang=enCisco fixes a critical and already actively exploited vulnerability in Cisco Catalyst SD-WAN Controller and Cisco Catalyst SD-WAN Manager with versions 20.9.8.2, 20.12.5.3, 20.12.6.1, 20.15.4.2 and 20.18.2.1. Cisco Catalyst SD-WAN Controller systems that are reachable from the internet and have open ports are at risk of compromise. The company recommends auditing the auth.log file, located at /var/log/auth.log, for entries related to the message "Accepted publickey for vmanage-admin" from unknown or unauthorized IP addresses. It further recommends comparing the IP addresses in auth.log with the configured System IPs listed in the Cisco Catalyst SD-WAN Manager web interface (WebUI > Devices > System IP). Vulnerabilities: Cisco - intro, Cisco Catalyst SD-WAN Controller, Catalyst SD-WAN Manager - authentication bypass (CVE-2026-20127, CVSS 10.0)https://cyberfeed.cesnet.cz/reports/807?lang=enhttps://cyberfeed.cesnet.cz/reports/806?lang=enSolarWinds version 15.5.4 fixes 4 critical vulnerabilities in Serv-U. Vulnerabilities: SolarWinds Serv-U - intro, SolarWinds Serv-U - RCE (CVE-2025-40538, CVSS 9.1), SolarWinds Serv-U - RCE (CVE-2025-40539, CVE-2025-40540, CVSS 9.1), SolarWinds Serv-U - RCE (CVE-2025-40541, CVSS 9.1)https://cyberfeed.cesnet.cz/reports/806?lang=enhttps://cyberfeed.cesnet.cz/reports/805?lang=enMicrosoft warns of a high-severity vulnerability in Windows Admin Center. The fixed version 2511 was released as early as December 2025. No details about the vulnerability are available yet, probably in line with responsible disclosure principles. Vulnerabilities: Microsoft Windows Admin Center - intro, Microsoft Windows Admin Center - privilege escalation (CVE-2026-26119, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/805?lang=enhttps://cyberfeed.cesnet.cz/reports/804?lang=enHPE Aruba Networking has released fixes 6.12.7 Hotfix and 6.11.13 Hotfix for 1 vulnerability in ClearPass Policy Manager OnGuard Software for Linux. Vulnerabilities: HPE Aruba Networking ClearPass Policy Manager - intro, HPE Aruba Networking ClearPass Policy Manager OnGuard for Linux - privilege escalation (CVE-2026-23599, CVSS 7.8)https://cyberfeed.cesnet.cz/reports/804?lang=enhttps://cyberfeed.cesnet.cz/reports/803?lang=enMozilla fixes a high-severity vulnerability in its products. Fixed versions: Firefox - 147.0.4 Firefox ESR - 140.7.1, 115.32.1 Thunderbird - 147.0.2, 140.7.2 Among operating systems, the vulnerability has been fixed, for example, by Debian and Ubuntu in the libvpx package. Debian releases and fixed versions: bullseye - 1.9.0-1+deb11u5, bookworm - 1.12.0-1+deb12u5 trixie - 1.15.0-2.1+deb13u1 Ubuntu releases and fixed versions: questing - 1.15.0-2.1ubuntu0.1 noble - 1.14.0-1ubuntu2.3 jammy - 1.11.0-2ubuntu2.5 Vulnerabilities: Mozilla Firefox, Thunderbird - intro, Mozilla Firefox, Firefox ESR, Thunderbird - RCE, DoS (CVE-2026-2447, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/803?lang=enhttps://cyberfeed.cesnet.cz/reports/802?lang=enJenkins versions 2.551 (weekly) and 2.541.2 (LTS) fix 2 vulnerabilities. Vulnerabilities: Jenkins - intro, Jenkins - XSS (CVE-2026-27099, CVSS 8.0), Jenkins - information disclosure (CVE-2026-27100, CVSS 4.3)https://cyberfeed.cesnet.cz/reports/802?lang=enhttps://cyberfeed.cesnet.cz/reports/801?lang=enSplunk fixes 35 vulnerabilities in various products. The most severe ones are described below, the others can be found at. Individual products and their fixed versions: Splunk Enterprise - 10.2.0, 10.0.3, 9.4.8, 9.3.9, 9.2.12 Splunk Universal Forwarder - 10.0.3, 9.4.8, 9.3.9, 9.2.12 Splunk Cloud Platform - 10.2.2510.3, 10.1.2507.11, 10.0.2503.9, 9.3.2411.121 Splunk DB Connect - 4.2.0 Vulnerabilities: Splunk - intro, Splunk Enterprise for Windows - LPE, DoS (CVE-2026-20143, CVSS 7.7), Splunk Enterprise for Windows - LPE (CVE-2026-20140, CVSS 7.7), Splunk DB Connect – DoS (CVE-2026-21441, CVSS 8.9), Splunk Enterprise – Request Smuggling (CVE-2025-22871, CVSS 9.1)https://cyberfeed.cesnet.cz/reports/801?lang=enhttps://cyberfeed.cesnet.cz/reports/800?lang=enGoogle fixes 3 high-severity vulnerabilities in Google Chrome and other browsers based on the Chromium engine. The fix has been released for Windows/macOS (versions 145.0.7632.109/110). The fix for Linux (144.0.7559.109) should be available within days to weeks. A fix for Microsoft Edge is not yet available. Vulnerabilities: Google Chrome - intro, Google Chrome - memory corruption/write, RCE (CVE-2026-2648, CVE-2026-2649, CVE-2026-2650, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/800?lang=enhttps://cyberfeed.cesnet.cz/reports/799?lang=enF5 has released an emergency fix (Hotfix-BIGIP-17.5.1.4.0.17.20-ENG.iso) for a high-severity vulnerability in BIG-IP AFM and DDoS Hybrid Defender. After authentication, the hotfix can be downloaded from the MyF5 Downloads page. More detailed information can be found at. Vulnerabilities: F5 BIG-IP AFM and DDoS Hybrid Defender - intro, F5 BIG-IP AFM and DDoS Hybrid Defender - DoS (CVE-2026-2507, CVSS 8.7)https://cyberfeed.cesnet.cz/reports/799?lang=enhttps://cyberfeed.cesnet.cz/reports/798?lang=enApple fixes more than 70 vulnerabilities in its products, of which CVE-2026-20700 is already being actively exploited. A description of selected most severe vulnerabilities can be found below; the remaining ones are described on the vendor's website. Products and their fixed versions: macOS - Tahoe 26.3, Sequoia 15.7.4, Sonoma 14.8.4 iOS - 26.3, 18.7.5 iPadOS - 26.3, 18.7.5 tvOS - 26.3 watchOS - 26.3 visionOS - 26.3 Safari - 26.3 Vulnerabilities: Apple - intro, Apple macOS Tahoe, Sonoma, visionOS, iOS, iPadOS - sandbox escape (CVE-2026-20677, CVSS 9.0), Apple macOS Tahoe, Sequoia, Sonoma, watchOS, iPadOS, iOS - sandbox escape (CVE-2026-20667, CVSS 8.8), Apple macOS Tahoe, tvOS, watchOS, visionOS, iPadOS, iOS - memory corruption, code execution (CVE-2026-20700, CVSS 7.8)https://cyberfeed.cesnet.cz/reports/798?lang=enhttps://cyberfeed.cesnet.cz/reports/797?lang=enHPE Aruba fixes 9 vulnerabilities in HPE Aruba Networking Private 5G Core and EdgeConnect SD-WAN Orchestrator. The most severe vulnerabilities are described below; the remaining ones can be found at. Products and their fixed versions: HPE Aruba Networking Private 5G Core - 1.25.1.0 HPE Aruba Networking EdgeConnect SD-WAN Orchestrator - 9.6.1, 9.5.6, 9.4.8 Vulnerabilities: HPE Aruba Networking - intro, HPE Aruba Networking Private 5G Core - sensitive data manipulation (CVE-2026-23595, CVSS 8.8), HPE Aruba Networking EdgeConnect SD-WAN Orchestrator - SQL injection (CVE-2025-37181, CVE-2025-37182, CVE-2025-37183, CVSS 7.2), HPE Aruba Networking Private 5G Core - information disclosure (CVE-2026-23597, CVE-2026-23598, CVSS 6.5)https://cyberfeed.cesnet.cz/reports/797?lang=enhttps://cyberfeed.cesnet.cz/reports/796?lang=enQNAP fixes 47 vulnerabilities in various products, the most severe of which are described below. The remaining ones can be found at. Products and their fixed versions: Media Streaming add-on - 500.1.1.6 Qsync Central - 5.0.0.4 File Station 5 - 5.5.6.5190 QTS - 5.2.8.3350 build 20251216 QuTS hero - h5.2.8.3350 build 20251216 - h5.3.2.3354 build 20251225 Vulnerabilities: QNAP - intro, QTS, QuTS hero - path traversal (CVE-2025-66277, CVSS 9.1), QTS, QuTS hero - (CVE-2024-43204, CVSS 7.5), Qsync Central - DoS (CVE-2025-54149, CVE-2025-54150, CVE-2025-54151, CVSS 4.9), QTS, QuTS hero - command injection (CVE-2025-10230, CVSS 10.0)https://cyberfeed.cesnet.cz/reports/796?lang=enhttps://cyberfeed.cesnet.cz/reports/795?lang=enKubernetes fixes 4 vulnerabilities in ingress-nginx in versions 1.13.7 and 1.14.3. The presence of ingress-nginx in a cluster can be verified with the command "kubectl get pods --all-namespaces --selector app.kubernetes.io/name=ingress-nginx". Vulnerabilities: Kubernetes - intro, Kubernetes ingress-nginx – authentication bypass (CVE-2026-24513, CVSS 3.1), Kubernetes ingress-nginx - DoS (CVE-2026-24514, CVSS 6.5), Kubernetes ingress-nginx - RCE (CVE-2026-1580, CVE-2026-24512, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/795?lang=enhttps://cyberfeed.cesnet.cz/reports/794?lang=enFortinet fixes 8 vulnerabilities in various products. The most severe ones are described below; the remaining ones can be found in the attached links. Individual products and their fixed versions: FortiAuthenticator - 6.6.7 FortiClientWindows - 7.4.5, 7.2.13 FortiOS - 7.6.5, 7.4.10 FortiSandbox - 5.0.2, 4.4.8 Vulnerabilities: Fortinet - intro, FortiSandbox - XSS (CVE-2025-52436, CVSS 8.8), FortiOS - LDAP authentication bypass (CVE-2026-22153, CVSS 8.1), FortiAuthenticator - unauthorized data modification (CVE-2026-21743, CVSS 7.2)https://cyberfeed.cesnet.cz/reports/794?lang=enhttps://cyberfeed.cesnet.cz/reports/793?lang=enPostgreSQL versions 18.2, 17.8, 16.12, 15.16 and 14.21 fix 5 vulnerabilities. The most severe ones are described below; the remaining ones can be found at. Vulnerabilities: PostgreSQL - intro, PostgreSQL - arbitrary code execution (CVE-2026-2004, CVSS 8.8), PostgreSQL - arbitrary code execution (CVE-2026-2005, CVSS 8.8), PostgreSQL - arbitrary code execution (CVE-2026-2006, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/793?lang=enhttps://cyberfeed.cesnet.cz/reports/792?lang=enGoogle fixes a high-severity vulnerability in Google Chrome and other browsers based on the Chromium engine. The fix has been released for Windows and macOS (versions 145.0.7632.75/76) and Linux (144.0.7559.75). A fix for Microsoft Edge is not yet available. Vulnerabilities: Google Chrome - intro, Google Chrome - RCE (CVE-2026-2441, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/792?lang=enhttps://cyberfeed.cesnet.cz/reports/790?lang=enF5 fixes 5 vulnerabilities in various products. The most severe ones are described below; the remaining ones can be found at. Fixed versions of individual products: BIG-IP Advanced WAF/ASM - 17.1.3 NGINX Plus - R36 P2, R35 P1, R32 P4 NGINX Open Source - 1.29.5, 1.28.2 NGINX Ingress Controller - 5.3.3 NGINX Gateway Fabric - 2.4.1 BIG-IP Container Ingress Services (Kubernetes and OpenShift) - 2.20.2 (or 2.20.1 with Helm in version 0.0.36) Vulnerabilities: F5 - intro, BIG-IP Advanced WAF/ASM - DoS (CVE-2026-22548, CVSS 8.2), NGINX Plus, Open Source, Ingress Controller, Gateway Fabric, Instance Manager - response injection (CVE-2026-1642, CVSS 8.2), BIG-IP Container Ingress Services (Kubernetes, OpenShift) - unauthorized read (CVE-2026-22549, CVSS 6.9)https://cyberfeed.cesnet.cz/reports/790?lang=enhttps://cyberfeed.cesnet.cz/reports/789?lang=enGitLab fixes 15 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) in versions 18.8.4, 18.7.4 and 18.6.6. The most severe vulnerabilities are listed below. Vulnerabilities: GitLab CE/EE - incomplete token validation (CVE-2025-7659, CVSS 8.0), GitLab CE/EE - DoS (CVE-2025-8099, CVSS 7.5), GitLab CE/EE - XSS (CVE-2025-14560, CVSS 7.3), GitLab CE/EE - introhttps://cyberfeed.cesnet.cz/reports/789?lang=enhttps://cyberfeed.cesnet.cz/reports/788?lang=enpgAdmin 4 version 9.12 fixes 1 vulnerability. Vulnerabilities: pgAdmin - intro, pgAdmin - RCE (CVE-2026-1707, CVSS 7.4)https://cyberfeed.cesnet.cz/reports/788?lang=enhttps://cyberfeed.cesnet.cz/reports/787?lang=enFortinet fixes a critical vulnerability in FortiClientEMS with version 7.4.5. Vulnerabilities: Fortinet FortiClientEMS - intro, Fortinet FortiClientEMS - RCE (CVE-2026-21643, CVSS 9.8)https://cyberfeed.cesnet.cz/reports/787?lang=enhttps://cyberfeed.cesnet.cz/reports/786?lang=enGitLab fixes 1 vulnerability in GitLab AI Gateway in versions 18.6.2, 18.7.1 and 18.8.1. Vulnerabilities: GitLab - intro, GitLab AI Gateway - DoS (CVE-2026-1868, CVSS 9.9)https://cyberfeed.cesnet.cz/reports/786?lang=enhttps://cyberfeed.cesnet.cz/reports/785?lang=enZyxel fixes 1 vulnerability in Zyxel ZLD (firewall firmware) in version 5.42. The specifically affected firewall series are ATP, USG FLEX, USG FLEX 50(W) and USG20(W)-VPN. Vulnerabilities: Zyxel ZLD - intro, Zyxel ZLD (Firewall) - comand injection (CVE-2025-11730, CVSS 7.2)https://cyberfeed.cesnet.cz/reports/785?lang=enhttps://cyberfeed.cesnet.cz/reports/784?lang=enCisco fixes 5 vulnerabilities in various products. The most severe vulnerabilities are described below; the rest can be found at. Individual products and their fixed versions: Cisco Meeting Management - 3.12.1 MR Cisco TelePresence CE Software, RoomOS Software - On-Premise: 11.27.5.0, 11.32.3.0 - Cloud-Aware: RoomOS October 2025, RoomOS December 2025 Cisco Prime Infrastructure - 3.10.6 Security Update 02 Cisco Evolved Programmable Network Manager - 8.1.1 Cisco Secure Web Appliance - 15.2.5-011 Vulnerabilities: Cisco - intro, Cisco Meeting Management - arbitrary file upload (CVE-2026-20098, CVSS 8.8), Cisco TelePresence Collaboration Endpoint Software, RoomOS Software - DoS (CVE-2026-20119, CVSS 7.5)https://cyberfeed.cesnet.cz/reports/784?lang=enhttps://cyberfeed.cesnet.cz/reports/782?lang=enMozilla fixes 3 vulnerabilities in Firefox and Thunderbird. Individual products and fixed versions: Firefox - 147.0.2 Thunderbird - 147.0.1, 140.7.1 Vulnerabilities: Mozilla Firefox - intro, Mozilla Firefox - use after free (CVE-2026-24869, CVSS 8.1), Mozilla Firefox - mitigation bypass (CVE-2026-24868, CVSS 7.5), Thunderbird - email content exfiltration (CVE-2026-0818, CVSS 4.3)https://cyberfeed.cesnet.cz/reports/782?lang=enhttps://cyberfeed.cesnet.cz/reports/781?lang=enOpenSSL fixes 12 vulnerabilities in versions 3.6.1, 3.5.5, ​3.4.4, 3.3.6, 3.0.19, 1.1.1ze and 1.0.2zn. The most severe of them are described below; the full list can be found at. The OpenSSL FIPS modules are not affected by these vulnerabilities. Vulnerabilities: OpenSSL - intro, OpenSSL - DoS, remote code execution (CVE-2025-15467, CVSS 9.8), OpenSSL - DoS, code execution (CVE-2025-11187, CVSS 6.1), OpenSSL - DoS (CVE-2025-66199, CVSS 5.9)https://cyberfeed.cesnet.cz/reports/781?lang=enhttps://cyberfeed.cesnet.cz/reports/780?lang=enRancher fixes a high-severity vulnerability with versions 2.13.2, 2.12.6, 2.11.10 and 2.10.11. Vulnerabilities: Rancher - intro, Rancher - TLS bypass, MITM (CVE-2025-67601, CVSS 8.3)https://cyberfeed.cesnet.cz/reports/780?lang=enhttps://cyberfeed.cesnet.cz/reports/779?lang=enIvanti Endpoint Manager Mobile (EPMM) has released a patch for 2 critical vulnerabilities, one of which is being actively exploited. Available fixes: RPM_12.x.0.x: - for versions 12.5.0.x, 12.6.0.x and 12.7.0.x - compatible with 12.3.0.x and 12.4.0.x RPM_12.x.1.x: - for versions 12.5.1.0 and 12.6.1.0 The RPM patch must be re-applied after every update to a different version until the final fix is released in version 12.8.0.0 (Q1 2026). To apply it, the installation command must be prefixed with credentials for the support.mobileiron.com portal. For further steps and detailed information see. Vulnerabilities: Ivanti Endpoint Manager Mobile - intro, Ivanti Endpoint Manager Mobile - RCE (CVE-2026-1281, CVSS 9.8), Ivanti Endpoint Manager Mobile - RCE (CVE-2026-1340, CVSS 9.8)https://cyberfeed.cesnet.cz/reports/779?lang=enhttps://cyberfeed.cesnet.cz/reports/778?lang=enSolarWinds fixes 6 vulnerabilities in Web Help Desk with version 2026.1. The most severe of them are described below; the rest can be found at. The vulnerability CVE-2025-40551 has been added to the CISA Known Exploited Vulnerabilities catalog. Vulnerabilities: SolarWinds - intro, SolarWinds Web Help Desk - authentication bypass (CVE-2025-40552, CVSS 9.8), SolarWinds Web Help Desk - RCE (CVE-2025-40551, CVE-2025-40553, CVSS 9.8), SolarWinds Web Help Desk - authentication bypass (CVE-2025-40554, CVSS 9.8)https://cyberfeed.cesnet.cz/reports/778?lang=enhttps://cyberfeed.cesnet.cz/reports/777?lang=enIcinga fixes 2 vulnerabilities in various products. Products and their fixed versions: Icinga 2 - 2.15.2, 2.14.8, 2.13.14 Icinga for Windows - 1.13.4, 1.12.4, 1.11.2 Vulnerabilities: Icinga 2 - intro, Icinga 2, Icinga for Windows - unauthorized read (CVE-2026-24413, CVSS 6.8), Icinga for Windows - unauthorized read (CVE-2026-24414, CVSS 6.8)https://cyberfeed.cesnet.cz/reports/777?lang=enhttps://cyberfeed.cesnet.cz/reports/776?lang=enGnuPG fixes 3 vulnerabilities with version 2.5.17. Vulnerabilities: GnuPG - intro, GnuPG - DoS, memory corruption, code execution (CVE-2026-24882, CVSS 8.4), GnuPG - DoS, memory corruption, code execution (CVE-2026-24881, CVSS 8.1), GnuPG - process crash (CVE-2026-24883, CVSS 3.7)https://cyberfeed.cesnet.cz/reports/776?lang=enhttps://cyberfeed.cesnet.cz/reports/775?lang=enFortinet fixes a critical, actively exploited vulnerability in various products. Products and their fixed versions: FortiAnalyzer - 7.6.6, 7.4.10, 7.2.12, 7.0.16 FortiManager - 7.6.6, 7.4.10, 7.2.13, 7.0.16 FortiOS - 7.6.6, 7.4.11, 7.2.13, 7.0.19 FortiProxy - 7.6.6, 7.4.13 FortiWeb - 8.0.4, 7.6.7, 7.4.12 Vulnerabilities: Fortinet - intro, FortiAnalyzer, FortiManager, FortiOS, FortiProxy, FortiWeb - authentication bypass (CVE-2026-24858, CVSS 9.8)https://cyberfeed.cesnet.cz/reports/775?lang=enhttps://cyberfeed.cesnet.cz/reports/774?lang=enHPE Aruba fixes 2 vulnerabilities in HPE Aruba Networking Fabric Composer in version 7.3.0. Vulnerabilities: HPE Aruba - intro, HPE Aruba Networking Fabric Composer - RCE (CVE-2026-23592, CVSS 7.2), HPE Aruba Networking Fabric Composer - system file read (CVE-2026-23593, CVSS 5.3)https://cyberfeed.cesnet.cz/reports/774?lang=enhttps://cyberfeed.cesnet.cz/reports/773?lang=enMicrosoft Office fixes a high-severity, actively exploited vulnerability. Fixed product versions: - Microsoft Office 2021 and later, Microsoft 365 - automatic fix (restart required) - Microsoft Office 2019 (32-bit and 64-bit) - 16.0.10417.20095 - Microsoft Office 2016 (32-bit and 64-bit) - 16.0.5539.1001 Vulnerabilities: Microsoft Office, 365 - intro, Microsoft Office, 365 - security bypass (CVE-2026-21509, CVSS 7.8)https://cyberfeed.cesnet.cz/reports/773?lang=enhttps://cyberfeed.cesnet.cz/reports/772?lang=enCisco fixes 4 medium-severity vulnerabilities in various products. Fixed versions of individual products: Cisco Intersight Virtual Appliance Software - 1.1.4-1 Cisco IEC6400 Wireless Backhaul Edge Compute Software - 1.2.0 Cisco Packaged Contact Center Enterprise (CCE) - 15.0(1)ES202511 Cisco Unified CCE - 15.0(1)ES202511 Vulnerabilities: Cisco - intro, Cisco Intersight Virtual Appliance - privilege escalation (CVE-2026-20092, CVSS 6.0), Cisco IEC6400 Wireless Backhaul Edge Compute Software - DoS (CVE-2026-20080, CVSS 5.3), Cisco Packaged Contact Center Enterprise & Unified Contact Center Enterprise - XSS (CVE-2026-20055, CVE-2026-20109, CVSS 4.8)https://cyberfeed.cesnet.cz/reports/772?lang=enhttps://cyberfeed.cesnet.cz/reports/770?lang=enNVIDIA fixes 5 vulnerabilities in NVIDIA Merlin Transformers4Rec and NVIDIA CUDA Toolkit. The most severe are described below; the rest can be found at. Products and their fixes: NVIDIA Merlin Transformers4Rec - all versions that contain commit 27ddd49 NVIDIA CUDA Toolkit - 13.1 Vulnerabilities: NVIDIA - intro, NVIDIA Merlin - code execution, escalation of privileges, information disclosure, data tampering (CVE-2025-33233, CVSS 7.8), NVIDIA CUDA Toolkit - code execution, escalation of privileges, data tampering, denial of service, information disclosure (CVE-2025-33228, CVSS 7.3), NVIDIA CUDA Toolkit - code execution, escalation of privileges, data tampering, denial of service, information disclosure (CVE-2025-33229, CVSS 7.3)https://cyberfeed.cesnet.cz/reports/770?lang=enhttps://cyberfeed.cesnet.cz/reports/768?lang=enWith versions 14SU5 and 15SU4 (03/2026), Cisco fixes a critical, actively exploited vulnerability in the following products: - Unified Communications Manager (Unified CM) - Cisco Unified Communications Manager Session Management Edition (Unified CM SME) - Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) - Cisco Unity Connection - Cisco Webex Calling Dedicated Instance The patch for Cisco Unity Connection version 14 is available at, for version 15 at. The patch for the other products in version 14 can be found at, in version 15 at. Vulnerabilities: Cisco Unified CM, Webex & Unity Connection - intro, Cisco Unified CM, Webex & Unity Connection - RCE, privilege escalation (CVE-2026-20045, CVSS 8.2)https://cyberfeed.cesnet.cz/reports/768?lang=enhttps://cyberfeed.cesnet.cz/reports/767?lang=enSonatype fixes two vulnerabilities in Nexus Repository 3 with version 3.88.0. Vulnerabilities: Sonatype Nexus Repository - intro, Sonatype Nexus Repository - SSRF (CVE-2026-0600, CVSS 6.2), Sonatype Nexus Repository - reflected XSS (CVE-2026-0601, CVSS 5.1)https://cyberfeed.cesnet.cz/reports/767?lang=enhttps://cyberfeed.cesnet.cz/reports/766?lang=enFortinet fixes 6 vulnerabilities in various products. Individual products and their fixed versions: FortiSIEM - 7.4.1, 7.3.5, 7.2.7, 7.1.9 FortiFone - 7.0.2, 3.0.24 FortiOS - 7.6.4, 7.4.9, 7.2.12, 7.0.18 FortiSwitchManager - 7.2.7, 7.0.6 FortiClientEMS - 7.4.5, 7.2.12 FortiVoice - 7.2.3, 7.0.8 FortiSandbox - 5.0.5 Vulnerabilities: Fortinet FortiSIEM - OS command injection (CVE-2025-64155, CVSS 9.8), Fortinet FortiFone - configuration leak (CVE-2025-47855, CVSS 7.5), Fortinet FortiOS, FortiSwitchManager - code execution (CVE-2025-25249, CVSS 8.1), Fortinet FortiClientEMS - SQL injection (CVE-2025-59922, CVSS 7.2), Fortinet FortiClientEMS - path traversal (CVE-2025-58693, CVSS 6.5), Fortinet FortiSandbox - SSRF (CVE-2025-67685, CVSS 3.8), Fortinet - introhttps://cyberfeed.cesnet.cz/reports/766?lang=enhttps://cyberfeed.cesnet.cz/reports/750?lang=enPalo Alto fixes a high-severity vulnerability in PAN-OS and Prisma Access. Fixed versions by branch: 12.1 PAN-OS: 12.1.3-h3, 12.1.4 11.2 PAN-OS: 11.2.4-h15, 11.2.7-h8, 11.2.10-h2 11.1 PAN-OS: 11.1.4-h27, 11.1.6-h23, 11.1.10-h9, 11.1.13 10.2 PAN-OS: 10.2.7-h32, 10.2.10-h30, 10.2.13-h18, 10.2.16-h6, 10.2.18-h1 10.1 PAN-OS: 10.1.14-h20 Prisma Access (fixed automatically) - 10.2.4-h43, 10.2.10-h29, 11.2.7-h8 Vulnerabilities: Palo Alto PAN-OS - intro, Palo Alto PAN-OS, Prisma Access - DoS (CVE-2026-0227, CVSS 7.7)https://cyberfeed.cesnet.cz/reports/750?lang=enhttps://cyberfeed.cesnet.cz/reports/749?lang=enGitLab fixes 5 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) with versions 18.8.2, 18.7.2 and 18.6.4. Vulnerabilities: GitLab CE/EE - intro, GitLab CE/EE - DoS (CVE-2025-13927, CVSS 7.5), GitLab CE/EE - DoS (CVE-2025-13928, CVSS 7.5), GitLab CE/EE - 2FA bypass (CVE-2026-0723, CVSS 7.4), GitLab CE/EE - DoS (CVE-2025-13335, CVSS 6.5), GitLab CE/EE - DoS (CVE-2026-1102, CVSS 5.3)https://cyberfeed.cesnet.cz/reports/749?lang=enhttps://cyberfeed.cesnet.cz/reports/748?lang=enOpenStack fixes a critical vulnerability in the keystonemiddleware package with versions 10.7.2, 10.9.1 and 10.12.1. Patches for manual application to individual OpenStack development branches can be found at. Among the most common Linux distributions, for example Ubuntu versions 24.04 LTS (noble) and 25.10 (questing) are vulnerable. In the Red Hat portfolio, OpenShift Container Platform 4 is affected. Debian has released a fix for trixie (security) in version 10.9.0-2+deb13u1 and for forky and sid in version 10.12.0-3; the bullseye and bookworm releases are not affected. SUSE products are not affected by this vulnerability by default; a fix was released only for openSUSE Tumbleweed. Vulnerabilities: OpenStack keystonemiddleware - intro, OpenStack keystonemiddleware - privilege escalation (CVE-2026-22797, CVSS 9.9)https://cyberfeed.cesnet.cz/reports/748?lang=enhttps://cyberfeed.cesnet.cz/reports/747?lang=enVulnerabilities: Juniper - introhttps://cyberfeed.cesnet.cz/reports/747?lang=enhttps://cyberfeed.cesnet.cz/reports/746?lang=enNode.js fixes 8 vulnerabilities in versions 20.20.0, 22.22.0, 24.13.0 and 25.3.0. Vulnerabilities: Node.js - intro, Node.js - data corruption (CVE-2025-55131, CVSS 8.1), Node.js - file read/write (CVE-2025-55130, CVSS 8.1), Node.js - DoS (CVE-2025-59465, CVSS 7.5), Node.js - DoS (CVE-2025-59466, CVSS 5.9)https://cyberfeed.cesnet.cz/reports/746?lang=enhttps://cyberfeed.cesnet.cz/reports/745?lang=enElastic fixes 3 vulnerabilities in Kibana in versions 8.19.9, 9.1.9 and 9.2.3. Vulnerabilities: Kibana - DoS (CVE-2026-0530, CVSS 6.5), Kibana - DoS (CVE-2026-0543, CVSS 6.5), Kibana - introhttps://cyberfeed.cesnet.cz/reports/745?lang=enhttps://cyberfeed.cesnet.cz/reports/744?lang=enHPE Aruba fixes 12 vulnerabilities in Mobility Conductors, Mobility Controllers, WLAN and SD-WAN Gateways (AOS-10 and AOS-8) with versions 10.7.2.2, 10.4.1.10, 8.13.1.1 and 8.10.0.21. In addition, version 4.7.6 (released on 15 February 2026) will fix 1 vulnerability in HPE Aruba Networking VIA client for Linux. The most severe vulnerabilities are listed below; the rest are listed at. Vulnerabilities: HPE Aruba Networking - intro, Aruba AOS - DoS (CVE-2025-37168, CVSS 8.2), Aruba AOS - arbitrary code execution (CVE-2025-37169, CVSS 7.2), Aruba AOS - arbitrary command execution (CVE-2025-37170, CVE-2025-37171, CVE-2025-37172, CVSS 7.2), Aruba AOS - arbitrary command execution (CVE-2025-37175, CVSS 7.2), HPE Aruba Networking VIA client - arbitrary code execution (CVE-2025-37186, CVSS 7.8)https://cyberfeed.cesnet.cz/reports/744?lang=enhttps://cyberfeed.cesnet.cz/reports/743?lang=enXWiki fixes 2 vulnerabilities in the Full Calendar macro with version 2.4.6. Vulnerabilities: XWiki - intro, XWiki Full Calendar - SQL injection (CVE-2025-65091, CVSS 10.0), XWiki Full Calendar - data leak (CVE-2025-65090, CVSS 5.3)https://cyberfeed.cesnet.cz/reports/743?lang=enhttps://cyberfeed.cesnet.cz/reports/742?lang=enApache Struts 2 version 6.1.1 fixes a high-severity vulnerability. Vulnerabilities: Apache Struts 2 - intro, Apache Struts 2 - information disclosure, DoS, SSRF (CVE-2025-68493, CVSS 8.1)https://cyberfeed.cesnet.cz/reports/742?lang=enhttps://cyberfeed.cesnet.cz/reports/741?lang=enUbiquiti fixes 2 vulnerabilities in its products. Products and their fixed versions: airMAX AC - 8.7.21 airMAX M - 6.3.24 airFiber AF60-XG - 1.2.3 airFiber AF60 - 2.6.8 UBB-XG - 1.2.3 UDB-Pro/UDB-Pro-Sector - 1.4.2 UBB - 3.1.7 Vulnerabilities: Ubiquiti - intro, airMAX, airFiber, UBB, UDB - RCE (CVE-2026-21639, CVE-2026-21638, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/741?lang=enhttps://cyberfeed.cesnet.cz/reports/740?lang=enGitLab fixes 7 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) in versions 18.7.1, 18.6.3 and 18.5.5. The most severe vulnerabilities are listed below. Vulnerabilities: GitLab CE/EE - stored XSS (CVE-2025-9222, CVSS 8.7), GitLab CE/EE - XSS (CVE-2025-13761, CVSS 8.0), GitLab CE/EE - DoS (CVE-2025-10569, CVSS 6.5), GitLab CE/EE - introhttps://cyberfeed.cesnet.cz/reports/740?lang=enhttps://cyberfeed.cesnet.cz/reports/739?lang=enCisco fixes 3 vulnerabilities in various products. Individual products and their fixed versions: Cisco ISE – 3.2 Patch 8, 3.3 Patch 8, 3.4 Patch 4, 3.5 Cisco ISE-PIC – 3.2 Patch 8, 3.3 Patch 8, 3.4 Patch 4, 3.5 The list of the remaining fixed versions can be found at. Vulnerabilities: Cisco - intro, Cisco Products Snort 3 - DoS (CVE-2026-20026, CVSS 5.8), Cisco Products Snort 3 - information disclosure (CVE-2026-20027, CVSS 5.3), Cisco ISE, ISE-PIC - sensitive information leak (CVE-2026-20029, CVSS 4.9)https://cyberfeed.cesnet.cz/reports/739?lang=enhttps://cyberfeed.cesnet.cz/reports/738?lang=enVeeam Backup & Replication version 13.0.1 (build 13.0.1.1071) fixes 4 vulnerabilities. Vulnerabilities: Veeam - intro, Veeam Backup & Replication - RCE (CVE-2025-59470, CVSS 9.0), Veeam Backup & Replication - RCE (CVE-2025-55125, CVSS 7.2), Veeam Backup & Replication - file write (CVE-2025-59469, CVSS 7.2), Veeam Backup & Replication - RCE (CVE-2025-59468, CVSS 6.7)https://cyberfeed.cesnet.cz/reports/738?lang=enhttps://cyberfeed.cesnet.cz/reports/737?lang=enGitHub Enterprise Server versions 3.19.1, 3.18.2, 3.17.8, 3.16.11, 3.15.15 and 3.14.20 fix a high-severity vulnerability. Vulnerabilities: GitHub Enterprise Server - intro, GitHub Enterprise Server - XSS (CVE-2025-13744, CVSS 8.4)https://cyberfeed.cesnet.cz/reports/737?lang=enhttps://cyberfeed.cesnet.cz/reports/736?lang=enQNAP fixes 27 vulnerabilities in various products; the most severe selected ones are described below. The remaining ones can be found at. Products and their fixed versions: License Center - 2.0.36 MARS (Multi-Application Recovery Service) - 1.2.1.1686 Qfiling - 3.13.1 Qfinder Pro (macOS) - 7.13.0 Qsync (macOS) - 5.1.5 QTS - 5.2.7.3256 build 20250913 - 5.2.8.3332 build 20251128 QuTS hero - h5.2.7.3256 build 20250913 - h5.2.8.3321 build 20251117 - h5.3.1.3250 build 20250912 QuMagie - 2.8.1 QVPN Device Client (macOS) - 2.2.8 Vulnerabilities: QNAP - intro, Multi-Application Recovery Service - SQL injection (CVE-2025-59387, CVSS 8.1), Qfiling - unauthorized read/write (CVE-2025-59384, CVSS 8.1), QTS, QuTS hero - unauthorized read (CVE-2025-54164, CVE-2025-54165, CVE-2025-54166, CVSS 4.6)https://cyberfeed.cesnet.cz/reports/736?lang=enhttps://cyberfeed.cesnet.cz/reports/735?lang=enZimbra fixes 2 vulnerabilities in Zimbra Collaboration in versions 10.0.18 and 10.1.13. Vulnerabilities: Zimbra Collaboration - stored XSS (CVE-2025-66376, CVSS 7.2), Zimbra Collaboration - hardcoded credentials (CVE-2025-67809, CVSS 4.7), Zimbra Collaboration - introhttps://cyberfeed.cesnet.cz/reports/735?lang=enhttps://cyberfeed.cesnet.cz/reports/734?lang=enUbiquiti versions 6.2.72 and 1.6.1 fix 3 vulnerabilities in the UniFi Protect Application and UniFi Connect EV Station Lite products. Vulnerabilities: Ubiquiti - intro, UniFi Protect Application - improper authentication (CVE-2026-21633, CVSS 8.8), UniFi Protect Application - DoS (CVE-2026-21634, CVSS 6.5), UniFi Connect EV Station Lite - improper access control (CVE-2026-21635, CVSS 5.3)https://cyberfeed.cesnet.cz/reports/734?lang=enhttps://cyberfeed.cesnet.cz/reports/733?lang=enCowrie fixes 1 vulnerability in version 2.9.4. Vulnerabilities: Cowrie - SSRF (CVE-2025-34469, CVSS 8.3), Cowrie - introhttps://cyberfeed.cesnet.cz/reports/733?lang=enhttps://cyberfeed.cesnet.cz/reports/730?lang=enNVIDIA Isaac Launchable fixes 3 high-severity vulnerabilities in version 1.1. Vulnerabilities: NVIDIA - intro, NVIDIA Isaac Launchable - code execution, escalation of privileges, denial of service, information disclosure, data tampering (CVE-2025-33223, CVE-2025-33224, CVSS 9.8), NVIDIA Isaac Launchable - code execution, escalation of privileges, denial of service, data tampering (CVE-2025-33222, CVSS 9.8)https://cyberfeed.cesnet.cz/reports/730?lang=enhttps://cyberfeed.cesnet.cz/reports/729?lang=enWebKitGTK and WPE WebKit versions 2.50.4 fix 7 vulnerabilities. The most severe selected ones are described below; the remaining ones can be found at. Apple products and their fixed versions: iOS - 26.2, 18.7.3 iPadOS - 26.2, 18.7.3 macOS - Tahoe 26.2, Sonoma 14.8.3, Sequoia 15.7.3 tvOS - 26.2 watchOS - 26.2 visionOS - 26.2 Safari - 26.2 Vulnerabilities: WebKitGTK, WPE WebKit - intro, WebKitGTK, WPE WebKit - RCE (CVE-2025-43529, CVSS 8.8), WebKitGTK, WPE WebKit - memory corruption (CVE-2025-14174, CVSS 7.1), WebKitGTK, WPE WebKit - process crash (CVE-2025-43501, CVSS 4.3)https://cyberfeed.cesnet.cz/reports/729?lang=enhttps://cyberfeed.cesnet.cz/reports/728?lang=enMongoDB Server versions 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32 and 4.4.30 fix a high-severity, actively exploited vulnerability. Fixes on MongoDB Atlas were applied automatically. Among the most common Linux distributions, Ubuntu (releases focal 20.04 and bionic 18.04) is affected, for example. Red Hat systems are not affected. Gentoo tracks the vulnerability, and a fix is so far available upstream. Vulnerabilities: MongoDB Server - intro, MongoDB Server - unauthorized memory read (CVE-2025-14847, CVSS 8.7)https://cyberfeed.cesnet.cz/reports/728?lang=enhttps://cyberfeed.cesnet.cz/reports/727?lang=enSynology fixes 3 vulnerabilities in the Assistant, Active Backup for Business Agent and C2 Identity Edge Server for DSM products. Products and fixed versions: Synology Assistant - 7.0.6-50085 Synology Active Backup for Business Agent - 3.1.0-4967 Synology C2 Identity Edge Server for DSM - 1.76.0-0307 Vulnerabilities: Synology - intro, Synology Assistant, Active Backup for Business Agent - arbitrary file write (CVE-2025-66593, CVE-2025-66592, CVSS 6.1), Synology C2 Identity Edge Server for DSM - credentials disclosure (CVE-2025-14713, CVSS 7.5)https://cyberfeed.cesnet.cz/reports/727?lang=enhttps://cyberfeed.cesnet.cz/reports/726?lang=enCisco warns of a critical vulnerability in the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager products (AsyncOS Software). Attackers are already actively exploiting this flaw. No fix is available yet, so the company recommends temporarily mitigating the risk according to the recommendations at. Vulnerabilities: Cisco Secure Email Gateway, Secure Email and Web Manager - intro, Cisco Secure Email Gateway, Secure Email and Web Manager - arbitrary command execution, privilege escalation (CVE-2025-20393, CVSS 10.0)https://cyberfeed.cesnet.cz/reports/726?lang=enhttps://cyberfeed.cesnet.cz/reports/725?lang=enElastic fixes 2 vulnerabilities in its products. Products and their fixed versions: Elasticsearch - 8.19.8, 9.1.8, 9.2.2 Kibana - 8.19.8, 9.1.8, 9.2.2 Vulnerabilities: Elastic - intro, Elasticsearch - user impersonation (CVE-2025-37731, CVSS 6.8), Elastic Kibana - XSS (CVE-2025-37732, CVSS 5.4)https://cyberfeed.cesnet.cz/reports/725?lang=enhttps://cyberfeed.cesnet.cz/reports/724?lang=enReact versions 19.0.3, 19.1.4 and 19.2.3 fix 2 vulnerabilities in React Server Components (packages react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack) discovered during analysis of the fix for the critical vulnerability CVE-2025-55182 of 3 December 2025. The affected frameworks are next, react-router, waku, @parcel/rsc, @vitejs/plugin-rsc and rwsdk. Detailed information on the vulnerabilities and fixes can be found at. Vulnerabilities: React Server Components - intro, React Server Components - DoS (CVE-2025-67779, CVSS 7.5), React Server Components - source code exposure (CVE-2025-55183, CVSS 5.3)https://cyberfeed.cesnet.cz/reports/724?lang=enhttps://cyberfeed.cesnet.cz/reports/722?lang=enFortinet fixes 16 vulnerabilities in various products. The most severe vulnerabilities are listed below. Individual products and their fixed versions: FortiOS - 7.4.9, 7.6.4 FortiPortal - 7.4.6 FortiProxy - 7.0.22, 7.2.15, 7.4.11, 7.6.4 FortiSwitchManager - 7.0.6, 7.2.7 FortiWeb - 7.0.12, 7.2.12, 7.4.11, 7.6.6, 8.0.2 FortiSandbox - 4.0.7, 4.2.9, 4.4.8, 5.0.3 FortiSandbox PaaS - 24.2 FortiSOAR - 7.5.2, 7.6.4 FortiAuthenticator - 6.6.7 FortiVoice - 6.0.13, 6.4.12, 7.0.8, 7.2.3 FortiExtender - 7.0.5, 7.2.6, 7.4.8, 7.6.4 Vulnerabilities: Fortinet - intro, FortiOS, FortiProxy, FortiSwitchManager, FortiWeb - authentication bypass (CVE-2025-59718, CVE-2025-59719, CVSS 9.8), FortiSandbox - command injection (CVE-2025-53949, CVSS 7.2), FortiVoice - arbitrary file write (CVE-2025-60024, CVSS 8.8), FortiWeb - arbitrary operation execution (CVE-2025-64447, CVSS 8.1)https://cyberfeed.cesnet.cz/reports/722?lang=enhttps://cyberfeed.cesnet.cz/reports/721?lang=enpgAdmin 4 version 9.11 fixes 1 vulnerability. Vulnerabilities: pgAdmin 4 - intro, pgAdmin 4 - RCE (CVE-2025-13780, CVSS 9.1)https://cyberfeed.cesnet.cz/reports/721?lang=enhttps://cyberfeed.cesnet.cz/reports/720?lang=enApache Struts versions 6.8.0 and 7.1.1 fix a high-severity vulnerability. Vulnerabilities: Apache Struts - intro, Apache Struts - DoS (CVE-2025-66675, CVSS 8.2)https://cyberfeed.cesnet.cz/reports/720?lang=enhttps://cyberfeed.cesnet.cz/reports/719?lang=enGitHub Enterprise Server versions 3.18.3, 3.17.9, 3.16.12, 3.15.16 and 3.14.21 fix a high-severity vulnerability. Vulnerabilities: GitHub Enterprise Server - intro, GitHub Enterprise Server - XSS (CVE-2025-14046, CVSS 8.6)https://cyberfeed.cesnet.cz/reports/719?lang=enhttps://cyberfeed.cesnet.cz/reports/718?lang=enXWiki versions 16.10.10, 17.4.3 and 17.6.0-rc-1 fix 1 vulnerability. Vulnerabilities: XWiki - intro, XWiki - RCE (CVE-2025-66474, CVSS 8.7)https://cyberfeed.cesnet.cz/reports/718?lang=enhttps://cyberfeed.cesnet.cz/reports/717?lang=enIvanti version 2024 SU4 SR1 fixes 4 vulnerabilities in the Ivanti Endpoint Manager product. Vulnerabilities: Ivanti Endpoint Manager - intro, Ivanti Endpoint Manager - XSS (CVE-2025-10573, CVSS 9.6), Ivanti Endpoint Manager - arbitrary file write, RCE (CVE-2025-13659, CVSS 8.8), Ivanti Endpoint Manager - RCE (CVE-2025-13662, CVSS 8.8), Ivanti Endpoint Manager - arbitrary file write (CVE-2025-13661, CVSS 7.1)https://cyberfeed.cesnet.cz/reports/717?lang=enhttps://cyberfeed.cesnet.cz/reports/716?lang=enSplunk fixes 10 vulnerabilities in various products. The most severe ones are described below; the remaining ones can be found at. Individual products and their latest fixed versions: Splunk Enterprise - 10.0.2, 9.4.6, 9.3.8, 9.2.10 Splunk Universal Forwarder - 10.0.2, 9.4.6, 9.3.8, 9.2.10 Splunk Cloud Platform - 10.1.2507.10, 10.0.2503.8, 9.3.2411.120 Splunk Secure Gateway - 3.9.10, 3.8.58, 3.7.28 Splunk MCP Server - 0.2.4 Vulnerabilities: Splunk - intro, Splunk Enterprise - file read/modification (CVE-2025-20386, CVSS 8.0), Splunk Universal Forwarder - file read/modification (CVE-2025-20387, CVSS 8.0), Splunk Enterprise - arbitrary file write, RCE (CVE-2025-47273, CVSS 7.7)https://cyberfeed.cesnet.cz/reports/716?lang=enhttps://cyberfeed.cesnet.cz/reports/715?lang=enGitLab fixes 10 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) in versions 18.6.2, 18.5.4 and 18.4.6. The most severe vulnerabilities are listed below. Vulnerabilities: GitLab CE/EE - XSS (CVE-2025-12716, CVSS 8.7), GitLab CE/EE - XSS (CVE-2025-12029, CVSS 8.0), GitLab CE/EE - DoS (CVE-2025-12562, CVSS 7.5), GitLab CE/EE - introhttps://cyberfeed.cesnet.cz/reports/715?lang=enhttps://cyberfeed.cesnet.cz/reports/714?lang=enReact versions 19.0.1, 19.1.2 and 19.2.1 fix a critical, actively exploited vulnerability in React Server Components (packages react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack). The affected frameworks are next, react-router, waku, @parcel/rsc, @vitejs/plugin-rsc and rwsdk. Vulnerabilities: React Server Components - intro, React Server Components - RCE (CVE-2025-55182, CVSS 10.0)https://cyberfeed.cesnet.cz/reports/714?lang=enhttps://cyberfeed.cesnet.cz/reports/713?lang=enWith versions 18.6.1, 18.5.3 and 18.4.5, GitLab fixes 6 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE). The most serious of them are listed below. Vulnerabilities: GitLab - intro, GitLab CE/EE - privilege escalation (CVE-2024-9183, CVSS 7.7), GitLab CE/EE - DoS (CVE-2025-12571, CVSS 7.5), GitLab CE/EE - Authentication bypass (CVE-2025-12653, CVSS 6.5)https://cyberfeed.cesnet.cz/reports/713?lang=enhttps://cyberfeed.cesnet.cz/reports/712?lang=enWith version 2.7_rc2, OpenVPN fixes 1 vulnerability. Vulnerabilities: OpenVPN - Heap Buffer Over-Read (CVE-2025-12106, CVSS 9.1), OpenVPN - Introhttps://cyberfeed.cesnet.cz/reports/712?lang=enhttps://cyberfeed.cesnet.cz/reports/711?lang=enMongoDB is fixing 5 vulnerabilities in various products. The most serious of them are listed below, the remaining ones are listed at. Products and their fixed versions: MongoDB Server – 7.0.26, 8.0.16, 8.2.2 MongoDB C Driver – 1.30.6, 2.1.2 MongoDB PHP Driver – 2.1.2 Vulnerabilities: MongoDB Server - invariant failure (CVE-2025-13644, CVSS 7.1), MongoDB Server - process termination (CVE-2025-13507, CVSS 7.1), MongoDB - invalid memory read (CVE-2025-12119, CVSS 6.9), MongoDB - Introhttps://cyberfeed.cesnet.cz/reports/711?lang=enhttps://cyberfeed.cesnet.cz/reports/710?lang=enWebKitGTK and WPE WebKit versions 2.50.2 fix 13 vulnerabilities. The most severe ones are described below; the remaining ones can be found at. Apple products and their fixed versions: iOS - 26.1, 18.7.2 iPadOS - 26.1, 18.7.2 macOS - Tahoe 26.1, Sonoma 14.8.2, Sequoia 15.7.2 tvOS - 26.1 watchOS - 26.1 visionOS - 26.1 Safari - 26.1 Vulnerabilities: WebKitGTK, WPE WebKit - intro, WebKitGTK, WPE WebKit - memory corruption (CVE-2025-43419, CVSS 7.1), WebKitGTK, WPE WebKit - data exfiltration (CVE-2025-43480, CVSS 6.5), WebKitGTK, WPE WebKit - process crash (CVE-2025-43432, CVSS 4.3)https://cyberfeed.cesnet.cz/reports/710?lang=enhttps://cyberfeed.cesnet.cz/reports/709?lang=enGrafana Enterprise versions 12.3.0, 12.2.1+security-01, 12.1.3+security-01 and 12.0.6+security-01 fix 1 vulnerability in the System for Cross-domain Identity Management (SCIM) component. Vulnerabilities: Grafana - intro, Grafana - incorrect privilege assignment (CVE-2025-41115, CVSS 10.0)https://cyberfeed.cesnet.cz/reports/709?lang=enhttps://cyberfeed.cesnet.cz/reports/708?lang=enSolarWinds fixes 5 vulnerabilities in the Serv-U and Observability Self-Hosted products. The most severe ones are described below; the remaining ones can be found in the individual links. Products and their fixed versions: SolarWinds Serv-U - 15.5.3 SolarWinds Observability Self-Hosted - 2025.4 SR1 Vulnerabilities: SolarWinds - intro, SolarWinds Serv-U - RCE (CVE-2025-40547, CVSS 9.1), SolarWinds Serv-U - RCE (CVE-2025-40548, CVSS 9.1), SolarWinds Serv-U - RCE (CVE-2025-40549, CVSS 9.1), SolarWinds Observability Self-Hosted - XSS (CVE-2025-26391, CVSS 5.4)https://cyberfeed.cesnet.cz/reports/708?lang=enhttps://cyberfeed.cesnet.cz/reports/707?lang=enHPE is fixing 24 vulnerabilities in various products. The most serious of them are listed below, the remaining ones are listed at. Products and their fixed versions: HPE Aruba Networking AOS-CX - 10.16.1001, 10.15.1030, 10.14.1060, 10.13.1101, 10.10.1170, HPE Aruba Networking Management Software (AirWave) - 8.3.0.5, HPE Compute Scale-up Server 3200 - v1.55.98, HPE Telco Service Activator - v10.4.0. Vulnerabilities: Aruba AOS-CX - Unauthorized Access (CVE-2025-37155, CVSS 7.8), Aruba AirWave - command injection (CVE-2025-37163, CVSS 7.2), HPE Scale-up Server 3200 - escalation of privilege (CVE-2025-20109, CVSS 7.8), HPE Telco Service Activator - DoS (2025-9784, CVSS 7.5), HPE - introhttps://cyberfeed.cesnet.cz/reports/707?lang=enhttps://cyberfeed.cesnet.cz/reports/706?lang=enZyxel fixes 2 vulnerabilities in specific firmware versions of its products: - 4G LTE/5G NR CPE - DSL/Ethernet CPE - Fiber ONTs - Security Routers - Wireless Extenders A clear table of all fixed versions and the corresponding devices can be found at. Vulnerabilities: Zyxel - intro, Zyxel DSL/Ethernet CPE, Fiber ONTs, Wireless Extenders - OS command execution (CVE-2025-8693, CVSS 8.8), Zyxel 4G LTE/5G NR CPE, DSL/Ethernet CPE, Fiber ONTs, Security Routers, Wireless Extenders - DoS (CVE-2025-6599, CVSS 5.3)https://cyberfeed.cesnet.cz/reports/706?lang=enhttps://cyberfeed.cesnet.cz/reports/705?lang=enFortinet fixes 18 vulnerabilities in its products. The most serious of them are described below; the remaining ones can be found in the individual links. Products and their fixed versions: FortiADC - 8.0.1, 7.6.4 FortiClientWindows - 7.4.4, 7.2.11 FortiExtender - 7.6.3, 7.4.8 FortiOS - 7.6.4, 7.4.9 FortiPAM - 1.6.1 FortiProxy - 7.6.4 FortiSASE - 25.3.c (no user action required) FortiSandbox - 5.0.2, 4.4.8 FortiVoice - 7.2.3, 7.0.8 FortiWeb - 8.0.2, 7.6.6 FortiMail - 7.6.4, 7.4.6 (to be released) Vulnerabilities: Fortinet - intro, FortiWeb - administrative command execution (CVE-2025-64446, CVSS 9.8), FortiVoice - RCE, command execution (CVE-2025-58692, CVSS 8.8), FortiOS, FortiSASE - RCE, command execution (CVE-2025-58413, CVSS 7.5), FortiWeb - RCE, command execution (CVE-2025-58034, CVSS 7.2)https://cyberfeed.cesnet.cz/reports/705?lang=enhttps://cyberfeed.cesnet.cz/reports/704?lang=enWith versions 3.14.19, 3.15.14, 3.16.10, 3.17.7 and 3.18.1, GitHub fixes 2 vulnerabilities in GitHub Enterprise Server. Vulnerabilities: GitHub Enterprise Server - XSS (CVE-2025-11892, CVSS 8.6), GitHub Enterprise Server - symlink escape (CVE-2025-11578, CVSS 7.5), GitHub Enterprise Server - introhttps://cyberfeed.cesnet.cz/reports/704?lang=enhttps://cyberfeed.cesnet.cz/reports/703?lang=enCisco is fixing 8 vulnerabilities in various products. The most serious of them are listed below and the remaining ones at. Individual products and their fixed versions: Cisco Unified Contact Center Express (Unified CCX) - 12.5 SU3 ES07, 15.0 ES01 Cisco Unified Intelligence Center (CUIC) - 12.6(02) ES06 (Dec 2025), 15.0(01) ES202508 Cisco Identity Services Engine (ISE) - 3.2 Patch 8 (Dec 2025), 3.3 Patch 8, 3.4 Patch 4 Cisco ISE Passive Identity Connector (ISE-PIC) - 3.2 Patch 8 (Dec 2025), 3.3 Patch 8, 3.4 Patch 4 Vulnerabilities: Cisco Unified CCX - Arbitrary File Download (CVE-2025-20375, CVSS 6.5), Cisco Unified CCX - RCE (CVE-2025-20376, CVSS 6.5), Cisco ISE - Reflected XSS (CVE-2025-20303, CVE-2025-20304, CVSS 5.4), Cisco - Intro, Cisco Unified Intelligence Center (CUIC) - API Information Disclosure (CVE-2025-20377, CVSS 4.3)https://cyberfeed.cesnet.cz/reports/703?lang=enhttps://cyberfeed.cesnet.cz/reports/702?lang=enpgAdmin 4 version 9.10 fixes 4 vulnerabilities, one of them critical. Vulnerabilities: pdAdmin 4 - intro, pgAdmin 4 - RCE (CVE-2025-12762, CVSS 9.1), pgAdmin 4 - TLS certificate bypass, MITM (CVE-2025-12765, CVSS 7.5), pgAdmin 4 - DoS (CVE-2025-12764, CVSS 7.5), pgAdmin 4 - command execution (CVE-2025-12763, CVSS 6.8)https://cyberfeed.cesnet.cz/reports/702?lang=enhttps://cyberfeed.cesnet.cz/reports/701?lang=enOpenPrinting fixes 2 lower-severity vulnerabilities in components of the CUPS printing system (libcupsfilters, cups-filters). The fixes are available as commits, a list of which can be found at. Fixed versions are not available for the stable releases of common Linux distributions such as Debian, Ubuntu or SUSE. Vulnerabilities: CUPS - intro, libcupsfilters, cups-filters - out-of-bounds read/write (CVE-2025-57812, CVSS 3.7), libcupsfilters, cups-filters - process crash (CVE-2025-64503, CVSS 4.0)https://cyberfeed.cesnet.cz/reports/701?lang=enhttps://cyberfeed.cesnet.cz/reports/700?lang=enWith versions 25.1.2 and 25.2.1, Cisco fixes 3 vulnerabilities in Cisco IOS XR. The vulnerability CVE-2025-20159 affects the devices listed in, and after the update the recommended configuration checks must be performed according to this source. Vulnerabilities: Cisco Intro - Test, Cisco IOS XR - DoS (CVE-2025-20340) - Test Report (CVSS 7.4), Cisco IOS XR - Signature Verification Bypass - Test Report (CVSS 6.0), Cisco IOS XR (CVE-2025-20159) - ACL Bypass - Test Report (CVSS 5.3)https://cyberfeed.cesnet.cz/reports/700?lang=enhttps://cyberfeed.cesnet.cz/reports/699?lang=enSamba versions 4.23.2, 4.22.5 and 4.21.9 fix 2 vulnerabilities, one of them critical. Vulnerabilities: Samba - command injection (CVE-2025-10230, CVSS 10.0), Samba - sensitive data leak (CVE-2025-9640, CVSS 4.3), Samba - introhttps://cyberfeed.cesnet.cz/reports/699?lang=enhttps://cyberfeed.cesnet.cz/reports/697?lang=enCisco fixes 5 vulnerabilities in the Cisco Catalyst Center product with versions 2.3.7.10 and 2.3.7.10-VA. The most serious of them are described below; the remaining ones can be found at. Vulnerabilities: Cisco Catalyst Center - intro, Cisco Catalyst Center Virtual Appliance - privilege escalation (CVE-2025-20341, CVSS 8.8), Cisco Catalyst Center - command execution (CVE-2025-20349, CVSS 6.3), Cisco Catalyst Center - XSS (CVE-2025-20353, CVSS 6.1)https://cyberfeed.cesnet.cz/reports/697?lang=enhttps://cyberfeed.cesnet.cz/reports/696?lang=enPalo Alto Networks is fixing a vulnerability in PAN-OS. Individual fixed versions by branch: 11.2 PAN-OS: 11.2.2-h2, 11.2.3-h6, 11.2.4-h4, 11.2.5 11.1 PAN-OS: 11.1.2-h18, 11.1.3-h2, 11.1.4-h13, 11.1.6-h1, 11.1.7 10.2 PAN-OS: 10.2.4-h25, 10.2.7-h24, 10.2.8-h21, 10.2.9-h21, 10.2.10-h14, 10.2.11-h12, 10.2.12-h6, 10.2.13-h3 and 10.2.14 Vulnerabilities: Palo Alto Networks PAN-OS - DoS (CVE-2025-4619, CVSS 6.6), Palo Alto Networks - introhttps://cyberfeed.cesnet.cz/reports/696?lang=enhttps://cyberfeed.cesnet.cz/reports/695?lang=enIvanti version 2024 SU4 fixes a high-severity vulnerability in the Ivanti Endpoint Manager product. Vulnerabilities: Ivanti Endpoint Manager - arbitrary file write (CVE-2025-10918, CVSS 7.1), Ivanti Endpoint Manager - introhttps://cyberfeed.cesnet.cz/reports/695?lang=enhttps://cyberfeed.cesnet.cz/reports/694?lang=enWith versions 18.5.2, 18.4.4 and 18.3.6, GitLab fixes 9 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE). The most serious vulnerabilities are listed below. Vulnerabilities: GitLab CE/EE - XSS (CVE-2025-11224, CVSS 7.7), GitLab CE/EE - unauthorized access (CVE-2025-11865, CVSS 6.5), GitLab CE/EE - information disclosure (CVE-2025-11865, CVSS 4.3), GitLab CE/EE - introhttps://cyberfeed.cesnet.cz/reports/694?lang=enhttps://cyberfeed.cesnet.cz/reports/693?lang=enWith versions 18.5.2, 18.4.4 and 18.3.6, GitLab fixes 9 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE). The most serious vulnerabilities are listed below. Vulnerabilities: GitLab CE/EE - XSS (CVE-2025-11224, CVSS 7.7), GitLab CE/EE - unauthorized access (CVE-2025-11865, CVSS 6.5), GitLab CE/EE - information disclosure (CVE-2025-11865, CVSS 4.3), GitLab CE/EE - introhttps://cyberfeed.cesnet.cz/reports/693?lang=enhttps://cyberfeed.cesnet.cz/reports/692?lang=enElastic fixes 3 vulnerabilities in its products. Products and their fixed versions: Elastic Cloud Enterprise - 3.8.3, 4.0.3 Elastic Defend - 8.19.6, 9.1.6, 9.2.0 Kibana - 8.19.7, 9.1.7, 9.2.1 Vulnerabilities: Elastic - intro, Elastic Cloud Enterprise - privilege escalation (CVE-2025-37736, CVSS 8.8), Elastic Defend - privilege escalation (CVE-2025-37735, CVSS 7.0), Elastic Kibana - SSRF (CVE-2025-37734, CVSS 4.3)https://cyberfeed.cesnet.cz/reports/692?lang=enhttps://cyberfeed.cesnet.cz/reports/691?lang=enGoogle fixes a high-severity vulnerability in the Google Chrome browser and other browsers based on the Chromium engine. The fix has been released for Windows (version 142.0.7444.162/.163) and macOS (142.0.7444.162); the version for Linux (142.0.7444.162) will be released in the coming days. A fix for the Microsoft Edge browser is not yet available. Details of the vulnerability have not yet been published, probably in line with responsible disclosure principles. Vulnerabilities: Google Chrome - intro, Google Chrome - RCE, memory corruption, application crash (CVE-2025-13042, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/691?lang=enhttps://cyberfeed.cesnet.cz/reports/690?lang=enQNAP fixes 27 vulnerabilities in various products. Selected vulnerabilities are described below; the remaining ones can be found at by clicking on the individual advisories. Products and their fixed versions: Hyper Data Protector - 2.2.4.1 HBS 3 Hybrid Backup Sync - 26.2.0.938 QTS - 5.2.7.3297 build 20251024 QuTS hero - h5.2.7.3297 build 20251024, h5.3.1.3292 build 20251024 Malware Remover - 6.6.8.20251023 QuMagie - 2.7.0, 2.7.3 QuLog Center - 1.8.2.923 Notification Center - 1.9.2.3163, 2.1.0.3443, 3.0.0.3466 Qsync Central - 5.0.0.3 Download Station - 5.10.0.304, 5.10.0.305 File Station 5 - 5.5.6.5018 Vulnerabilities: QNAP - intro, QuMagie - RCE (CVE-2025-52425, CVSS 9.5), QuMagie - system data read (CVE-2025-58464, CVSS 7.8), Notification Center - application data read (CVE-2025-54167, CVSS 7.2)https://cyberfeed.cesnet.cz/reports/690?lang=enhttps://cyberfeed.cesnet.cz/reports/689?lang=enApple fixes 110 vulnerabilities in its products. Selected ones can be found below; the remaining ones are described on the vendor's pages and in a clear table at. Products and their fixed versions: iOS - 26.1, 18.7.2 iPadOS - 26.1, 18.7.2 macOS - Tahoe 26.1, Sequoia 15.7.2, Sonoma 14.8.2 tvOS - 26.1 watchOS - 26.1 visionOS - 26.1 Safari - 26.1 Xcode - 26.1 Vulnerabilities: Apple - intro, Apple iOS, iPadOS, macOS Tahoe, watchOS, tvOS, visionOS, Safari - memory corruption (CVE-2025-43431, CVSS 8.8), Apple iOS, iPadOS, watchOS, tvOS, visionOS - kernel memory corruption (CVE-2025-43462, CVSS 7.5), Apple iOS, iPadOS, macOS Sonoma, watchOS, tvOS, visionOS - (CVE-2025-43372, CVSS 7.8), Apple iOS, iPadOS, macOS Tahoe, macOS Sonoma, macOS Sequoia, tvOS, visionOS - sandbox escape (CVE-2025-43407, CVSS 7.8), Apple macOS Tahoe, macOS Sonoma, macOS Sequoia - privilege escalation (CVE-2025-43472, CVSS 7.8)https://cyberfeed.cesnet.cz/reports/689?lang=enhttps://cyberfeed.cesnet.cz/reports/688?lang=enCisco fixes 13 vulnerabilities in its products. The most serious of them are listed below; the remaining ones can be found at by clicking on the individual advisories. Products and their fixed versions: Cisco Secure Firewall ASA Software - 9.12.4.72, 9.14.4.28 Cisco Unified Contact Center Express - 12.5 SU3 ES07, 15.0 ES01 Cisco Identity Services Engine - 3.2 Patch 8, 3.3 Patch 8, 3.4 Patch 4 Cisco Unified Intelligence Center - 15.0(01) ES202508 The availability of a fix for Cisco Secure Firewall FTD Software can be verified using the Cisco Software Checker tool. The previously reported vulnerabilities CVE-2025-20333 and CVE-2025-20362 in Cisco Secure ASA and Cisco Secure FTD software can now, through a newly discovered attack variant, be exploited to carry out a DoS attack. Vulnerabilities: Cisco Unified CCX - arbitrary command execution (CVE-2025-20354, CVSS 9.8), Cisco Unified CCX Editor - arbitrary scripts execution (CVE-2025-20358, CVSS 9.4), Cisco Identity Services Engine - DoS (CVE-2025-20343, CVSS 8.6), Cisco - introhttps://cyberfeed.cesnet.cz/reports/688?lang=enhttps://cyberfeed.cesnet.cz/reports/687?lang=enGitLab is releasing versions 18.2.2, 18.1.4 and 18.0.6 for GitLab Community Edition (CE) and Enterprise Edition (EE), which fix 12 vulnerabilities. The most serious of them are described below, the rest can be found at. Vulnerabilities: Gitlab test - intro, Gitlab CE/EE - XSS (CVE-2025-7734) - test report (CVSS 8.7), GitLab CE/EE - XSS (CVE-2025-6186) - test report (CVSS 8.7), GitLab CE/EE - XSS (CVE-2025-7739) - test report (CVSS 8.7), GitLab CE/EE - DoS (CVE-2025-8094) - test report (CVSS 7.7), GitLab CE/EE - incorrect privilege assignment (CVE-2024-12303) - report test (CVSS 6.7)https://cyberfeed.cesnet.cz/reports/687?lang=enhttps://cyberfeed.cesnet.cz/reports/686?lang=ensecurity researchers from Arctic Wolf Labs warn of a new wave of cyber attacks actively targeting European organizations, including government and diplomatic targets, and exploiting a yet unpatched vulnerability in Microsoft Windows designated CVE-2025-9491. As Microsoft has not yet released an official patch, it is recommended to limit the use of .LNK files from untrusted sources and to block connections to the C2 infrastructure identified by the company. Vulnerabilities: Microsoft Windows - intro, Microsoft Windows - RCE (CVE-2025-9491, CVSS 7.5)https://cyberfeed.cesnet.cz/reports/686?lang=enhttps://cyberfeed.cesnet.cz/reports/685?lang=enDocker Compose version 2.40.2 fixes 1 vulnerability. A PoC can be found at. Vulnerabilities: Docker Compose - intro, Docker Compose - arbitrary file write (CVE-2025-62725, CVSS 8.9)https://cyberfeed.cesnet.cz/reports/685?lang=enhttps://cyberfeed.cesnet.cz/reports/683?lang=enX.Org X server versions 21.1.19 and Xwayland versions 24.1.9 fix 3 vulnerabilities. The fixes are also available in commits, a list of which can be found at. Among operating systems, a fix was released by Slackware within SSA:2025-302-01, and by Debian for bullseye in version 2:1.20.11-1+deb11u17, bookworm in version 2:21.1.7-3+deb12u11 and trixie in version 2:21.1.16-1.3+deb13u1 (xorg-server). Gentoo fixed the vulnerabilities in versions 21.1.20 for xorg-server and 24.1.9 for xwayland. Individual Ubuntu releases (packages in the order xorg-server and xwayland) and fixed product versions: questing - 2:21.1.18-1ubuntu1.1 and 2:24.1.6-1ubuntu1.1; plucky - 2:21.1.16-1ubuntu1.2 and 2:24.1.6-1ubuntu0.2; noble - 2:21.1.12-1ubuntu1.5 and 2:23.2.6-1ubuntu0.7; jammy - 2:21.1.4-2ubuntu1.7~22.04.16 and 2:22.1.1-1ubuntu0.20. Vulnerabilities: X.Org X server and Xwayland - intro, X.Org X server and Xwayland - use-after-free (CVE-2025-62229, CVSS 7.5), X.Org X server and Xwayland - use-after-free (CVE-2025-62230, CVSS 8.1), X.Org X server and Xwayland - memory corruption, DoS (CVE-2025-62231, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/683?lang=enhttps://cyberfeed.cesnet.cz/reports/682?lang=enApache Tomcat versions 11.0.12, 10.1.47 and 9.0.110 fix 3 vulnerabilities. For the stable Debian release, security fixes were issued only in the tomcat9 package in version 9.0.107-0+deb11u1 for bullseye (security) and in version 9.0.70-2 for bookworm. Red Hat and Ubuntu have not yet provided fixes, or their releases are not affected by the vulnerabilities. Gentoo has fixed versions available as testing for the most common architectures. Vulnerabilities: Apache Tomcat - intro, Apache Tomcat - console manipulation, command execution (CVE-2025-55754, CVSS 9.6), Apache Tomcat - remote code execution (CVE-2025-55752, CVSS 7.5), Apache Tomcat - DoS (CVE-2025-61795, CVSS 5.3)https://cyberfeed.cesnet.cz/reports/682?lang=enhttps://cyberfeed.cesnet.cz/reports/681?lang=enWith versions 18.5.1, 18.4.3 and 18.3.5, GitLab fixes 7 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE). The most serious vulnerabilities are listed below. Vulnerabilities: GitLab EE - improper access control (CVE-2025-11702, CVSS 8.5), GitLab CE/EE - DoS (CVE-2025-10497, CVSS 7.5), GitLab CE/EE - DoS (CVE-2025-11447, CVSS 7.5), GitLab CE/EE - introhttps://cyberfeed.cesnet.cz/reports/681?lang=enhttps://cyberfeed.cesnet.cz/reports/680?lang=enUbiquiti version 4.0.21 fixes 1 vulnerability in the UniFi Access Application product. Vulnerabilities: Ubiquiti UniFi Access Application - intro, UniFi Access Application - authentication bypass (CVE-2025-52665, CVSS 10.0)https://cyberfeed.cesnet.cz/reports/680?lang=enhttps://cyberfeed.cesnet.cz/reports/679?lang=enMicrosoft Windows Server is fixing a critical vulnerability. Vulnerabilities: Microsoft Windows Server - RCE (CVE-2025-59287, CVSS 9.8), Microsoft Windows Server - introhttps://cyberfeed.cesnet.cz/reports/679?lang=enhttps://cyberfeed.cesnet.cz/reports/678?lang=enWith version 2.0.1, MongoDB Atlas ODBC fixes a high-severity vulnerability. Vulnerabilities: MongoDB Atlas ODBC - privilege escalation (CVE-2025-11575, CVSS 8.8), MongoDB Atlas ODBC - introhttps://cyberfeed.cesnet.cz/reports/678?lang=enhttps://cyberfeed.cesnet.cz/reports/677?lang=enSolarWinds version 2025.4 fixes 1 vulnerability in SolarWinds Observability Self-Hosted. Vulnerabilities: SolarWinds - intro, SolarWinds Observability Self-Hosted - SQL injection (CVE-2025-26392, CVSS 5.4)https://cyberfeed.cesnet.cz/reports/677?lang=enhttps://cyberfeed.cesnet.cz/reports/676?lang=enMoodle versions 5.0.3, 4.5.7, 4.4.11 and 4.1.21 fix 10 vulnerabilities. The most severe ones are described below, the rest can be found at. Vulnerabilities: Moodle - intro, Moodle - MFA bypass (CVE-2025-62398, CVSS 5.4), Moodle - DoS (CVE-2025-54869, CVSS 6.0), Moodle - password bruteforce (CVE-2025-62399, CVSS 7.5), Moodle - privacy exposure (CVE-2025-62400, CVSS 6.5), Moodle - misconfigured headers (CVE-2025-62396, CVSS 5.3)https://cyberfeed.cesnet.cz/reports/676?lang=enhttps://cyberfeed.cesnet.cz/reports/675?lang=enWith version 5.41, Zyxel fixes 2 vulnerabilities in Zyxel ZLD (firewall firmware). The specifically affected firewall series are ATP, USG FLEX, USG FLEX 50(W) and USG20(W)-VPN. Vulnerabilities: Zyxel ZLD (Firewall) - command injection (CVE-2025-8078, CVSS 7.2), Zyxel ZLD (Firewall) - configuration leak (CVE-2025-9133, CVSS 6.5), Zyxel ZLD - introhttps://cyberfeed.cesnet.cz/reports/675?lang=enhttps://cyberfeed.cesnet.cz/reports/674?lang=enSpring is fixing 2 vulnerabilities in 2 products. Individual products and their fixed versions: Spring STOMP - 6.2.12, 6.1.24, 5.3.46 Spring Cloud Gateway Server Webflux - 4.3.2, 4.2.6, 4.1.12, 3.1.12 Vulnerabilities: Spring STOMP - CSRF (CVE-2025-41254, CVSS 4.3), Spring Cloud Gateway Server Webflux - sensitive information leak (CVE-2025-41253, CVSS 7.5), Spring - introhttps://cyberfeed.cesnet.cz/reports/674?lang=enhttps://cyberfeed.cesnet.cz/reports/673?lang=enSpring is fixing 2 vulnerabilities in 2 products. Individual products and their fixed versions: Spring STOMP - 6.2.12, 6.1.24, 5.3.46 Spring Cloud Gateway Server Webflux - 4.3.2, 4.2.6, 4.1.12, 3.1.12 Vulnerabilities: Spring STOMP - CSRF (CVE-2025-41254, CVSS 4.3), Spring Cloud Gateway Server Webflux - sensitive information leak (CVE-2025-41253, CVSS 7.5), Spring - introhttps://cyberfeed.cesnet.cz/reports/673?lang=enhttps://cyberfeed.cesnet.cz/reports/672?lang=enCisco fixes 7 vulnerabilities in its products. The most severe ones are listed below, the remaining ones can be found at. Products and their fixed versions: Cisco SIP Software - 3.3(1), 11.0(6)SR7, 14.4(1) Cisco TelePresence CE and RoomOS - 11.32.2.1 The availability of a fix for Cisco IOS XE Software, Cisco Secure Firewall ASA, Secure FMC and Secure FTD Software can be verified using the Cisco Software Checker tool. Vulnerabilities: Cisco - intro, Cisco Session Initiation Protocol (SIP) Software - DoS (CVE-2025-20350, CVSS 7.5), Cisco IOS XE - code execution (CVE-2025-20313, CVE-2025-20314, CVSS 6.7), Cisco Session Initiation Protocol (SIP) Software - XSS (CVE-2025-20351, CVSS 6.1)https://cyberfeed.cesnet.cz/reports/672?lang=enhttps://cyberfeed.cesnet.cz/reports/671?lang=enFortinet warns of 3 vulnerabilities in FortiDLP, which can be mitigated by updating to versions 12.1 and 6.0. Vulnerabilities: Fortinet FortiDLP - sensitive information leak (CVE-2025-46752, CVSS 4.4), Fortinet FortiDLP - email information leak (CVE-2025-53950, CVSS 5.5), Fortinet FortiDLP - privilege escalation (CVE-2025-53951, CVE-2025-54658, CVSS 7.8), Fortinet FortiDLP - introhttps://cyberfeed.cesnet.cz/reports/671?lang=enhttps://cyberfeed.cesnet.cz/reports/670?lang=enF5 fixes 44 vulnerabilities in its products. The most severe ones are listed below, the remaining ones can be found at, including detailed information on fixed versions. Vulnerabilities: F5 - intro, F5 BIG-IP - restrictions bypass (CVE-2025-53868, CVSS 8.7), F5 F5OS-A, F5OS-C - arbitrary command execution (CVE-2025-61955, CVSS 8.8), F5 F5OS-A, F5OS-C - arbitrary command execution (CVE-2025-57780, CVSS 8.8), F5 BIG-IP, BIG-IP Next SPK, BIG-IP Next CNF - DoS (CVE-2025-60016, CVSS 7.5), F5 BIG-IP Next SPK, BIG-IP Next CNF, BIG-IP Next for Kubernetes - DoS (CVE-2025-58120, CVSS 7.5)https://cyberfeed.cesnet.cz/reports/670?lang=enhttps://cyberfeed.cesnet.cz/reports/669?lang=enWith versions 10.7.2.1,10.4.1.9, 8.13.1.0, 8.12.0.6 and 8.10.0.19, HPE Aruba fixes 17 vulnerabilities in Access Points, Mobility Conductors, Mobility Controllers and WLAN and SD-WAN Gateways (AOS-10 and AOS-8). The most serious vulnerabilities are listed below. As a temporary fix for some of the vulnerabilities, the web and command-line interfaces can be restricted to trusted users only. Vulnerabilities: Aruba AOS - command execution (CVE-2025-37132, CVSS 7.2), Aruba AOS - command injection (CVE-2025-37133, CVSS 7.2), Aruba AOS - command injection (CVE-2025-37134, CVSS 7.2), Aruba AOS - secure boot bypass (CVE-2025-37147, CVSS 7.1), Aruba AOS - introhttps://cyberfeed.cesnet.cz/reports/669?lang=enhttps://cyberfeed.cesnet.cz/reports/668?lang=enWith versions 10.7.2.1,10.4.1.9, 8.13.1.0, 8.12.0.6 and 8.10.0.19, HPE Aruba fixes 17 vulnerabilities in Access Points, Mobility Conductors, Mobility Controllers and WLAN and SD-WAN Gateways (AOS-10 and AOS-8). The most serious vulnerabilities are listed below. As a temporary fix for some of the vulnerabilities, the web and command-line interfaces can be restricted to trusted users only. Vulnerabilities: Aruba AOS - command execution (CVE-2025-37132, CVSS 7.2), Aruba AOS - command injection (CVE-2025-37133, CVSS 7.2), Aruba AOS - command injection (CVE-2025-37134, CVSS 7.2), Aruba AOS - secure boot bypass (CVE-2025-37147, CVSS 7.1), Aruba AOS - introhttps://cyberfeed.cesnet.cz/reports/668?lang=enhttps://cyberfeed.cesnet.cz/reports/667?lang=enMicrosoft fixes 2 vulnerabilities in SharePoint. Products and their fixes: Microsoft SharePoint Server Subscription Edition - 16.0.19127.20262 Microsoft SharePoint Server 2019 - 16.0.10417.20059 Microsoft SharePoint Enterprise Server 2016 - 16.0.5522.1000 Vulnerabilities: Microsoft SharePoint - RCE (CVE-2025-59228, CVSS 8.8), Microsoft SharePoint - RCE (CVE-2025-59237, CVSS 8.8), Microsoft SharePoint - introhttps://cyberfeed.cesnet.cz/reports/667?lang=enhttps://cyberfeed.cesnet.cz/reports/666?lang=enIvanti warns of 13 vulnerabilities in Ivanti Endpoint Manager. Fixes will be released in versions 2024 SU4 (12 November 2025) and 2024 SU5 (Q1 2026). For mitigation or a temporary workaround, follow. Vulnerabilities: Ivanti Endpoint Manager - intro, Ivanti Endpoint Manager - RCE (CVE-2025-9713, CVSS 8.8), Ivanti Endpoint Manager - privilege escalation (CVE-2025-11622, CVSS 7.8), Ivanti Endpoint Manager - SQL injection (CVE-2025-11623, CVE-2025-62392, CVE-2025-62390, CVE-2025-62389, CVE-2025-62388, CVE-2025-62387, CVE-2025-62385, CVE-2025-62391, CVE-2025-62383, CVE-2025-62386, CVE-2025-62384, CVSS 6.5)https://cyberfeed.cesnet.cz/reports/666?lang=enhttps://cyberfeed.cesnet.cz/reports/665?lang=enVulnerabilities: Juniper - introhttps://cyberfeed.cesnet.cz/reports/665?lang=enhttps://cyberfeed.cesnet.cz/reports/664?lang=enElastic versions 8.18.8, 8.19.5, 9.0.8 and 9.1.5 fix 2 vulnerabilities in Kibana. Vulnerabilities: Elastic Kibana - intro, Elastic Kibana - XSS (CVE-2025-25018, CVSS 8.7), Elastic Kibana - XSS (CVE-2025-25017, CVSS 8.2)https://cyberfeed.cesnet.cz/reports/664?lang=enhttps://cyberfeed.cesnet.cz/reports/663?lang=enOracle is fixing a critical vulnerability in Oracle E-Business Suite. To fix the vulnerability, it is necessary to make sure that the October 2023 critical patch has been applied and then update to the latest version. Vulnerabilities: Oracle E-Business Suite - RCE (CVE-2025-61882, CVSS 9.8), Oracle E-Business Suite - introhttps://cyberfeed.cesnet.cz/reports/663?lang=enhttps://cyberfeed.cesnet.cz/reports/662?lang=enXWiki Platform versions 16.10.9, 17.5.0 and 17.4.2 and OIDC Authenticator for XWiki version 2.18.2 fix 2 vulnerabilities. Vulnerabilities: XWiki - intro, XWiki - HQL injection (CVE-2025-52472, CVSS 9.3), XWiki - authentication bypass (CVE-2025-49594, CVSS 9.2)https://cyberfeed.cesnet.cz/reports/662?lang=enhttps://cyberfeed.cesnet.cz/reports/661?lang=enDebian has released a fix for a vulnerability in the Dovecot software package (IMAP and POP3 server). The fix is available for the trixie (security) release in version 1:2.4.1+dfsg1-6+deb13u1. Older Debian versions, such as bullseye and bookworm, were not affected by this vulnerability. Vulnerabilities: Dovecot - intro, Dovecot - cache key collision (CVE-2025-30189, CVSS 7.4)https://cyberfeed.cesnet.cz/reports/661?lang=enhttps://cyberfeed.cesnet.cz/reports/660?lang=enThe SSO (OAuth Client) plugin for WordPress version 6.26.13 fixes one vulnerability. Vulnerabilities: SSO (OAuth Client) plugin - intro, SSO (OAuth Client) plugin - authentication bypass (CVE-2025-9485, CVSS 9.8)https://cyberfeed.cesnet.cz/reports/660?lang=enhttps://cyberfeed.cesnet.cz/reports/659?lang=enQNAP fixes 46 vulnerabilities in various products, the most severe of which are described below. The remaining ones can be found at by clicking through the individual advisories. Products and their fixed versions: NetBak Replicator - 4.5.15.0807 Qsync Central - Qsync Central 5.0.0.2, 5.0.0.1 Video Station - 5.8.4 QNAP Authenticator - 1.3.1.1227 QTS - 5.2.6.3195 build 20250715 QuTS hero - h5.2.6.3195 build 20250715 Vulnerabilities: QNAP - intro, NetBak Replicator - code or command execution (CVE-2025-57714, CVSS 8.5), Qsync Central - DoS (CVE-2025-44012, CVSS 7.1), Qsync Central - SQL injection (CVE-2025-53595,CVE-2025-54153, CVSS 8.6), Qsync Central - memory corruption (CVE-2025-44014, CVSS 7.1), QTS, QuTS hero - data read (CVE-2025-47211, CVSS 6.9)https://cyberfeed.cesnet.cz/reports/659?lang=enhttps://cyberfeed.cesnet.cz/reports/658?lang=enWith versions 3.5.4, 3.4.3, 3.3.5, 3.2.6, 3.0.18, 1.1.1zd and 1.0.2zm, OpenSSL fixes 3 vulnerabilities. Vulnerabilities: OpenSSL - out-of-bounds read/write (CVE-2025-9230, CVSS 9.8), OpenSSL - private key recovery (CVE-2025-9231, CVSS 5.9), OpenSSL - out-of-bound read (CVE-2025-9232, CVSS 5.9), OpenSSL - introhttps://cyberfeed.cesnet.cz/reports/658?lang=enhttps://cyberfeed.cesnet.cz/reports/657?lang=enSplunk fixes 6 vulnerabilities in Splunk Enterprise with versions 10.0.1, 9.4.4, 9.3.6 and 9.2.8. These versions also include fixes for third-party packages. The most severe vulnerabilities are described below. Vulnerabilities: Splunk Enterprise - SSRF (CVE-2025-20371, CVSS 7.5), Splunk Enterprise - Improper Access Control (CVE-2025-20366, CVSS 6.5), Splunk Enterprise - introhttps://cyberfeed.cesnet.cz/reports/657?lang=enhttps://cyberfeed.cesnet.cz/reports/656?lang=enCisco fixes 5 vulnerabilities in various products. Products and their fixed versions: Cisco Cyber Vision Center - 5.3 Cisco Unified Communications Manager - 15SU3 Cisco Unified Communications Manager Session Management Edition - 15SU3 The availability of a fix for Cisco IOS and IOS XE Software can be verified using the Cisco Software Checker tool. Vulnerabilities: Cisco - intro, Cisco IOS, IOS XE - DoS (CVE-2025-20352, CVSS 7.7), Cisco IOS XE - DoS (CVE-2025-20311, CVSS 7.4), Cisco Cyber Vision Center - stored XSS (CVE-2025-20356, CVE-2025-20357, CVSS 5.4), Cisco Unified Communications Manager and Unified Communications Manager Session Management Edition - stored XSS (CVE-2025-20361, CVSS 4.8)https://cyberfeed.cesnet.cz/reports/656?lang=enhttps://cyberfeed.cesnet.cz/reports/655?lang=enAcronis fixes 2 vulnerabilities in Acronis True Image. Products and their fixed versions: Acronis True Image (MacOS) - 42389 Acronis True Image (MacOS, SanDisk) - 42198 Acronis True Image (MacOS, Western Digital) - 42197 Acronis True Image (Windows) - 42386 Vulnerabilities: Acronis True Image - privilege escalation (CVE-2025-7779, CVSS 8.8), Acronis True Image - privilege escalation (CVE-2025-11178, CVSS 7.3), Acronis True Image - introhttps://cyberfeed.cesnet.cz/reports/655?lang=enhttps://cyberfeed.cesnet.cz/reports/654?lang=enVMware fixes 6 vulnerabilities in multiple products. The vulnerability CVE-2025-41244 is already being actively exploited, and a PoC can be found at. Products and their fixes: VMware Aria Operations - 8.18.5 VMware Cloud Foundation - 9.0.1.0, 13.0.5.0 VMware vSphere Foundation - 9.0.1.0, 13.0.5.0 VMware Tools - 13.0.5, 12.5.4 VMware Telco Cloud Platform - 8.18.5 VMware Telco Cloud Infrastructure - 8.18.5 VMware vCenter - 7.0 U3w, 8.0 U3g VMware NSX - 4.1.2.7, 4.2.2.2, 4.2.3.1 VMware NSX-T - 3.2.4.3 The remediation procedure for products within the cloud platforms VMware Cloud Foundation, Telco Cloud Platform and Telco Cloud Infrastructure is available at. Vulnerabilities: VMware - intro, VMware Aria Operations and Tools - privilege escalation (CVE-2025-41244, CVSS 7.8), VMware Tools - improper authorisation (CVE-2025-41246, CVSS 7.6), VMware Aria Operations - information disclosure (CVE-2025-41245, CVSS 4.9), VMware vCenter - SMTP header injection (CVE-2025-41250, CVSS 8.5), VMware NSX - brute-force attacks (CVE-2025-41251, CVSS 8.1), VMware NSX - unauthorized access (CVE-2025-41252, CVSS 7.5)https://cyberfeed.cesnet.cz/reports/654?lang=enhttps://cyberfeed.cesnet.cz/reports/653?lang=enWazuh fixes a vulnerability in Wazuh Manager with version 4.11.0. Vulnerabilities: Wazuh Manager - buffer overflow (CVE-2025-59938, CVSS 6.5), Wazuh Manager - introhttps://cyberfeed.cesnet.cz/reports/653?lang=enhttps://cyberfeed.cesnet.cz/reports/652?lang=enGitLab versions 18.4.1, 18.3.3 and 18.2.7 fix 10 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE). The most severe ones are described below, the full list can be found at. Vulnerabilities: GitLab CE/EE - intro, GitLab CE/EE - XSS (CVE-2025-9642, CVSS 8.7), GitLab CE/EE - DoS (CVE-2025-10858, CVSS 7.5), GitLab CE/EE - DoS (CVE-2025-8014, CVSS 7.5), GitLab CE/EE - information disclosure (CVE-2025-9958, CVSS 6.5), GitLab EE - privilege escalation (CVE-2025-7691, CVSS 6.5), GitLab CE/EE - DoS (CVE-2025-11042, CVSS 4.3)https://cyberfeed.cesnet.cz/reports/652?lang=enhttps://cyberfeed.cesnet.cz/reports/651?lang=enCisco fixes 20 vulnerabilities in various products. The most severe ones can be found below. The remaining ones, including the list of vulnerable products, can be found at by clicking through the individual advisories. The vulnerabilities CVE-2025-20333 and CVE-2025-20362 in Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) have been added to CISA's Known Exploited Vulnerabilities catalog. Products and their fixed versions: Cisco ASA Software - 9.12.4.72, 9.14.4.28, 9.16.4.85, 9.18.4.67, 9.20.4.10, 9.22.2.14, 9.23.1.19 Cisco FTD Software - 7.0.8.1, 7.2.10.2, 7.4.2.4, 7.6.2.1, 7.7.10.1 The availability of a fix for Cisco IOS, IOS XE and IOS XR Software can be verified using the Cisco Software Checker tool. Vulnerabilities: Cisco - intro, Cisco Secure Firewall Adaptive Security Appliance (ASA) & Secure Firewall Threat Defense (FTD) Software - RCE (CVE-2025-20333, CVSS 9.9), Cisco Secure Firewall Adaptive Security Appliance (ASA) & Secure Firewall Threat Defense (FTD) Software, Cisco IOS, IOS XE, IOS XR - RCE (CVE-2025-20363, CVSS 9.0), Cisco IOS XE - command injection (CVE-2025-20334, CVSS 8.8), Cisco IOS XE - DoS (CVE-2025-20315, CVSS 8.6), Cisco IOS, IOS XE - authentication bypass (CVE-2025-20160, CVSS 8.1), Cisco Secure Firewall Adaptive Security Appliance (ASA) & Secure Firewall Threat Defense (FTD) Software - unauthorized access (CVE-2025-20362, CVSS 6.5)https://cyberfeed.cesnet.cz/reports/651?lang=enhttps://cyberfeed.cesnet.cz/reports/650?lang=enSolarWinds version 12.8.7 HF1 fixes 1 vulnerability in Web Help Desk. Vulnerabilities: SolarWinds - intro, SolarWinds Web Help Desk - command execution (CVE-2025-26399, CVSS 9.8)https://cyberfeed.cesnet.cz/reports/650?lang=enhttps://cyberfeed.cesnet.cz/reports/649?lang=enVMware fixes 1 vulnerability in Spring Cloud Gateway with versions 4.3.1, 4.2.5, 4.1.11 and 3.1.11. Vulnerabilities: Spring Cloud Gateway - intro, Spring Cloud Gateway - Spring Environment property modification (CVE-2025-41243, CVSS 10.0)https://cyberfeed.cesnet.cz/reports/649?lang=enhttps://cyberfeed.cesnet.cz/reports/648?lang=enJenkins fixes 4 vulnerabilities with versions 2.528 (weekly release) and 2.516.3 (LTS release). Vulnerabilities: Jenkins - intro, Jenkins - DoS (CVE-2025-5115, CVSS 7.5), Jenkins - missing permission check (CVE-2025-59474, CVSS 5.3), Jenkins - missing permission check (CVE-2025-59475, CVSS 4.3), Jenkins - log message injection (CVE-2025-59476, CVSS 5.3)https://cyberfeed.cesnet.cz/reports/648?lang=enhttps://cyberfeed.cesnet.cz/reports/647?lang=enGoogle fixes 4 vulnerabilities in Google Chrome as well as in Chromium-based web browsers. Google has fixed the vulnerabilities in version 140.0.7339.185 for Chrome on Linux (available in the coming days) and in version 140.0.7339.185/.186 for Chrome on Windows/Mac. Microsoft has not yet released a fix for Edge, but is working on it. Further details on these vulnerabilities have not yet been published due to responsible disclosure. Vulnerabilities: Google Chrome - use after free (CVE-2025-10500, CVE-2025-10501, CVSS 8.8), Google Chrome - heap buffer overflow (CVE-2025-10502, CVSS 8.8), Google Chrome - type confusion (CVE-2025-10585, CVSS 8.8), Google Chrome - introhttps://cyberfeed.cesnet.cz/reports/647?lang=enhttps://cyberfeed.cesnet.cz/reports/646?lang=enApple fixes more than 80 vulnerabilities in its products. Selected ones are listed below; the remaining ones are described on the vendor's pages and in the overview table at. Products and their fixed versions: macOS - Tahoe 26, Sequoia 15.7, Sonoma 14.8 iOS - 26, 18.7, 16.7.12, 15.8.5 iPadOS - 26, 18.7, 16.7.12, 15.8.5 tvOS - 26 watchOS - 26 visionOS - 26 Safari - 26 Xcode - 26 Vulnerabilities: Apple - intro, Apple macOS Sequoia, Sonoma, Tahoe, iOS, iPadOS - sandbox restriction bypass (CVE-2025-43358, CVSS 8.8), Apple macOS Sequoia, Sonoma, Tahoe - privilege escalation (CVE-2025-43304, CVSS 7.0), Apple macOS Sequoia, Sonoma, Tahoe - memory corruption (CVE-2025-43353, CVSS 7.1), Apple iOS, iPadOS - information disclosure (CVE-2025-43362, CVSS 7.5)https://cyberfeed.cesnet.cz/reports/646?lang=enhttps://cyberfeed.cesnet.cz/reports/645?lang=enCurl fixes 2 vulnerabilities with version 8.16.0. Vulnerabilities: curl - cookie tampering (CVE-2025-9086, CVSS 7.4), curl - proxy cache poisoning (CVE-2025-10148, CVSS 5.9), curl - introhttps://cyberfeed.cesnet.cz/reports/645?lang=enhttps://cyberfeed.cesnet.cz/reports/644?lang=enAs part of "Patch Tuesday", Microsoft released fixes for 86 vulnerabilities. The most severe ones are described below; the full list is available at or in the SANS overview table. Vulnerabilities: Microsoft - intro, Microsoft High Performance Compute Pack - RCE (CVE-2025-55232, CVSS 9.8), Windows Routing and Remote Access Service - RCE (CVE-2025-54106, CVSS 8.8), Windows Kernel - privilege escalation (CVE-2025-54110, CVSS 8.8), Microsoft SharePoint - RCE (CVE-2025-54897, CVSS 8.8), Microsoft Office - RCE (CVE-2025-54910, CVSS 8.4), Windows NTLM - privilege escalation (CVE-2025-54918, CVSS 8.8), Microsoft SQL Server - privilege escalation (CVE-2025-55227, CVSS 8.8), Windows SMB Server - privilege escalation (CVE-2025-55234, CVSS 8.8), Azure Windows Virtual Machine Agent - privilege escalation (CVE-2025-49692, CVSS 7.8), Windows BitLocker - privilege escalation (CVE-2025-54912, CVSS 7.8)https://cyberfeed.cesnet.cz/reports/644?lang=enhttps://cyberfeed.cesnet.cz/reports/643?lang=enCisco fixes 3 vulnerabilities in Cisco IOS XR with versions 25.1.2 and 25.2.1. For the vulnerability CVE-2025-20159, the specific vulnerable devices and the configuration changes required after the update are listed in. Vulnerabilities: Cisco IOS XR - DoS (CVE-2025-20340, CVSS 7.4), Cisco IOS XR - signature verification bypass (CVE-2025-20248, CVSS 6.0), Cisco IOS XR - ACL bypass (CVE-2025-20159, CVSS 5.3), Cisco - introhttps://cyberfeed.cesnet.cz/reports/643?lang=enhttps://cyberfeed.cesnet.cz/reports/642?lang=enIvanti fixes 13 vulnerabilities in Ivanti Connect Secure, Policy Secure, ZTA Gateways, Neurons for Secure Access and Ivanti Endpoint Manager. The most severe vulnerabilities are described below; the remaining ones can be found at. Products and their fixed versions: Ivanti Connect Secure - 22.7R2.9, 22.8R2 Ivanti Policy Secure - 22.7R1.5 ZTA Gateways - 22.8R2.3-723 Neurons for Secure Access - 22.8R1.4 Ivanti Endpoint Manager - 2022 SU8 Security Release 2, 2024 SU3 Security Release 1 Vulnerabilities: Ivanti - intro, Ivanti Connect Secure, Policy Secure, ZTA Gateways, Neurons for Secure Access - HTML5 connection hijacking (CVE-2025-55145, CVSS 8.9), Ivanti Connect Secure, Policy Secure, ZTA Gateways, Neurons for Secure Access - CSRF (CVE-2025-55147, CVSS 8.8), Ivanti Connect Secure, Policy Secure, ZTA Gateways, Neurons for Secure Access - privilege escalation (CVE-2025-55141, CVE-2025-55142, CVSS 8.8), Ivanti Endpoint Manager - RCE (CVE-2025-9712, CVE-2025-9872, CVSS 8.8), Ivanti Connect Secure, Policy Secure, ZTA Gateways, Neurons for Secure Access - privilege escalation (CVE-2025-55148, CVSS 7.6)https://cyberfeed.cesnet.cz/reports/642?lang=enhttps://cyberfeed.cesnet.cz/reports/641?lang=enNvidia fixes 6 vulnerabilities in various products. Products and their fixed versions: NVIDIA DOCA collectx-clxapidev - 3.0.0, 2.9.3 NVIDIA DOCA collectx-dpserver - 3.0.0, 2.5.4, 2.9.3 BlueField GA - 45.1020 BlueField LTS22 - 35.4554 BlueField LTS23 - 39.5050 BlueField LTS24 - 43.3608 ConnectX GA - 45.1020 ConnectX LTS22 - 35.4554 ConnectX LTS23 - 39.5050 ConnectX LTS24 - 43.3608 ConnectX-4 - 12.28.4704 (published by the end of September) ConnectX-4 LX - 14.32.1908 (published by the end of September) Mellanox DPDK (GA) - 22.11_2504.1.0 Mellanox DPDK (LTS) - 20.11.7.9.0, 22.11_2410.4.0, 22.11_2310.6.0 DPDK (Upstream) - 25.07 DPDK (Upstream LTS) - 24.11.3, 23.11.5, 22.11.10 NVOS NVSwitch - 25.02.42xx NVOS IBSwitch - 25.02.4xxx Cumulus Linux - 5.13, 5.11.0.0026, 5.11.1.1009, 5.9.2.0020, 5.9.0.0032 Vulnerabilities: NVIDIA BlueField - configuration alteration (CVE-2025-23256, CVSS 8.7), NVIDIA DOCA collectx-clxapidev (Debian) - privilege escalation (CVE-2025-23257, CVSS 7.3), NVIDIA DOCA collectx-dpeserver (Debian arm64) - privilege escalation (CVE-2025-23258, CVSS 7.3), NVIDIA ConnectX - configuration alteration (CVE-2025-23262, CVSS 7.6), NVIDIA Mellanox DPDK - DoS, information disclosure (CVE-2025-23259, CVSS 7.6), NVIDIA Cumulus (Linux), NVOS - password hash leak (CVE-2025-23261, CVSS 7.6), NVIDIA - introhttps://cyberfeed.cesnet.cz/reports/641?lang=enhttps://cyberfeed.cesnet.cz/reports/640?lang=enXWiki fixes 1 vulnerability in XWiki Blog Application with version 9.14. Vulnerabilities: XWiki - intro, XWiki - remote code execution (CVE-2025-58365, CVSS 8.7)https://cyberfeed.cesnet.cz/reports/640?lang=enhttps://cyberfeed.cesnet.cz/reports/639?lang=enMongoDB fixes 3 vulnerabilities in MongoDB Server with versions 8.2.0-rc0, 8.1.2, 8.0.12, 7.0.22 and 6.0.25. Vulnerabilities: MongoDB - DoS (CVE-2025-10059, CVSS 6.5), MongoDB - DoS (CVE-2025-10060, CVSS 6.5), MongoDB - DoS (CVE-2025-10061, CVSS 6.5), MongoDB - introhttps://cyberfeed.cesnet.cz/reports/639?lang=enhttps://cyberfeed.cesnet.cz/reports/638?lang=enpgAdmin fixes 1 vulnerability with version 9.8. Vulnerabilities: pgAdmin - intro, pgAdmin - privilege escalation (CVE-2025-9636, CVSS 7.9)https://cyberfeed.cesnet.cz/reports/638?lang=enhttps://cyberfeed.cesnet.cz/reports/637?lang=enCisco fixes 10 vulnerabilities in various products, the most severe of which are described below. The remaining ones, including the list of vulnerable products and available fixes, can be found at by clicking through the individual advisories. Vulnerabilities: Cisco - intro, Cisco Secure Firewall Adaptive Security Appliance (ASA) & Secure Firewall Threat Defense (FTD) Software - DoS (CVE-2025-20127, CVSS 7.7), Cisco Unified Communications Manager IM & Presence Service - XSS (CVE-2025-20330, CVSS 6.1), Cisco Webex Meetings - XSS (CVE-2025-20328, CVSS 5.4)https://cyberfeed.cesnet.cz/reports/637?lang=enhttps://cyberfeed.cesnet.cz/reports/636?lang=enXWiki fixes 3 vulnerabilities with versions 16.4.8, 16.10.7 and 17.4.0-rc-1. Vulnerabilities: XWiki - intro, XWiki - configuration file disclosure (CVE-2025-55747, CVSS 9.3), XWiki - configuration file disclosure (CVE-2025-55748, CVSS 9.3), XWiki - sensitive information disclosure (CVE-2025-58049, CVSS 5.8)https://cyberfeed.cesnet.cz/reports/636?lang=enhttps://cyberfeed.cesnet.cz/reports/635?lang=enElastic fixes a medium-severity vulnerability in the Kibana product with versions 9.1.3 and 9.0.6. Vulnerabilities: Elastic Kibana - intro, Elastic Kibana - privilege escalation (CVE-2025-25010, CVSS 6.5)https://cyberfeed.cesnet.cz/reports/635?lang=enhttps://cyberfeed.cesnet.cz/reports/634?lang=enAcronis fixes 2 vulnerabilities in the Acronis Cyber Protect Cloud Agent product. Fixed versions can be found in the links for the individual vulnerabilities. Vulnerabilities: Acronis Cyber Protect Cloud Agent - intro, Acronis Cyber Protect Cloud Agent - local privilege escalation (CVE-2025-9578, CVSS 7.8), Acronis Cyber Protect Cloud Agent - local privilege escalation (CVE-2025-48963 , CVSS 7.3)https://cyberfeed.cesnet.cz/reports/634?lang=enhttps://cyberfeed.cesnet.cz/reports/633?lang=enPostgreSQL fixes 3 vulnerabilities with versions 17.6, 16.10, 15.14, 14.19, 13.22 and 18 Beta 3. Vulnerabilities: PostgreSQL - intro, PostgreSQL - arbitrary code execution (CVE-2025-8714, CVSS 8.8), PostgreSQL - arbitrary code execution (CVE-2025-8715, CVSS 8.8), PostgreSQL - statistics data exposure (CVE-2025-8713, CVSS 3.1)https://cyberfeed.cesnet.cz/reports/633?lang=enhttps://cyberfeed.cesnet.cz/reports/632?lang=enQNAP fixes 42 vulnerabilities in various products, the most severe of which are described below. The remaining ones can be found at by clicking through the individual advisories. Products and their fixed versions: File Station 5 - 5.5.6.4907 HybridDesk Station - 4.2.18 Legacy VioStor NVR - QVR 5.1.6 build 20250621 License Centre - 1.9.51, 1.8.51 Photo Station - 6.4.5 (2025/01/02) Qsync Central - 4.5.0.7 (2025/04/23) QTS - 5.2.5.3145 build 20250526 QuRouter - 2.5.1.060 QuTS hero - h5.2.5.3138 build 20250519 Vulnerabilities: QNAP - intro, Legacy VioStor NVR QVR - system security compromise (CVE-2025-52856, CVSS 9.3), Qsync Central - system security compromise (CVE-2025-30277, CVE-2025-30278, CVSS 8.3), QTS, QuTS hero - command injection (CVE-2025-30264, CVSS 7.7), Qsync Central - SQL injection (CVE-2025-29893, CVE-2025-29894, CVSS 7.5)https://cyberfeed.cesnet.cz/reports/632?lang=enhttps://cyberfeed.cesnet.cz/reports/631?lang=enGitHub Enterprise Server fixes a high-severity vulnerability with versions 3.14.17, 3.15.12, 3.16.8 and 3.17.5. Vulnerabilities: GitHub Enterprise Server - intro, GitHub Enterprise Server - information disclosure (CVE-2025-8447, CVSS 7.0)https://cyberfeed.cesnet.cz/reports/631?lang=enhttps://cyberfeed.cesnet.cz/reports/630?lang=enRancher fixes a high-severity vulnerability with versions 2.12.1, 2.11.5, 2.10.9 and 2.9.12. Vulnerabilities: Rancher - intro, Rancher - DoS (CVE-2024-58259, CVSS 8.2)https://cyberfeed.cesnet.cz/reports/630?lang=enhttps://cyberfeed.cesnet.cz/reports/629?lang=enGitLab fixes 4 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) with versions 18.3.1, 18.2.5 and 18.1.5. Vulnerabilities: GitLab CE/EE - intro, GitLab CE/EE - DoS (CVE-2025-3601, CVSS 6.5), GitLab CE/EE - sensitive information access (CVE-2025-2246, CVSS 5.8), GitLab CE/EE - DoS (CVE-2025-4225, CVSS 5.3), GitLab CE/EE - code injection (CVE-2025-5101, CVSS 5.0)https://cyberfeed.cesnet.cz/reports/629?lang=enhttps://cyberfeed.cesnet.cz/reports/628?lang=enCisco fixes 15 vulnerabilities in various products, the most severe of which are described below. The remaining ones, including the list of vulnerable products and available fixes, can be found at by clicking through the individual advisories. Vulnerabilities: Cisco - intro, Cisco Nexus 3000/9000 Series Switches - DoS (CVE-2025-20241, CVSS 7.4), Cisco Integrated Management Controller - sensitive information disclosure (CVE-2025-20317, CVSS 7.1), Cisco UCS Manager Software - command injection, privilege escalation (CVE-2025-20294, CVSS 6.5), Cisco Nexus Dashboard - privilege escalation (CVE-2025-20344, CVSS 6.5), Cisco Evolved Programmable Network Manager & Prime Infrastructure - sensitive information disclosure (CVE-2025-20269, CVSS 6.5)https://cyberfeed.cesnet.cz/reports/628?lang=enhttps://cyberfeed.cesnet.cz/reports/627?lang=enGoogle fixes a critical vulnerability in the Cloud Dataform product. Vulnerabilities: Google Cloud Dataform - intro, Google Cloud Dataform - arbitrary file read/write (CVE-2025-9118, CVSS 10.0)https://cyberfeed.cesnet.cz/reports/627?lang=enhttps://cyberfeed.cesnet.cz/reports/626?lang=enCitrix fixes 3 vulnerabilities in its products. The vulnerability CVE-2025-7775 has been added to the CISA Known Exploited Vulnerabilities catalog. Individual products and their fixed versions: NetScaler ADC - 14.1-47.48, 13.1-59.22, 13.1-37.241-FIPS, 13.1-37.241-NDcPP, 12.1-55.330-FIPS, 12.1-55.330-NDcPP NetScaler Gateway - 14.1-47.48, 13.1-59.22 Vulnerabilities: Citrix - intro, Citrix NetScaler ADC, NetScaler Gateway - RCE, DoS (CVE-2025-7775, CVSS 9.2), Citrix NetScaler ADC, NetScaler Gateway - DoS (CVE-2025-7776, CVSS 8.8), Citrix NetScaler ADC, NetScaler Gateway - improper access control (CVE-2025-8424, CVSS 8.7)https://cyberfeed.cesnet.cz/reports/626?lang=enhttps://cyberfeed.cesnet.cz/reports/625?lang=enUbiquiti fixes a vulnerability in Ubiquiti EdgeMAX EdgeSwitch with version 1.11.1. Vulnerabilities: Ubiquiti EdgeMAX EdgeSwitch - command injection (CVE-2025-48978, CVSS 7.5), Ubiquiti EdgeMAX EdgeSwitch - introhttps://cyberfeed.cesnet.cz/reports/625?lang=enhttps://cyberfeed.cesnet.cz/reports/624?lang=enApple fixes a high-severity and actively exploited vulnerability in its products. Products and their fixed versions: iOS - 18.6.2 iPadOS - 18.6.2, 17.7.10 macOS Ventura - 13.7.8 macOS Sonoma - 14.7.8 macOS Sequoia - 15.6.1 Vulnerabilities: Apple iOS, iPadOS, macOS Ventura, macOS Sonoma, macOS Sequoia - memory corruption (CVE-2025-43300, CVSS 8.8), Apple - introhttps://cyberfeed.cesnet.cz/reports/624?lang=enhttps://cyberfeed.cesnet.cz/reports/623?lang=enDocker fixes a vulnerability in Docker Desktop with version 4.44.3. Vulnerabilities: Docker Desktop - container escape (CVE-2025-9074, CVSS 9.3), Docker Desktop - introhttps://cyberfeed.cesnet.cz/reports/623?lang=enhttps://cyberfeed.cesnet.cz/reports/622?lang=enF5 fixes 6 vulnerabilities in its products. The most severe of them are listed below; the remaining ones can be found at. Individual products and their fixed versions: BIG-IP (all modules) - 17.1.2.2, 16.1.6, Hotfix-BIGIP-17.5.1.0.80.7-ENG.iso, Hotfix-BIGIP-17.1.2.2.0.259.12-ENG.iso, Hotfix-BIGIP-16.1.6.0.27.3-ENG.iso; BIG-IP (APM) - 17.1.2.2, 16.1.6; F5 Access for Android - 3.1.2; APM Clients - 7.2.5.3; NGINX Plus - R35, R34 P2, R33 P3, R32 P3; NGINX Open Source - 1.29.1. Detailed information on the fixed versions for the individual vulnerabilities can be found in the overview table at. Vulnerabilities: F5 - intro, F5 BIG-IP - DoS (CVE-2025-52585, CVSS 7.5), F5 BIG-IP - DoS (CVE-2025-46405, CVSS 7.5), F5 Access for Android - data read/modification (CVE-2025-54809, CVSS 7.4), F5 BIG-IP, APM Clients - local privilege escalation (CVE-2025-48500, CVSS 7.3)https://cyberfeed.cesnet.cz/reports/622?lang=enhttps://cyberfeed.cesnet.cz/reports/621?lang=enMozilla fixes 9 vulnerabilities in various products. The most severe vulnerabilities are listed below. Products and their fixed versions: Firefox - 142 Firefox ESR - 140.2, 128.14, 115.27 Thunderbird - 142, 140.2, 128.14 Vulnerabilities: Mozilla Firefox, Firefox ESR, Thunderbird - memory corruption (CVE-2025-9185, CVSS 7.5), Mozilla Firefox, Firefox ESR, Thunderbird - sandbox escape (CVE-2025-9179, CVSS 7.1), Mozilla Firefox, Firefox ESR, Thunderbird - sensitive data leak (CVE-2025-9180, CVSS 7.4), Mozilla Firefox, Firefox ESR, Thunderbird - introhttps://cyberfeed.cesnet.cz/reports/621?lang=enhttps://cyberfeed.cesnet.cz/reports/620?lang=enGitLab versions 18.2.2, 18.1.4, 18.0.6 fix 12 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) products. The most severe of them are described below; the remaining vulnerabilities can be found at. Vulnerabilities: GitLab CE/EE - intro, GitLab CE/EE - XSS (CVE-2025-7734, CVSS 8.7), GitLab CE/EE - XSS (CVE-2025-7739, CVSS 8.7), GitLab CE/EE - XSS (CVE-2025-6186, CVSS 8.7), GitLab CE/EE - DoS (CVE-2025-8094, CVSS 7.7), GitLab CE/EE - incorrect privilege assignment (CVE-2024-12303, CVSS 6.7), GitLab CE/EE - DoS (CVE-2025-2614, CVSS 6.5)https://cyberfeed.cesnet.cz/reports/620?lang=enhttps://cyberfeed.cesnet.cz/reports/619?lang=enFortinet fixes 9 vulnerabilities in its products. The most severe of them are described below; the remaining ones can be found in the individual links. Products and their fixed versions: FortiADC - 7.2.1, 7.1.2 FortiOS - 7.6.3, 7.4.8 FortiPAM - 1.7, 1.6, 1.5.1, 1.4.3 FortiProxy - 7.6.3, 7.4.4 FortiSIEM - 7.3.2, 7.2.6, 7.1.8, 7.0.4, 6.7.10 FortiSOAR - 7.6.2, 7.5.2 FortiWeb - 7.6.4, 7.4.9, 7.2.11, 7.0.11 Vulnerabilities: Fortinet - intro, FortiSIEM - RCE, OS command injection (CVE-2025-25256, CVSS 9.8), FortiWeb - authentication bypass (CVE-2025-52970, CVSS 8.1), FortiOS - privilege escalation (CVE-2025-53744, CVSS 7.2), FortiADC - RCE, OS command injection (CVE-2025-49813, CVSS 7.2)https://cyberfeed.cesnet.cz/reports/619?lang=enhttps://cyberfeed.cesnet.cz/reports/618?lang=enGoogle fixes 6 vulnerabilities in Google Chrome. The fix is available in version 139.0.7258.127/.128 for Windows and macOS. It will also be available in version 139.0.7258.127 for Linux in the coming days/weeks. The most severe vulnerabilities are listed below; the remaining ones can be found at. Vulnerabilities: Google Chrome - intro, Google Chrome - arbitrary code execution (CVE-2025-8879, CVSS 8.8), Google Chrome - arbitrary code execution (CVE-2025-8880, CVSS 8.8), Google Chrome - out of bounds memory access (CVE-2025-8901, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/618?lang=enhttps://cyberfeed.cesnet.cz/reports/617?lang=enCisco reports a critical vulnerability in the Cisco Secure Firewall Management Center (FMC) Software product. The availability of a fix can be verified using the Cisco Software Checker tool, followed by an upgrade to a fixed version according to the Cisco documentation. If an immediate update is not possible, it is recommended, as a temporary risk mitigation, to disable RADIUS authentication and use a different login method. Vulnerabilities: Cisco - intro, Cisco Secure Firewall Management Center Software - RCE (CVE-2025-20265, CVSS 10.0)https://cyberfeed.cesnet.cz/reports/617?lang=enhttps://cyberfeed.cesnet.cz/reports/616?lang=enIvanti fixes 4 vulnerabilities in Ivanti Connect Secure, Policy Secure, ZTA Gateways and Neurons for Secure Access. Products and their fixes: Ivanti Connect Secure - 22.7R2.8, 22.8R2 Ivanti Policy Secure - 22.7R1.5 Ivanti ZTA Gateway - 22.8R2.3-723 Ivanti Neurons for Secure Access - 22.8R1.4 Vulnerabilities: Ivanti - intro, Ivanti Connect Secure, Policy Secure, ZTA Gateway and Neurons for Secure Access - DoS (CVE-2025-5456, CVSS 7.5), Ivanti Connect Secure, Policy Secure, ZTA Gateway and Neurons for Secure Access - (CVE-2025-5462, CVSS 7.5), Ivanti Connect Secure, Policy Secure, ZTA Gateway and Neurons for Secure Access - arbitrary files read (CVE-2025-5468, CVSS 5.5), Ivanti Connect Secure, Policy Secure, ZTA Gateway and Neurons for Secure Access - DoS (CVE-2025-5466, CVSS 4.9)https://cyberfeed.cesnet.cz/reports/616?lang=enhttps://cyberfeed.cesnet.cz/reports/615?lang=enVim version 9.1.1406 fixes 2 vulnerabilities. Vulnerabilities: Vim - intro, Vim - memory corruption (CVE-2025-55157, CVSS 7.3), Vim - memory corruption (CVE-2025-55158, CVSS 7.1)https://cyberfeed.cesnet.cz/reports/615?lang=enhttps://cyberfeed.cesnet.cz/reports/614?lang=enWinRAR version 7.13 fixes a high-severity, actively exploited vulnerability. The vulnerability affects only the Windows version of this tool. Vulnerabilities: WinRAR - intro, WinRAR - RCE (CVE-2025-8088, CVSS 8.6)https://cyberfeed.cesnet.cz/reports/614?lang=enhttps://cyberfeed.cesnet.cz/reports/613?lang=enXWiki versions 16.4.8, 16.10.6 and 17.3.0-rc-1 fix 4 vulnerabilities. Vulnerabilities: XWiki - intro, XWiki - SQL injection (CVE-2025-54385, CVSS 8.6), XWiki - personal information exposure (CVE-2025-54125, CVSS 8.7), XWiki - personal information exposure (CVE-2025-54124, CVSS 7.1), XWiki - XSS (CVE-2025-32430, CVSS 6.5)https://cyberfeed.cesnet.cz/reports/613?lang=enhttps://cyberfeed.cesnet.cz/reports/612?lang=enWebKitGTK and WPE WebKit version 2.48.5 fix 11 vulnerabilities. Selected ones are described below; the remaining ones can be found at. Apple products and their latest fixed versions: macOS - Sequoia 15.6, Sonoma 14.7.7, Ventura 13.7.7 iOS - 18.6 iPadOS - 18.6, 17.7.9 watchOS - 11.6 tvOS - 18.6 visionOS - 2.6 Safari - 18.6 Vulnerabilities: WebKitGTK and WPE WebKit - intro, WebKitGTK and WPE WebKit - memory corruption (CVE-2025-31273, CVE-2025-31278, CVSS 7.1), WebKitGTK and WPE WebKit - sensitive information disclosure (CVE-2025-43227, CVSS 6.5)https://cyberfeed.cesnet.cz/reports/612?lang=enhttps://cyberfeed.cesnet.cz/reports/611?lang=enGitHub fixes 1 vulnerability in GitHub Actions with version 9.0. Vulnerabilities: GitHub Actions - command injection (CVE-2025-54416, CVSS 9.1), GitHub Actions - introhttps://cyberfeed.cesnet.cz/reports/611?lang=enhttps://cyberfeed.cesnet.cz/reports/610?lang=enSolarWinds fixes 2 vulnerabilities in the Observability Self-Hosted and Web Help Desk products. Products and their fixes: SolarWinds Observability Self-Hosted - 2025.2.1 SolarWinds Web Help Desk - 12.8.7 Vulnerabilities: SolarWinds - intro, SolarWinds Observability Self-Hosted - local privilege escalation (CVE-2025-26397, CVSS 7.8), SolarWinds Web Help Desk - XXE (CVE-2025-26400, CVSS 5.3)https://cyberfeed.cesnet.cz/reports/610?lang=enhttps://cyberfeed.cesnet.cz/reports/609?lang=enApple fixes more than 80 vulnerabilities in its products. Selected ones are listed below; the remaining ones are described at. Products and their fixed versions: macOS - Sequoia 15.6, Sonoma 14.7.7, Ventura 13.7.7 iOS - 18.6 iPadOS - 18.6, 17.7.9 watchOS - 11.6 tvOS - 18.6 visionOS - 2.6 Safari - 18.6 Vulnerabilities: Apple - intro, Apple macOS Sequoia, macOS Sonoma, macOS Ventura - protected filesystem modification (CVE-2025-43194, CVSS 9.8), Apple macOS Sequoia, macOS Sonoma - privilege escalation (CVE-2025-43256, CVSS 8.8), Apple macOS Sequoia, Safari, iOS, iPadOS, watchOS, tvOS, visionOS - memory corruption (CVE-2025-31278, CVSS 7.1), Apple iOS, iPadOS - sensitive information disclosure (CVE-2025-31276, CVSS 5.3), Apple macOS Sequoia, macOS Sonoma, macOS Ventura - sensitive information disclosure (CVE-2025-43259, CVSS 4.6)https://cyberfeed.cesnet.cz/reports/609?lang=enhttps://cyberfeed.cesnet.cz/reports/608?lang=enElastic fixes 2 vulnerabilities in the Beats and APM Server products, which occur only when these products are installed on Windows using the Windows Installer. Products and their fixes: Beats - 9.1.0 APM Server - 8.16.3, 8.17.1 Vulnerabilities: Elastic - intro, Beats, APM Server - local privilege escalation (CVE-2025-25011, CVE-2025-0712, CVSS 7.0)https://cyberfeed.cesnet.cz/reports/608?lang=enhttps://cyberfeed.cesnet.cz/reports/607?lang=enXWiki versions 17.3.0-rc-1 and 16.10.6 fix a critical vulnerability. Vulnerabilities: XWiki - intro, XWiki - SQL injection (CVE-2025-32429, CVSS 9.3)https://cyberfeed.cesnet.cz/reports/607?lang=enhttps://cyberfeed.cesnet.cz/reports/606?lang=enPHP fixes 3 vulnerabilities with versions 8.4.10, 8.3.23, 8.2.29 and 8.1.33. Red Hat has not yet released fixes and Debian has released a fix only for the unstable and testing releases. On Gentoo, the fixed versions, except for 8.1.33, are available as testing. Ubuntu releases and their fixed versions: Jammy - 8.1.2-1ubuntu2.22 Noble - 8.3.6-0ubuntu0.24.04.5 Plucky - 8.4.5-1ubuntu1.1 Vulnerabilities: PHP - improper check (CVE-2025-1735, CVSS 5.9), PHP - improper check (CVE-2025-6491, CVSS 5.9), PHP - SSRF (CVE-2025-1220, CVSS 3.7), PHP - introhttps://cyberfeed.cesnet.cz/reports/606?lang=enhttps://cyberfeed.cesnet.cz/reports/604?lang=enVMware fixes 4 vulnerabilities in VMware ESXi, Workstation, Fusion and Tools. Products and their fixes: VMware ESXi - ESXi80U2e-24789317, ESXi80U3f-24784735, ESXi70U3w-24784741 VMware Workstation - 17.6.4 VMware Fusion - 13.6.4 VMware Tools - 13.0.1.0, 12.5.3 (Windows) Vulnerabilities: VMware - intro, VMware ESXi, Workstation and Fusion - code execution (CVE-2025-41236, CVSS 9.3), VMware ESXi, Workstation and Fusion - code execution (CVE-2025-41237, CVSS 9.3), VMware ESXi, Workstation and Fusion - code execution (CVE-2025-41238, CVSS 9.3), VMware ESXi, Workstation, Fusion and Tools - memory leak (CVE-2025-41239, CVSS 7.1)https://cyberfeed.cesnet.cz/reports/604?lang=enhttps://cyberfeed.cesnet.cz/reports/603?lang=enMozilla fixes 21 vulnerabilities. The most severe are listed below. Products and their fixed versions: Firefox - 141 Firefox ESR - 115.26, 128.13, 140.1 Thunderbird - 128.13, 140.1, 141 Vulnerabilities: Mozilla Firefox, Firefox ESR, Thunderbird - data leak (CVE-2025-8027, CVSS 6.5), Mozilla Firefox, Firefox ESR, Thunderbird - memory address miscalculation (CVE-2025-8028, CVSS 8.8), Mozilla Firefox, Firefox ESR, Thunderbird - memory corruption (CVE-2025-8034, CVSS 8.8), Mozilla Firefox, Firefox ESR, Thunderbird - introhttps://cyberfeed.cesnet.cz/reports/603?lang=enhttps://cyberfeed.cesnet.cz/reports/602?lang=enApache HTTP Server version 2.4.65 fixes a medium-severity vulnerability. The fix is also available in commit 8abb3d0. Vulnerabilities: Apache HTTP Server - intro, Apache HTTP Server - security restriction bypass (CVE-2025-54090, CVSS 6.3)https://cyberfeed.cesnet.cz/reports/602?lang=enhttps://cyberfeed.cesnet.cz/reports/601?lang=enGitLab versions 18.2.1, 18.1.3 and 18.0.5 fix 6 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE). The most severe of them are described below; the remaining vulnerabilities can be found at. Vulnerabilities: GitLab CE/EE - intro, GitLab CE/EE - XSS (CVE-2025-4700, CVSS 8.7), GitLab CE/EE - XSS (CVE-2025-4439, CVSS 7.7), GitLab EE - unauthorized access (CVE-2025-4976, CVSS 4.3), GitLab CE/EE - sensitive information disclosure (CVE-2025-7001, CVSS 4.3)https://cyberfeed.cesnet.cz/reports/601?lang=enhttps://cyberfeed.cesnet.cz/reports/600?lang=enFortinet fixes 4 vulnerabilities in its products, with vulnerability CVE-2025-25257 having been added to CISA's Known Exploited Vulnerabilities catalog. Products and their fixes: FortiWeb - 7.6.4, 7.4.8, 7.2.11, 7.0.11 FortiSandbox - 4.4.5, 4.2.7 FortiIsolator - 2.4.5 Forti OS - 7.6.3, 7.4.8, 7.2.12 Vulnerabilities: Fortinet - intro, Fortinet FortiWeb - SQL injection (CVE-2025-25257, CVSS 9.8), Fortinet FortiSandbox, FortiIsolator - improper access control (CVE-2024-27779, CVSS 6.7), Fortinet FortiIsolator - access control bypass (CVE-2024-32124, CVSS 4.3), Fortinet Forti OS - arbitrary code execution (CVE-2025-24477, CVSS 4.2)https://cyberfeed.cesnet.cz/reports/600?lang=enhttps://cyberfeed.cesnet.cz/reports/599?lang=enKubernetes fixes a highly severe vulnerability in Kubernetes Image Builder with version 0.1.45. In addition to updating to the fixed version, the affected digital images must be rebuilt. The procedure for verifying the current version is described at. Vulnerabilities: Kubernetes Image Builder - intro, Kubernetes Image Builder - default credentials access (CVE-2025-7342, CVSS 8.1)https://cyberfeed.cesnet.cz/reports/599?lang=enhttps://cyberfeed.cesnet.cz/reports/598?lang=enGit version 2.50.1 fixes 7 vulnerabilities in the Git tool and in its graphical interfaces Git GUI and Gitk. The most severe of them are listed below. Vulnerabilities: Git - intro, Git - arbitrary code execution (CVE-2025-48384, CVSS 8.0), Git - arbitrary code execution (CVE-2025-48385, CVSS 8.6), Gitk - arbitrary code execution (CVE-2025-27614, CVSS 8.6), Git GUI - arbitrary code execution (CVE-2025-46334, CVSS 8.6)https://cyberfeed.cesnet.cz/reports/598?lang=enhttps://cyberfeed.cesnet.cz/reports/597?lang=enCisco fixes 6 vulnerabilities in various products. The most severe of them can be found below, the remaining ones at. Individual products and their fixed versions: Cisco Identity Services Engine (ISE) - 3.4 Patch 2, 3.3 Patch 7 Cisco ISE Passive Identity Connector (ISE-PIC) - 3.4 Patch 2, 3.3 Patch 7 Cisco Unified Intelligence Center - 12.6(2) ES05, 12.5(1) SU ES05 Cisco Prime Infrastructure - 3.10.6 Security Update 02 Cisco Evolved Programmable Network Manager (EPNM) - 8.1.1, 8.0.1 Vulnerabilities: Cisco - intro, Cisco Identity Services Engine - RCE (CVE-2025-20283, CVE-2025-20284, CVSS 6.5), Cisco Unified Intelligence Center - arbitrary file upload (CVE-2025-20274, CVSS 6.3), Cisco Unified Intelligence Center - SSRF (CVE-2025-20288, CVSS 5.8)https://cyberfeed.cesnet.cz/reports/597?lang=enhttps://cyberfeed.cesnet.cz/reports/596?lang=enGoogle fixes 6 vulnerabilities in Google Chrome, one of which is already being actively exploited. The fix is available in version 138.0.7204.157/.158 for Windows and macOS. In the coming days/weeks it will also be available in version 138.0.7204.157 for Linux. A description of selected vulnerabilities can be found below. Vulnerabilities: Google Chrome - intro, Google Chrome - sandbox escape (CVE-2025-6558, CVSS 8.8), Google Chrome - heap corruption (CVE-2025-7656, CVSS 7.1), Google Chrome - heap corruption (CVE-2025-7657, CVSS 7.1)https://cyberfeed.cesnet.cz/reports/596?lang=enhttps://cyberfeed.cesnet.cz/reports/595?lang=enNVIDIA fixes 2 vulnerabilities in NVIDIA Container Toolkit version 1.17.8 and GPU Operator version 25.3.1. If an update is not possible, the impact of the vulnerability can be mitigated by disabling the 'enable-cuda-compat' hook. Vulnerabilities: NVIDIA Container Toolkit and GPU Operator - intro, NVIDIA Container Toolkit and GPU Operator - privileges escalation, data tampering, information disclosure, DoS (CVE-2025-23266, CVSS 9.0), NVIDIA Container Toolkit and GPU Operator - data tampering, DoS (CVE-2025-23267, CVSS 8.5)https://cyberfeed.cesnet.cz/reports/595?lang=enhttps://cyberfeed.cesnet.cz/reports/594?lang=enJuniper fixes several vulnerabilities in Junos OS and Junos OS Evolved, which concern multiple devices and affect various versions. Details of the vulnerabilities and their fixes can be found at. The most severe of them are described below. Vulnerabilities: Juniper - intro, Juniper Junos OS and Junos OS Evolved - DoS (CVE-2025-52946, CVSS 7.5), Juniper Junos OS - DoS (CVE-2025-52980, CVSS 7.5), Juniper Junos OS Evolved - privilege escalation (CVE-2025-52954, CVSS 7.8), Juniper Junos OS - DoS (CVE-2025-52981, CVSS 7.5)https://cyberfeed.cesnet.cz/reports/594?lang=enhttps://cyberfeed.cesnet.cz/reports/593?lang=enZyxel fixes a critical vulnerability in the firmware of some CPE models. The affected models and the corresponding fixed firmware versions can be found at. Vulnerabilities: Zyxel - intro, Zyxel EMG, EX, VMG, XMG firmware - RCE, DoS (CVE-2025-7673, CVSS 9.8)https://cyberfeed.cesnet.cz/reports/593?lang=enhttps://cyberfeed.cesnet.cz/reports/592?lang=enHPE Aruba Networking fixes 2 vulnerabilities in the HPE Networking Instant On Access Points product. Devices are updated automatically to version 3.2.1.0 or higher during the week of 30 June 2025. A manual upgrade is possible via the app or the web. Vulnerabilities: HPE Networking Instant On Access Points - intro, HPE Networking Instant On Access Points - hardcoded credential exposure (CVE-2025-37103, CVSS 9.8), HPE Networking Instant On Access Points - authenticated command injection (CVE-2025-37102, CVSS 7.2)https://cyberfeed.cesnet.cz/reports/592?lang=enhttps://cyberfeed.cesnet.cz/reports/591?lang=enGitLab versions 18.1.2, 18.0.4 and 17.11.6 fix 4 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE). The most severe of them are described below; the remaining vulnerabilities can be found at. Vulnerabilities: GitLab CE/EE - intro, GitLab CE/EE - XSS (CVE-2025-6948, CVSS 8.7), GitLab CE/EE - restriction bypass (CVE-2025-3396, CVSS 4.3)https://cyberfeed.cesnet.cz/reports/591?lang=enhttps://cyberfeed.cesnet.cz/reports/590?lang=enZyxel fixes a high-severity vulnerability in the firmware of some of its access points (AP). The affected models and the corresponding fixed firmware versions can be found at. Vulnerabilities: Zyxel - intro, Zyxel NWA, WAX, WAC, WBE AP firmware - path traversal (CVE-2025-6265, CVSS 7.2)https://cyberfeed.cesnet.cz/reports/590?lang=enhttps://cyberfeed.cesnet.cz/reports/589?lang=enXWiki versions 13.10.11, 14.4.7 and 14.10 fix two critical vulnerabilities. Vulnerabilities: XWiki - intro, XWiki - XSS (CVE-2025-53835 , CVSS 9.0), XWiki - RCE (CVE-2025-53836, CVSS 9.9)https://cyberfeed.cesnet.cz/reports/589?lang=enhttps://cyberfeed.cesnet.cz/reports/588?lang=enIvanti fixes 11 vulnerabilities in its products. The most severe of them are described below; the remaining ones can be found at. Individual products and their fixed versions: Ivanti Connect Secure (ICS) - 22.7R2.8 Ivanti Policy Secure (IPS) - 22.7R1.5 Ivanti Endpoint Manager (EPM) - 2024 SU3, 2022 SU8 Security Update 1 Ivanti Endpoint Manager Mobile (EPMM) - 12.5.0.2, 12.4.0.3, 12.3.0.3 Vulnerabilities: Ivanti - intro, Ivanti Endpoint Manager - password disclosure (CVE-2025-6995, CVE-2025-6996, CVSS 8.4), Ivanti Endpoint Manager Mobile - OS command injection (CVE-2025-6770, CVE-2025-6771, CVSS 7.2), Ivanti Endpoint Manager - SQL injection (CVE-2025-7037, CVSS 5.5), Ivanti Connect Secure & Policy Secure - CRLF injection (CVE-2025-0293, CVSS 6.6)https://cyberfeed.cesnet.cz/reports/588?lang=enhttps://cyberfeed.cesnet.cz/reports/587?lang=enZimbra Collaboration versions 9.0.0 Patch 46, 10.0.15 and 10.1.9 fix 1 vulnerability. Vulnerabilities: Zimbra Collaboration - intro, Zimbra Collaboration - DoS (CVE-2025-53645, CVSS 7.5)https://cyberfeed.cesnet.cz/reports/587?lang=enhttps://cyberfeed.cesnet.cz/reports/586?lang=enPalo Alto fixes 3 vulnerabilities in 2 products. Products and their fixed versions: Autonomous Digital Experience Manager (macOS) - 5.6.7 GlobalProtect™ App (macOS, Windows) - 6.3.3-h1 (6.3.3-c650), 6.2.8-h2 (6.2.8-c243) GlobalProtect™ App (Linux) - 6.2.8 Vulnerabilities: Palo Alto Networks Autonomous Digital Experience Manager - privilege escalation (CVE-2025-0139, CVSS 2.4), Palo Alto Networks GlobalProtect™ App - unauthorized management (CVE-2025-0140, CVSS 4.3), Palo Alto Networks GlobalProtect™ App - privilege escalation (CVE-2025-0141, CVSS 5.7), Palo Alto - introhttps://cyberfeed.cesnet.cz/reports/586?lang=enhttps://cyberfeed.cesnet.cz/reports/584?lang=enFortinet fixes 5 vulnerabilities in various products. The most severe vulnerabilities are listed below. Products and their fixed versions: FortiOS - 7.6.3, 7.4.8, 7.2.12 FortiProxy - 7.6.2, 7.4.9 FortiIsolator - 2.4.5 FortiSandbox - 4.4.5, 4.2.7 FortiAnalyzer - 7.6.2, 7.4.7 FortiAnalyzer Cloud - 7.4.7 FortiManager - 7.6.2, 7.4.7 FortiManager Cloud - 7.4.7 Vulnerabilities: FortiOS, FortiProxy - incorrect authentication (CVE-2024-52965, CVSS 7.2), FortiIsolator, FortiSandbox - Insufficient Session Expiration (CVE-2024-27779, CVSS 6.7), FortiOS, FortiProxy - DNS filter bypass (CVE-2024-55599, CVSS 5.3), FortiAnalyzer (Cloud), FortiManager (Cloud) - SQL injection (CVE-2025-244474, CVSS 2.7), Fortinet - introhttps://cyberfeed.cesnet.cz/reports/584?lang=enhttps://cyberfeed.cesnet.cz/reports/583?lang=enGoogle fixes a high-severity, actively exploited vulnerability in Google Chrome that also affects other Chromium-based web browsers. The fix is available in Chrome for Linux in version 138.0.7204.92, for Windows in version 138.0.7204.96/.97 and for macOS in version 138.0.7204.92/.93. Microsoft Edge fixes the vulnerability in version 138.0.3351.65. Vulnerabilities: Google Chrome - intro, Google Chrome - arbitrary read/write (CVE-2025-6554, CVSS 8.1)https://cyberfeed.cesnet.cz/reports/583?lang=enhttps://cyberfeed.cesnet.cz/reports/582?lang=enMongoDB fixes 3 vulnerabilities with versions 8.0.10, 8.1.1, 7.0.20 and 6.0.23. Vulnerabilities: MongoDB - DoS (CVE-2025-6712, CVSS 6.5), MongoDB - DoS (CVE-2025-7259, CVSS 6.5), MongoDB - DoS (CVE-2025-6714, CVSS 7.5), MongoDB - introhttps://cyberfeed.cesnet.cz/reports/582?lang=enhttps://cyberfeed.cesnet.cz/reports/581?lang=enCisco fixes 4 vulnerabilities in various products. Products and their fixed versions: Cisco Unified CM (SME) - 15SU3 (Jul 2025) (or by applying the patch ciscocm.CSCwp27755_D0247-1.cop.sha512 available at [5]) Cisco BroadWorks Application Delivery Platform - RI.2025.05 Cisco Spaces Connector - 3-Jun 2025 Cisco ECE - 12.6(1)_ES11 Vulnerabilities: Cisco Unified CM, Unified CM SME - hard-coded credentials (CVE-2025-20309, CVSS 10.0), Cisco BroadWorks Application Delivery Platform - XSS (CVE-2025-20307, CVSS 4.8), Cisco Spaces Connector - OS command injection (CVE-2025-20308, CVSS 6.0), Cisco ECE - XSS (CVE-2025-20310, CVSS 6.1), Cisco - introhttps://cyberfeed.cesnet.cz/reports/581?lang=enhttps://cyberfeed.cesnet.cz/reports/580?lang=enSudo fixes 2 critical vulnerabilities in version 1.9.17p1. Only some Red Hat products are affected by these vulnerabilities, and fixes have already been released for some of them. Details can be found at. Debian releases are affected only by the vulnerability CVE-2025-32462. Individual Debian and Ubuntu releases and their fixed versions: Debian: bullseye (security) - 1.9.5p2-3+deb11u2 bookworm (security) - 1.9.13p3-1+deb12u2 trixie, sid - 1.9.16p2-3 Ubuntu: plucky - 1.9.16p2-1ubuntu1.1 oracular - 1.9.15p5-3ubuntu5.24.10.1 noble - 1.9.15p5-3ubuntu5.24.04.1 jammy - 1.9.9-1ubuntu2.5 focal - 1.8.31-1ubuntu1.5+esm1 bionic - 1.8.21p2-3ubuntu1.6+esm1 xenial - 1.8.16-0ubuntu1.10+esm3 trusty - 1.8.9p5-1ubuntu1.5+esm8 Vulnerabilities: Sudo - privilege escalation (CVE-2025-32463, CVSS 9.3), Sudo - privilege escalation (CVE-2025-32462, CVSS 9.3), Sudo - introhttps://cyberfeed.cesnet.cz/reports/580?lang=enhttps://cyberfeed.cesnet.cz/reports/579?lang=enGitHub Enterprise Server version 3.17.2 fixes a medium-severity vulnerability. Vulnerabilities: GitHub Enterprise Server - intro, GitHub Enterprise Server - sensitive information disclosure (CVE-2025-6600, CVSS 6.3)https://cyberfeed.cesnet.cz/reports/579?lang=enhttps://cyberfeed.cesnet.cz/reports/578?lang=enMozilla fixes 13 vulnerabilities in Firefox ESR and Firefox. The fix is available in versions 128.12 and 115.25 for Firefox ESR and in version 140 for Firefox. The most serious vulnerabilities are listed below. Vulnerabilities: Mozilla Firefox,Thunderbird - use-after-free (CVE-2025-6424, CVSS 9.8), Mozilla Firefox,Thunderbird - XSS (CVE-2025-6430, CVSS 6.1), Mozilla Firefox, Firefox ESR - introhttps://cyberfeed.cesnet.cz/reports/578?lang=enhttps://cyberfeed.cesnet.cz/reports/577?lang=enMongoDB Server versions 8.0.5, 7.0.21, 6.0.24 and 5.0.31 fix 4 vulnerabilities. The most severe of them are described below; the remaining ones can be found at. Vulnerabilities: MongoDB Server - intro, MongoDB Server - DoS (CVE-2025-6709, CVSS 7.5), MongoDB Server - DoS (CVE-2025-6710, CVSS 7.5)https://cyberfeed.cesnet.cz/reports/577?lang=enhttps://cyberfeed.cesnet.cz/reports/576?lang=enGitLab versions 18.1.1, 18.0.3 and 17.11.5 fix 5 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE). The most severe of them are described below; the remaining vulnerabilities can be found at. Vulnerabilities: GitLab CE/EE - intro, GitLab CE/EE - DoS (CVE-2025-3279, CVSS 6.5), GitLab CE/EE - authentication bypass (CVE-2025-1754, CVSS 5.3)https://cyberfeed.cesnet.cz/reports/576?lang=enhttps://cyberfeed.cesnet.cz/reports/575?lang=enCitrix fixes a critical vulnerability in its products. Products and their fixed versions: NetScaler ADC: 13.1-59.19, 14.1-47.46, 13.1-37.236-FIPS, 13.1-37.236-NDcPP NetScaler Gateway: 13.1-59.19, 14.1-47.46 Vulnerabilities: Citrix NetScaler ADC and NetScaler Gateway - intro, Citrix NetScaler ADC and NetScaler Gateway - DoS (CVE-2025-6543, CVSS 9.2)https://cyberfeed.cesnet.cz/reports/575?lang=enhttps://cyberfeed.cesnet.cz/reports/574?lang=enCisco fixes 6 vulnerabilities in various products. Products and their fixed versions: Cisco Identity Services Engine (ISE) - 3.4 Patch 2, 3.3 Patch 6, 3.2 P8 (Nov 2025), 3.1 P10 Cisco ISE Passive Identity Connector (ISE-PIC) - 3.4 Patch 2, 3.3 Patch 6, 3.2 P7, 3.1 P10 ClamAV - 1.4.3, 1.0.9 Secure Endpoint Connector (Linux, Mac) - 1.26.1 Secure Endpoint Connector (Windows) - 8.4.5, 7.5.21 Secure Endpoint Private Cloud - 4.2.2 Cisco Meraki MX Firmware - 19.1.8, 18.211.6, 18.107.13 Vulnerabilities: Cisco - intro, Cisco Identity Services Engine, Identity Services Engine Passive Identity Connector - RCE (CVE-2025-20281, CVSS 10.0), Cisco Identity Services Engine, Identity Services Engine Passive Identity Connector - RCE (CVE-2025-20282, CVSS 10.0), Cisco ClamAV - RCE, DoS (CVE-2025-20260, CVSS 9.8), Cisco Meraki MX and Z Series AnyConnect VPN - DoS (CVE-2025-20271, CVSS 8.6), Cisco Identity Services Engine - authorization bypass (CVE-2025-20264, CVSS 6.4), Cisco ClamAV - information disclosure, DoS (CVE-2025-20234, CVSS 5.3)https://cyberfeed.cesnet.cz/reports/574?lang=enhttps://cyberfeed.cesnet.cz/reports/569?lang=enOpenVPN versions 2.6.14-I002 and 2.7_alpha2-I001 fix 1 vulnerability in the ovpn-dco-win component of OpenVPN GUI for Windows. Vulnerabilities: OpenVPN - intro, OpenVPN ovpn-dco-win - DoS (CVE-2025-50054, CVSS 5.5)https://cyberfeed.cesnet.cz/reports/569?lang=enhttps://cyberfeed.cesnet.cz/reports/567?lang=enCitrix fixes 5 vulnerabilities in various products. Individual products and their fixed versions: NetScaler ADC - 14.1-43.56 - 13.1-58.32 - 13.1-37.235 (FIPS and NDcPP) - 12.1-55.328 (FIPS) NetScaler Gateway - 14.1-43.56 - 13.1-58.32 Citrix Secure Access Client for Windows - 25.5.1.15 Citrix Workspace app for Windows - 2409 (CR) - 2402 LTSR CU2 Hotfix 1, 2402 LTSR CU3 Hotfix 1 NetScaler Console and NetScaler SDX (SVM) - 14.1.47.46 - 13.1.58.32 Vulnerabilities: Citrix - intro, Citrix NetScaler ADC and NetScaler Gateway - out-of-bounds read (CVE-2025-5777, CVSS 9.3), Citrix NetScaler ADC and NetScaler Gateway - unauthorized access (CVE-2025-5349, CVSS 8.7), Citrix Secure Access Client for Windows - privilege escalation (CVE-2025-0320, CVSS 8.5), Citrix Workspace app for Windows - privilege escalation (CVE-2025-4879, CVSS 7.3), Citrix NetScaler Console and NetScaler SDX (SVM) - arbitrary file read (CVE-2025-4365, CVSS 6.9)https://cyberfeed.cesnet.cz/reports/567?lang=enhttps://cyberfeed.cesnet.cz/reports/566?lang=enApache versions 10.0.6 and 9.2.11 fix two vulnerabilities in Apache Traffic Server. The fixed versions only provide configuration options to mitigate these vulnerabilities – their effectiveness depends on correct configuration by the user. Vulnerabilities: Apache Traffic Server - intro, Apache Traffic Server - DoS (CVE-2025-49763, CVSS 7.5), Apache Traffic Server - unauthorized access (CVE-2025-31698, CVSS 7.5)https://cyberfeed.cesnet.cz/reports/566?lang=enhttps://cyberfeed.cesnet.cz/reports/565?lang=enApache fixes 3 vulnerabilities in Apache Tomcat in versions 11.0.8, 10.1.42 and 9.0.106. The fix is not yet available for any stable release of the popular Linux distributions. Gentoo has fixed versions available as testing. Vulnerabilities: Apache Tomcat - DoS (CVE-2025-48988, CVSS 7.5), Apache Tomcat - side-loading (CVE-2025-49124, CVSS 8.4), Apache Tomcat - security constraint bypass (CVE-2025-49125, CVSS 7.5), Apache Tomcat - introhttps://cyberfeed.cesnet.cz/reports/565?lang=enhttps://cyberfeed.cesnet.cz/reports/564?lang=enVeeam fixes three vulnerabilities in its products. Products and their fixed versions: Veeam Backup & Replication - 12.3.2 (build 12.3.2.3617) Veeam Agent for Microsoft Windows - 6.3.2 (build 6.3.2.1205) Vulnerabilities: Veeam Backup & Replication - intro, Veeam Backup & Replication - RCE (CVE-2025-23121, CVSS 9.9), Veeam Backup & Replication - RCE (CVE-2025-24286, CVSS 7.2), Veeam Agent for Microsoft Windows - privilege escalation, RCE (CVE-2025-24287, CVSS 6.1)https://cyberfeed.cesnet.cz/reports/564?lang=enhttps://cyberfeed.cesnet.cz/reports/563?lang=enPalo Alto Networks fixes seven vulnerabilities in its products. The most severe of them are described below; the remaining ones can be found at. Products and their fixed versions: PAN-OS - 10.1.14-h16 (07/2025), 10.2.16-h1 (06/2025), 10.2.17 (08/2025) - 11.0.3, 11.1.10, 11.2.7 (06/2025) GlobalProtect App (Windows, macOS) - 6.3.3, 6.3.3-650, 6.2.8-h2 (06/2025) Prisma Access Browser - 137.16.2.69 Cortex XDR Broker VM - 27.0.26 Vulnerabilities: Palo Alto - intro, Palo Alto PAN-OS - command injection (CVE-2025-4231, CVSS 8.6), Palo Alto GlobalProtect App (macOS) - privilege escalation (CVE-2025-4232, CVSS 8.5), Palo Alto PAN-OS - OS command injection (CVE-2025-4230, CVSS 8.4), Palo Alto PAN-OS - traffic information disclosure (CVE-2025-4229, CVSS 6.0)https://cyberfeed.cesnet.cz/reports/563?lang=enhttps://cyberfeed.cesnet.cz/reports/562?lang=enMozilla fixes three vulnerabilities in Firefox and Thunderbird. Individual products and their fixed versions: Firefox - 139.0.4 Thunderbird - 128.11.1, 139.0.2 Vulnerabilities: Mozilla Firefox & Thunderbird - intro, Mozilla Firefox - memory corruption, RCE (CVE-2025-49710, CVSS 9.8), Mozilla Firefox - memory corruption (CVE-2025-49709, CVSS 8.1), Mozilla Thunderbird - credentials disclosure, DoS (CVE-2025-5986, CVSS 6.5)https://cyberfeed.cesnet.cz/reports/562?lang=enhttps://cyberfeed.cesnet.cz/reports/561?lang=enXWiki versions 16.4.7, 16.10.3 and 17.0.0 fix 9 vulnerabilities. The most severe of them are described below; the remaining ones can be found at. Vulnerabilities: XWiki - intro, XWiki - SQL injection (CVE-2024-56158, CVSS 9.3), XWiki - RCE (CVE-2025-49581, CVSS 8.7), XWiki - sensitive information disclosure (CVE-2025-49584, CVSS 8.7), XWiki - RCE (CVE-2025-49586, CVSS 8.7), XWiki - RCE (CVE-2025-49582, CVSS 8.6), XWiki - RCE (CVE-2025-49585, CVSS 8.6)https://cyberfeed.cesnet.cz/reports/561?lang=enhttps://cyberfeed.cesnet.cz/reports/560?lang=enVMware versions 6.2.8, 6.1.21 and 6.0.29 fix 1 vulnerability in Spring Framework. Vulnerabilities: Spring Framework - intro, Spring Framework - reflected file download (CVE-2025-41234, CVSS 6.5)https://cyberfeed.cesnet.cz/reports/560?lang=enhttps://cyberfeed.cesnet.cz/reports/559?lang=enGitLab fixes 10 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) in versions 18.0.2, 17.11.4 and 17.10.8. The most serious vulnerabilities are listed below. Vulnerabilities: GitLab CE/EE - XSS (CVE-2025-2254, CVE-2025-4278, CVSS 8.7), GitLab EE - CI/CD job injectiion (CVE-2025-5121, CVSS 8.5), GitLab CE/EE - DoS (CVE-2025-0673, CVSS 7.5), GitLab - information disclosure (CVE-2024-9512, CVSS 5.3), GitLab CE/EE - introhttps://cyberfeed.cesnet.cz/reports/559?lang=enhttps://cyberfeed.cesnet.cz/reports/558?lang=enFortinet fixes 13 vulnerabilities in various products. The most serious vulnerabilities are listed below. Products and their fixed versions: FortiADC - 7.6.2, 7.4.8, 7.2.11, 7.1.5 FortiOS - 7.6.2, 7.4.8 FortiProxy - 7.6.2, 7.4.8, 7.2.10, 7.0.17 FortiWeb - 7.6.2, 7.4.8 FortiPAM - 1.4.2, 1.3.1, 1.2.1, 1.1.3, 1.0.4; FortiSRA - 1.4.2 FortiClientEMS - 7.4.3, 7.2.7 FortiClientWindows - 7.4.1, 7.2.7 FortiPortal - 7.4.1, 7.2.6, 7.0.9 Vulnerabilities: Fortinet - intro, FortiADC - OS command injection (CVE-2025-31104, CVSS 7.2), FortiOS, FortiProxy, FortiWeb - privilege escalation (CVE-2025-22254, CVSS 6.6), FortiPAM, FortiSRA - unauthorized access (CVE-2025-22256, CVSS 6.3), FortiClientEMS - unauthorized access (CVE-2024-32119, CVSS 4.8), FortiClientWindows - VPN redirections (CVE-2024-54019, CVSS 4.8), FortiPortal - information disclosure (CVE-2024-45329, CVSS 4.3)https://cyberfeed.cesnet.cz/reports/558?lang=enhttps://cyberfeed.cesnet.cz/reports/557?lang=enFortinet fixes 13 vulnerabilities in various products. The most serious vulnerabilities are listed below. Products and their fixed versions: FortiADC - 7.6.2, 7.4.8, 7.2.11, 7.1.5 FortiOS - 7.6.2, 7.4.8 FortiProxy - 7.6.2, 7.4.8, 7.2.10, 7.0.17 FortiWeb - 7.6.2, 7.4.8 FortiPAM - 1.4.2, 1.3.1, 1.2.1, 1.1.3, 1.0.4; FortiSRA - 1.4.2 FortiClientEMS - 7.4.3, 7.2.7 FortiClientWindows - 7.4.1, 7.2.7 FortiPortal - 7.4.1, 7.2.6, 7.0.9 Vulnerabilities: Fortinet - intro, FortiADC - OS command injection (CVE-2025-31104, CVSS 7.2), FortiOS, FortiProxy, FortiWeb - privilege escalation (CVE-2025-22254, CVSS 6.6), FortiPAM, FortiSRA - unauthorized access (CVE-2025-22256, CVSS 6.3), FortiClientEMS - unauthorized access (CVE-2024-32119, CVSS 4.8), FortiClientWindows - VPN redirections (CVE-2024-54019, CVSS 4.8), FortiPortal - information disclosure (CVE-2024-45329, CVSS 4.3)https://cyberfeed.cesnet.cz/reports/557?lang=enhttps://cyberfeed.cesnet.cz/reports/556?lang=enQNAP fixes 25 vulnerabilities in its products. The most severe of them are described below. Products and their fixes: File Station - 5.5.6.4847, 5.5.6.4791 QTS - 5.2.4.3079 build 20250321, 5.2.4.3079 build 20250321 QuTS hero - h5.2.4.3079 build 20250321, h5.2.4.3079 build 20250321 Qsync Central - 4.5.0.6 QES - 2.2.1 build 20250304, 2.2.1 build 20241231 QuRouter - 2.5.0.140 License Center - 1.9.49 Vulnerabilities: QNAP - intro, QNAP File Station 5 - improper certificate validation (CVE-2025-30279, CVE-2025-33031, CVSS 8.3), QNAP File Station 5 - path traversal (CVE-2025-33035, CVSS 7.2), QNAP File Station 5 - DoS (CVE-2025-22484, CVE-2025-29872, CVSS 7.1), QNAP File Station 5 - improper certificate validation (CVE-2025-22486, CVE-2025-29883, CVE-2025-29884, CVE-2025-29885, CVSS 7.1), QNAP QTS, QuTS hero - command injection (CVE-2025-22481, CVSS 8.7), QNAP Qsync Central - SQL injection (CVE-2025-29892, CVSS 8.7)https://cyberfeed.cesnet.cz/reports/556?lang=enhttps://cyberfeed.cesnet.cz/reports/555?lang=enApache CloudStack versions 4.19.3.0 and 4.20.1.0 fix five vulnerabilities. Vulnerabilities: Apache CloudStack - intro, ApacheCloudstack - sensitive information disclosure (CVE-2025-26521, CVSS 8.8), Apache CloudStack - sensitive information disclosure (CVE-2025-30675, CVSS 4.7), Apache CloudStack - privilege escalation (CVE-2025-47713, CVSS 7.2), Apache CloudStack - privilege escalation (CVE-2025-47849, CVSS 7.2), Apache CloudStack Quota plugin - unauthorized access (CVE-2025-22829, CVSS 2.3)https://cyberfeed.cesnet.cz/reports/555?lang=enhttps://cyberfeed.cesnet.cz/reports/554?lang=enAcronis fixes 5 vulnerabilities in Acronis Cyber Protect 16 and Acronis Cyber Protect Cloud Agent. The fixed versions can be found in the links for the individual vulnerabilities. Vulnerabilities: Acronis - intro, Acronis Cyber Protect Cloud Agent - DoS (CVE-2025-30415, CVSS 7.5), Acronis Cyber Protect 16 - local privilege escalation (CVE-2025-48961, CVSS 7.3), Acronis Cyber Protect Cloud Agent - local privilege escalation (CVE-2025-48959, CVSS 6.7), Acronis Cyber Protect 16 - inadequate encryption strength (CVE-2025-48960, CVSS 5.9), Acronis Cyber Protect 16 - sensitive information disclosure (CVE-2025-48962, CVSS 4.3)https://cyberfeed.cesnet.cz/reports/554?lang=enhttps://cyberfeed.cesnet.cz/reports/553?lang=enVMware fixes 3 vulnerabilities in VMware NSX in versions 4.2.2.1, 4.2.1.4 and 4.1.2.6. If VMware NSX is part of VMware Telco Cloud Infrastructure or VMware Telco Cloud Platform, the patch available at must be applied. Vulnerabilities: VMware NSX - XSS (CVE-2025-22243, CVSS 7.5), VMware NSX - XSS (CVE-2025-22244, CVSS 6.9), VMware NSX - XSS (CVE-2025-22245, CVSS 5.9), VMware NSX - introhttps://cyberfeed.cesnet.cz/reports/553?lang=enhttps://cyberfeed.cesnet.cz/reports/552?lang=enCisco fixes 12 vulnerabilities in its products, one of them critical. The list of vulnerable products and available fixes can be found in the links provided for the individual vulnerabilities. Vulnerabilities: Cisco - intro, Cisco Identity Services Engine (ISE) - unauthorized access (CVE-2025-20286, CVSS 9.9), Cisco Integrated Management Controller (IMC) - privilege escalation (CVE-2025-20261, CVSS 8.8), Cisco Nexus Dashboard Fabric Controller (NDFC) - MITM (CVE-2025-20163, CVSS 8.7), Cisco Unified Intelligent Contact Management Enterprise - XSS (CVE-2025-20273, CVSS 6.1), Cisco Unified Communications Products - command injection (CVE-2025-20278, CVSS 6.0)https://cyberfeed.cesnet.cz/reports/552?lang=enhttps://cyberfeed.cesnet.cz/reports/551?lang=enSamba version 4.21.6 fixes 1 vulnerability. Among operating systems, only Debian has so far provided a fix, for the bullseye release in version 2:4.13.13+dfsg-1~deb11u6 and bookworm in version 2:4.17.12+dfsg-0+deb12u1. Vulnerabilities: Samba - intro, Samba - improper authentication (CVE-2025-0620, CVSS 7.0)https://cyberfeed.cesnet.cz/reports/551?lang=enhttps://cyberfeed.cesnet.cz/reports/550?lang=enCurl version 8.14.1 fixes a vulnerability in the libcurl library. Vulnerabilities: curl - intro, libcurl - DoS (CVE-2025-5399, CVSS 7.5)https://cyberfeed.cesnet.cz/reports/550?lang=enhttps://cyberfeed.cesnet.cz/reports/549?lang=enRoundcube fixes 1 critical vulnerability in Roundcube Webmail in versions 1.6.11 and 1.5.10. Debian and Ubuntu have not yet released a fix for their stable releases; Red Hat products are not affected by the vulnerability. Gentoo has the fixed version 1.6.11 available as testing. A manual fix can be made by creating and applying a patch from the fixed files available at. The changes can be verified in the commit available at. Vulnerabilities: Roundcube - RCE (CVE-2025-49113, CVSS 9.9), Roundcube - introhttps://cyberfeed.cesnet.cz/reports/549?lang=enhttps://cyberfeed.cesnet.cz/reports/548?lang=enApache Tomcat versions 11.0.7, 10.1.41 and 9.0.105 fix one vulnerability. Vulnerabilities: Apache Tomcat - security bypass (CVE-2025-46701, CVSS 6.3), Apache Tomcat - introhttps://cyberfeed.cesnet.cz/reports/548?lang=enhttps://cyberfeed.cesnet.cz/reports/547?lang=enFortinet fixes 4 vulnerabilities in FortiOS and FortiClient. The fix has been released for FortiOS in versions 7.4.4, 7.2.8 and 7.0.15, for FortiClient (Windows) in version 7.2.2, and for FortiClient (Mac) in versions 7.4.3 and 7.2.9. Vulnerabilities: FortiOS - DoS (CVE-2025-47294, CVSS 5.3), FortiOS - DoS (CVE-2025-47295, CVSS 3.7), FortiClientWindows - information leak (CVE-2025-24473, CVSS 3.7), FortiClientMac - privilege escalation (CVE-2025-25251, CVSS 7.8), Fortinet - introhttps://cyberfeed.cesnet.cz/reports/547?lang=enhttps://cyberfeed.cesnet.cz/reports/546?lang=enIcinga versions 2.14.6, 2.13.12 and 2.12.12 fix a critical vulnerability in Icinga 2. Vulnerabilities: Icinga 2 - intro, Icinga 2 - node impersonation (CVE-2025-48057, CVSS 9.3)https://cyberfeed.cesnet.cz/reports/546?lang=enhttps://cyberfeed.cesnet.cz/reports/545?lang=enCurl version 8.14.0 fixes 2 vulnerabilities in curl and libcurl. Vulnerabilities: Curl - intro, Curl - MITM attack (CVE-2025-4947, CVSS 7.4), Curl - trust spoofing (CVE-2025-5025, CVSS 7.5)https://cyberfeed.cesnet.cz/reports/545?lang=enhttps://cyberfeed.cesnet.cz/reports/544?lang=enBIND 9 fixes 1 vulnerability in versions 9.20.9 and 9.21.8. Debian stable releases, Ubuntu LTS releases and Red Hat products are not affected by this vulnerability. Gentoo has the vulnerable versions available only as testing. Vulnerabilities: BIND 9 - DoS (CVE-2025-40775, CVSS 7.5), BIND 9 - introhttps://cyberfeed.cesnet.cz/reports/544?lang=enhttps://cyberfeed.cesnet.cz/reports/543?lang=enPowerDNS DNSdist version 1.9.10 fixes a high-severity vulnerability. Vulnerabilities: PowerDNS DNSdist - intro, PowerDNS DNSdist - DoS (CVE-2025-30193, CVSS 7.5)https://cyberfeed.cesnet.cz/reports/543?lang=enhttps://cyberfeed.cesnet.cz/reports/542?lang=enGitLab versions 18.0.1, 17.11.3 and 17.10.7 fix 10 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE). The most severe of them are described below; the remaining vulnerabilities can be found at. Vulnerabilities: GitLab CE/EE - intro, GitLab CE/EE - DoS (CVE-2025-0993, CVSS 7.5), GitLab CE/EE - 2FA bypass (CVE-2024-12093, CVSS 6.8), GitLab CE/EE - DoS (CVE-2024-7803, CVSS 6.5), GitLab CE/EE - DoS (CVE-2025-3111, CVSS 6.5), GitLab CE/EE - DoS (CVE-2025-2853, CVSS 6.5)https://cyberfeed.cesnet.cz/reports/542?lang=enhttps://cyberfeed.cesnet.cz/reports/536?lang=enCisco fixes 13 vulnerabilities in its products; the most severe of them are described below. All vulnerabilities, individual products and their fixed versions can be found in the link for each vulnerability. Vulnerabilities: Cisco - intro, Cisco Identity Services Engine - DoS (CVE-2025-20152, CVSS 8.6), Cisco Unified Intelligence Center - privilege escalation (CVE-2025-20113, CVSS 7.1), Cisco Secure Network Analytics Manager - privilege escalation (CVE-2025-20256, CVSS 6.5), Cisco Unified Contact Center Enterprise Cloud Connect - unauthorized data read/modification (CVE-2025-20242, CVSS 6.5), Cisco Catalyst SD-WAN Manager - arbitrary file creation (CVE-2025-20187, CVSS 6.5)https://cyberfeed.cesnet.cz/reports/536?lang=enhttps://cyberfeed.cesnet.cz/reports/534?lang=enVMware fixes 7 vulnerabilities in vCenter Server, ESXi, Cloud Foundation (vCenter, ESXi), VMware Telco Cloud Platform (vCenter, ESXi), Telco Cloud Infrastructure (vCenter, ESXi), Workstation and Fusion (MacOS). The fixed versions can be found at. The most serious vulnerabilities are listed below. Vulnerabilities: VMware Cloud Foundation - directory traversal (CVE-2025-41229, CVSS 8.2), VMware Cloud Foundation - informaction disclosure (CVE-2025-41230, CVSS 7.5), VMware vCenter Server - command execution (CVE-2025-41225, CVSS 8.8), VMware ESXi - DoS (CVE-2025-41226, CVSS 6.8), VMware ESXi, vCenter Server - XSS (CVE-2025-41228, CVSS 4.3), VMware - introhttps://cyberfeed.cesnet.cz/reports/534?lang=enhttps://cyberfeed.cesnet.cz/reports/493?lang=enMozilla fixes two high-severity vulnerabilities in Firefox and Firefox ESR. Fixed versions of the individual products: Firefox - 138.0.4 Firefox ESR - 128.10.1, 115.23.1 Vulnerabilities: Mozilla Firefox, Firefox ESR - intro, Mozilla Firefox, Firefox ESR - memory read/write (CVE-2025-4919, CVSS 8.8), Mozilla Firefox, Firefox ESR - memory read/write (CVE-2025-4918, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/493?lang=enhttps://cyberfeed.cesnet.cz/reports/492?lang=enVMware fixes 2 vulnerabilities in Spring Security and Spring Framework. Products and their fixes: Spring Security - 6.4.6 Spring Framework - 6.2.7, 6.1.20, 6.0.28, 5.3.43 Vulnerabilities: VMware Spring - intro, VMware Spring Security - authorization bypass (CVE-2025-41232, CVSS 9.1), VMware Spring Framework - sensitive match exception (CVE-2025-22233, CVSS 3.1)https://cyberfeed.cesnet.cz/reports/492?lang=enhttps://cyberfeed.cesnet.cz/reports/491?lang=enGNU version 2.39 fixes a high-severity vulnerability in glibc. Among operating systems, only Debian has so far provided a fix, for the trixie release in version 2.41-7 and sid in version 2.41-8. Vulnerabilities: glibc - intro, glibc - RCE (CVE-2025-4802, CVSS 8.4)https://cyberfeed.cesnet.cz/reports/491?lang=enhttps://cyberfeed.cesnet.cz/reports/490?lang=enPalo Alto Networks fixes 9 vulnerabilities in its products. The most severe of them are described below; the rest can be found at. Products and their fixed versions: PAN-OS - 11.2.5, 11.1.6-h1, 11.1.7-h2, 11.1.8 - 11.2.7, 11.1.11, 10.2.17 - 11.1.5, 11.0.7, 10.2.11, 10.1.14-h14 - 11.2.5, 11.1.8, 10.2.13, 10.1.14-h14 MetaDefender Endpoint Security SDK - 4.3.4451 (Windows) Cortex XDR Broker VM - 26.0.119 GlobalProtect App - 6.3.3, 6.2.8 (macOS) Prisma Cloud Compute Edition - 34.00.141 Vulnerabilities: Palo Alto - intro, Palo Alto Networks PAN-OS - DoS (CVE-2025-0130, CVSS 8.2), Palo Alto Networks GlobalProtect App - incorrect privilege management (CVE-2025-0131, CVSS 7.1), Palo Alto Networks Cortex XDR Broker VM - missing authentication (CVE-2025-0132, CVSS 6.9), Palo Alto Networks PAN-OS - reflected XSS (CVE-2025-0133, CVSS 6.9), Palo Alto Networks Cortex XDR Broker VM - arbitrary code execution (CVE-2025-0134, CVSS 6.5)https://cyberfeed.cesnet.cz/reports/490?lang=enhttps://cyberfeed.cesnet.cz/reports/489?lang=enWebKitGTK and WPE WebKit version 2.48.2 fix 6 vulnerabilities. The most severe of them are described below; the rest can be found at. Apple products and their latest fixed versions: macOS - 13.7.6, 14.7.6, 15.5 iOS - 18.5 iPadOS - 17.7.7, 18.5 watchOS - 11.5 tvOS - 18.5 visionOS - 2.5 Safari - 18.5 Vulnerabilities: WebKitGTK and WPE WebKit - intro, WebKitGTK and WPE WebKit - memory corruption (CVE-2025-31204, CVSS 7.1), WebKitGTK and WPE WebKit - memory corruption (CVE-2025-24223, CVSS 7.1), WebKitGTK and WPE WebKit - data exfiltration (CVE-2025-31205, CVSS 6.5), WebKitGTK and WPE WebKit - DoS (CVE-2025-31215, CVSS 6.5)https://cyberfeed.cesnet.cz/reports/489?lang=enhttps://cyberfeed.cesnet.cz/reports/488?lang=enApple fixes over 60 vulnerabilities in its products. Selected ones are listed below; the remaining ones are described at. Products and their fixed versions: macOS - 13.7.6, 14.7.6, 15.5 iOS - 18.5 iPadOS - 17.7.7, 18.5 watchOS - 11.5 tvOS - 18.5 visionOS - 2.5 Safari - 18.5 Vulnerabilities: Apple - intro, Apple macOS Sequoia - sandbox escape (CVE-2025-31244, CVSS 8.8), Apple macOS Sequoia, macOS Sonoma - kernel memory corruption (CVE-2025-31246, CVSS 8.1), Apple macOS Sequoia, macOS Sonoma, macOS Ventura - privilege escalation (CVE-2025-24274, CVSS 7.8), Apple iOS, iPadOS, macOS Sequoia, macOS Sonoma, macOS Ventura, visionOS - data leak (CVE-2025-30448, CVSS 7.5), Apple iOS, iPadOS, macOS Sequoia, macOS Sonoma, macOS Ventura, watchOS, tvOS, visionOS - kernel memory corruption (CVE-2025-31219, CVSS 8.1), Apple iOS, iPadOS, macOS Sequoia, watchOS, tvOS, visionOS, Safari - memory corruption (CVE-2025-31204, CVSS 7.1)https://cyberfeed.cesnet.cz/reports/488?lang=enhttps://cyberfeed.cesnet.cz/reports/487?lang=enFortinet fixes a critical vulnerability in various products. Products and their fixed versions: FortiSwitchManager - 7.2.6 FortiProxy - 7.6.2 FortiOS - 7.4.7, 7.6.1 Vulnerabilities: Fortinet FortiOS, FortiProxy, FortiSwitchManager - intro, Fortinet FortiOS, FortiProxy, FortiSwitchManager - unauthorized admin access (CVE-2025-22252, CVSS 9.8)https://cyberfeed.cesnet.cz/reports/487?lang=enhttps://cyberfeed.cesnet.cz/reports/486?lang=enFortinet fixes three vulnerabilities in various products, one of which is critical and actively exploited. Individual products and their fixed versions: FortiCamera - 2.1.4 FortiClientEMS Cloud - 7.4.3 FortiClientEMS - 7.4.3 FortiClientMac - 7.2.9, 7.4.3 FortiMail - 7.0.9, 7.2.8, 7.4.5, 7.6.3 FortiNDR - 7.0.7, 7.2.5, 7.4.8, 7.6.1 FortiRecorder - 6.4.6, 7.0.6, 7.2.4 FortiVoice - 6.4.11, 7.0.7, 7.2.1 FortiVoiceUCDesktop - 7.0 Vulnerabilities: Fortinet - intro, Fortinet FortiVoice, FortiMail, FortiNDR, FortiRecorder, FortiCamera - RCE (CVE-2025-32756, CVSS 9.8), Fortinet FortiClientEMS, FortiClientEMS Cloud - limited arbitrary file write (CVE-2025-22859, CVSS 5.3), Fortinet FortiClient (macOS), FortiVoiceUC Desktop - code injection (CVE-2024-35281, CVSS 2.5)https://cyberfeed.cesnet.cz/reports/486?lang=enhttps://cyberfeed.cesnet.cz/reports/485?lang=enIvanti fixes 4 vulnerabilities in the products Ivanti Neurons for ITSM, Ivanti Cloud Services Application and Ivanti Endpoint Manager Mobile. Vulnerabilities: Ivanti - intro, Ivanti Neurons for ITSM - privilege escalation (CVE-2025-22462, CVSS 9.8), Ivanti Cloud Services Application - privilege escalation (CVE-2025-22460, CVSS 7.8), Ivanti Endpoint Manager Mobile - authentication bypass (CVE-2025-4427, CVSS 5.3), Ivanti Endpoint Manager Mobile - arbitrary code execution (CVE-2025-4428, CVSS 7.2)https://cyberfeed.cesnet.cz/reports/485?lang=enhttps://cyberfeed.cesnet.cz/reports/484?lang=enVMware fixes a vulnerability in VMware Aria Automation and VMware Telco Cloud Platform products with version 8.18.1 patch 2. For VMware Cloud Foundation, follow KB394224. Vulnerabilities: VMware - intro, VMware Aria Automation, VMware Cloud Foundation, VMware Telco Cloud Platform - XSS (CVE-2025-22249, CVSS 8.2)https://cyberfeed.cesnet.cz/reports/484?lang=enhttps://cyberfeed.cesnet.cz/reports/483?lang=enPostgreSQL fixes one vulnerability with versions 17.5, 16.9, 15.13, 14.18 and 13.21. Vulnerabilities: PostgreSQL - intro, PostgreSQL - DoS (CVE-2025-4207, CVSS 5.9)https://cyberfeed.cesnet.cz/reports/483?lang=enhttps://cyberfeed.cesnet.cz/reports/482?lang=enCisco fixes 35 vulnerabilities in its products. The most severe are described below; the remaining vulnerabilities can be found at. Vulnerable products and their fixed versions can be found in the link provided for each vulnerability. Vulnerabilities: Cisco - intro, Cisco IOS XE Software - arbitrary file upload (CVE-2025-20188, CVSS 10.0), Cisco IOS XE Software - DoS (CVE-2025-20140, CVSS 7.4), Cisco IOS XE Software - command injection (CVE-2025-20186, CVSS 8.8), Cisco IOS, IOS XE, and IOS XR Software - DoS (CVE-2025-20154, CVSS 8.6), Cisco Catalyst SD-WAN Manager - privilege escalation (CVE-2025-20122, CVSS 7.8), Cisco Catalyst Center - unauthenticated API access (CVE-2025-20210, CVSS 7.3)https://cyberfeed.cesnet.cz/reports/482?lang=enhttps://cyberfeed.cesnet.cz/reports/481?lang=enGitLab fixes 3 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) in versions 17.11.2, 17.10.6 and 17.9.8. Vulnerabilities: GitLab CE/EE - unauthorized access (CVE-2025-0549, CVSS 6.8), GitLab CE/EE - DoS (CVE-2024-8973, CVSS 6.5), GitLab CE/EE - unauthorized access (CVE-2025-1278, CVSS 5.3), GitLab CE/EE - introhttps://cyberfeed.cesnet.cz/reports/481?lang=enhttps://cyberfeed.cesnet.cz/reports/480?lang=enF5 fixes 12 vulnerabilities in its products. The most severe of them are listed below; the rest can be found at. Individual products and their fixed versions: BIG-IP (all modules) - 17.1.2.2, 16.1.6, 15.1.10.7; BIG-IP Next (all modules) - 20.3.0; BIG-IP Next CNF - 2.0.0; BIG-IP Next SPK - 2.0.0; BIG-IP (APM and PEM) - 17.1.2.2, 16.1.6, 15.1.10.7; F5OS-A, F5OS-C - 1.8.0. Detailed information on the fixed versions for each vulnerability can be found in the overview table at. Vulnerabilities: F5 - intro, F5 F5OS-A, F5OS-C - privilege escalation (CVE-2025-46265, CVSS 8.8), F5 BIG-IP - system command execution (CVE-2025-31644, CVSS 8.7), F5 F5OS-A, F5OS-C - unauthorized access (CVE-2025-36546, CVSS 8.1), F5 BIG-IP, BIG-IP Next, BIG-IP Next CNF, BIG-IP Next SPK - DoS (CVE-2025-41399, CVSS 7.5), F5 BIG-IP, BIG-IP Next CNF, BIG-IP Next SPK - DoS (CVE-2025-36557, CVSS 7.5), F5 BIG-IP, BIG-IP Next, BIG-IP Next CNF, BIG-IP Next SPK - DoS (CVE-2025-36504, CVSS 7.5)https://cyberfeed.cesnet.cz/reports/480?lang=enhttps://cyberfeed.cesnet.cz/reports/479?lang=enElastic fixes 2 vulnerabilities in its products. Products and their fixed versions: Kibana - 8.17.6, 8.18.1 and 9.0.1; Logstash - 8.17.6, 8.18.1 and 9.0.1. Vulnerabilities: Elastic - intro, Elastic Kibana - RCE (CVE-2025-25014, CVSS 9.1), Elastic Logstash - MITM (CVE-2025-37730, CVSS 6.5)https://cyberfeed.cesnet.cz/reports/479?lang=enhttps://cyberfeed.cesnet.cz/reports/478?lang=enApache fixes a vulnerability in ActiveMQ with versions 6.1.6, 5.19.0, 5.18.7, 5.17.7 and 5.16.8. Vulnerabilities: Apache ActiveMQ - intro, Apache ActiveMQ - DoS (CVE-2025-27533, CVSS 6.9)https://cyberfeed.cesnet.cz/reports/478?lang=enhttps://cyberfeed.cesnet.cz/reports/477?lang=enCisco fixes 4 vulnerabilities in its products, one of which is critical. A list of vulnerable products and available fixes can be found in the links provided for each vulnerability. Vulnerabilities: Cisco - intro, Multiple Cisco products - RCE (CVE-2025-32433, CVSS 10.0), Cisco Webex App - RCE (CVE-2025-20236, CVSS 8.8), Cisco Secure Network Analytics - privilege escalation (CVE-2025-20178, CVSS 6.0), Cisco Nexus Dashboard - LDAP username enumeration (CVE-2025-20150, CVSS 5.3)https://cyberfeed.cesnet.cz/reports/477?lang=enhttps://cyberfeed.cesnet.cz/reports/476?lang=enZimbra Collaboration fixes a high-severity vulnerability with version 10.1.4. Vulnerabilities: Zimbra Collaboration - intro, Zimbra Collaboration - CSRF (CVE-2025-32354, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/476?lang=enhttps://cyberfeed.cesnet.cz/reports/475?lang=enPowerDNS DNSdist fixes a high-severity vulnerability with version 1.9.9. Vulnerabilities: PowerDNS DNSdist - intro, PowerDNS DNSdist - DoS (CVE-2025-30194, CVSS 7.5)https://cyberfeed.cesnet.cz/reports/475?lang=enhttps://cyberfeed.cesnet.cz/reports/474?lang=enVMware fixes 3 vulnerabilities in the products Spring Boot, Spring Security and Spring Cloud Config. Products and their fixes: Spring Boot - 2.7.25, 3.1.16, 3.2.14, 3.3.11, 3.4.5 Spring Security - 5.7.17, 5.8.19, 6.0.17, 6.1.15, 6.2.11, 6.3.9, 6.4.5 Spring Cloud Config - 4.2.2, 4.1.6, 4.0.10, 3.1.10, 4.1.6, 4.1.6 Vulnerabilities: VMware Spring - intro, VMware Spring Boot - improper input validation (CVE-2025-22235, CVSS 7.3), VMware Spring Security - improper access control (CVE-2025-22234, CVSS 5.3), VMware Spring Cloud Config - improper authentication (CVE-2025-22232, CVSS 5.3)https://cyberfeed.cesnet.cz/reports/474?lang=enhttps://cyberfeed.cesnet.cz/reports/473?lang=enRancher fixes a high-severity vulnerability with versions 2.9.9, 2.10.5 and 2.11.1. Vulnerabilities: Rancher - intro, Rancher - privilege escalation (CVE-2024-22031, CVSS 8.5)https://cyberfeed.cesnet.cz/reports/473?lang=enhttps://cyberfeed.cesnet.cz/reports/472?lang=enthe h11 Python library for implementing the HTTP/1.1 protocol fixes a critical vulnerability with version 0.16.0. Vulnerabilities: h11 - intro, h11 - request smuggling (CVE-2025-43859, CVSS 9.1)https://cyberfeed.cesnet.cz/reports/472?lang=enhttps://cyberfeed.cesnet.cz/reports/471?lang=enDocker Desktop for Windows version 4.41.0 fixes a high-severity vulnerability. Vulnerabilities: Docker Desktop - intro, Docker Desktop - privilege escalation (CVE-2025-3224, CVSS 7.3)https://cyberfeed.cesnet.cz/reports/471?lang=enhttps://cyberfeed.cesnet.cz/reports/470?lang=enApache Software Foundation fixes 2 vulnerabilities in Apache Tomcat with versions 11.0.6, 10.1.40 and 9.0.104. Vulnerabilities: Apache Tomcat - intro, Apache Tomcat - DoS (CVE-2025-31650, CVSS 7.5), Apache Tomcat - rewrite rule bypass (CVE-2025-31651, CVSS 9.8)https://cyberfeed.cesnet.cz/reports/470?lang=enhttps://cyberfeed.cesnet.cz/reports/469?lang=enMoodle fixes 16 vulnerabilities with versions 4.5.4, 4.4.8, 4.3.12 and 4.1.18. The most severe of them are described below; you can find the rest at. Vulnerabilities: Moodle - intro, Moodle - RCE (CVE-2024-40446, CVSS 9.8), Moodle - RCE (CVE-2025-3641, CVSS 8.8), Moodle - RCE (CVE-2025-3642, CVSS 8.8), Moodle - DoS (CVE-2025-3625, CVSS 7.1), Moodle - XSS (CVE-2025-3643, CVSS 6.1)https://cyberfeed.cesnet.cz/reports/469?lang=enhttps://cyberfeed.cesnet.cz/reports/468?lang=enXWiki fixes 2 vulnerabilities in versions 16.10.1, 16.4.6 and 15.10.16. Vulnerabilities: XWiki - SQL injection (CVE-2025-32968, CVSS 8.6), XWiki - SQL injection (CVE-2025-32969, CVSS 9.3), XWiki - introhttps://cyberfeed.cesnet.cz/reports/468?lang=enhttps://cyberfeed.cesnet.cz/reports/466?lang=enAcronis Cyber Protect Cloud Agent for Windows version C25.04 fixes 2 vulnerabilities. Vulnerabilities: Acronis Cyber Protect Cloud Agent - intro, Acronis Cyber Protect Cloud Agent - privilege escalation (CVE-2025-30408, CVSS 6.7), Acronis Cyber Protect Cloud Agent - DoS (CVE-2025-30409, CVSS 5.5)https://cyberfeed.cesnet.cz/reports/466?lang=enhttps://cyberfeed.cesnet.cz/reports/465?lang=enGitHub Enterprise Server fixes 3 vulnerabilities with versions 3.16.2, 3.15.6, 3.14.11 and 3.13.14. Vulnerabilities: GitHub Enterprise Server - intro, GitHub Enterprise Server - XSS (CVE-2025-3246, CVSS 8.6), GitHub Enterprise Server - RCE (CVE-2025-3509, CVSS 7.1), GitHub Enterprise Server - missing authorization (CVE-2025-3124, CVSS 5.3)https://cyberfeed.cesnet.cz/reports/465?lang=enhttps://cyberfeed.cesnet.cz/reports/464?lang=enGitLab fixes 5 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) in versions 17.11.1, 17.10.5 and 17.9.7. Vulnerabilities: GitLab CE/EE - XSS (CVE-2025-1763, CVE-2025-2443, CVSS 8.7), GitLab CE/EE - account takeover (CVE-2025-1908, CVSS 7.7), GitLab CE/EE - DoS (CVE-2025-0639, CVSS 6.5), GitLab CE/EE - information leak (CVE-2024-12244, CVSS 4.3), GitLab CE/EE - introhttps://cyberfeed.cesnet.cz/reports/464?lang=enhttps://cyberfeed.cesnet.cz/reports/463?lang=enZyxel version 1.32 fixes 2 vulnerabilities in the uOS firmware for USG FLEX H series firewalls. Vulnerabilities: Zyxel USG FLEX H - intro, Zyxel USG FLEX H uOS - privilege escalation (CVE-2025-1731, CVSS 7.8), Zyxel USG FLEX H uOS - privilege escalation (CVE-2025-1732, CVSS 6.7)https://cyberfeed.cesnet.cz/reports/463?lang=enhttps://cyberfeed.cesnet.cz/reports/462?lang=enApple fixes 2 vulnerabilities in the operating systems of some of its products. The company is aware of possible active exploitation of these vulnerabilities in extremely sophisticated attacks against specifically targeted individuals. Operating systems and their fixed versions: iOS and iPadOS - 18.4.1; macOS - 15.4.1; tvOS - 18.4.1; visionOS - 2.4.1. Vulnerabilities: Apple iOS, iPadOS, macOS, tvOS, visionOS - intro, Apple iOS, iPadOS, macOS, tvOS, visionOS - RCE (CVE-2025-31200, CVSS 7.5), Apple iOS, iPadOS, macOS, tvOS, visionOS - memory security bypass (CVE-2025-31201, CVSS 6.8)https://cyberfeed.cesnet.cz/reports/462?lang=enhttps://cyberfeed.cesnet.cz/reports/461?lang=enVulnerabilities: Juniper - introhttps://cyberfeed.cesnet.cz/reports/461?lang=enhttps://cyberfeed.cesnet.cz/reports/460?lang=enPalo Alto Networks fixes 8 vulnerabilities in its products. The most severe of them are described below; you can find the rest at. Products and their fixed versions: PAN-OS: - 10.1.14-h11, 10.2.13-h5, 10.2.14, 11.0.6, 11.1.8, 11.2.5. PAN-OS (VM-Series): - 10.1.14-h13, 10.2.9, 11.0.4. Prisma Access (PAN-OS): - 10.2.4-h36, 10.2.10-h16, 11.2.4-h5. Prisma SD-WAN: - 6.1.10, 6.3.4, 6.4.2, 6.5.1. GlobalProtect App (Windows): - 6.2.7-h3, 6.2.8, 6.3.3 (expected availability at the end of April 2025). Cortex XDR Agent (Windows): - 7.9.103-CE HF, 8.3.101-CE HF, 8.5.2, 8.6.1. Vulnerabilities: Palo Alto Networks - intro, Palo Alto Networks PAN-OS, Prisma Access - DoS (CVE-2025-0128, CVSS 8.7), Palo Alto Networks PAN-OS, Prisma Access - user impersonation (CVE-2025-0126, CVSS 8.3), Palo Alto Networks PAN-OS, Prisma Access - command execution (CVE-2025-0127, CVSS 7.1), Palo Alto Networks GlobalProtect App - privilege escalation (CVE-2025-0120, CVSS 7.1), Palo Alto Networks Prisma SD-WAN - DoS (CVE-2025-0122, CVSS 4.9)https://cyberfeed.cesnet.cz/reports/460?lang=enhttps://cyberfeed.cesnet.cz/reports/459?lang=enGitLab fixes 5 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) in versions 17.10.4, 17.9.6 and 17.8.7. Vulnerabilities: GitLab CE/EE - DoS (CVE-2025-1677, CVSS 6.5), GitLab CE/EE - unauthorized access (CVE-2025-0362, CVSS 6.4), GitLab CE/EE - sensitive information leak (CVE-2025-2408, CVSS 5.3), GitLab CE/EE - information leak (CVE-2024-11129, CVSS 5.3), GitLab CE/EE - information leak (CVE-2025-2469, CVSS 3.7), GitLab CE/EE - introhttps://cyberfeed.cesnet.cz/reports/459?lang=enhttps://cyberfeed.cesnet.cz/reports/457?lang=enIvanti Endpoint Manager fixes 6 vulnerabilities with versions 2022 SU7 and 2024 SU1. Vulnerabilities: Ivanti Endpoint Manager - intro, Ivanti Endpoint Manager - XSS, privilege escalation (CVE-2025-22466, CVSS 8.2), Ivanti Endpoint Manager - privilege escalation (CVE-2025-22458, CVSS 7.8), Ivanti Endpoint Manager - RCE (CVE-2025-22461, CVSS 7.2), Ivanti Endpoint Manager - XSS (CVE-2025-22465, CVSS 6.1), Ivanti Endpoint Manager - DoS (CVE-2025-22464, CVSS 6.1), Ivanti Endpoint Manager - MITM (CVE-2025-22459, CVSS 4.8)https://cyberfeed.cesnet.cz/reports/457?lang=enhttps://cyberfeed.cesnet.cz/reports/456?lang=enApple fixes over 140 vulnerabilities in its products. A selection of the most severe is below; the remaining ones are described at. Products and their fixed versions: macOS - 13.7.5, 14.7.5, 15.4 iOS - 15.8.4, 16.7.11, 18.4 iPadOS - 15.8.4, 16.7.11, 17.7.6, 18.4 watchOS - 11.4 tvOS - 18.4 visionOS - 2.4 Safari - 18.4 Xcode - 16.3 Vulnerabilities: Apple iOS, iPadOS, macOS, watchOS, tvOS, visionOS, Safari, Xcode - intro, Apple macOS - privilege escalation (CVE-2025-24234, CVE-2025-24277, CVSS 8.8), Apple macOS - RCE (CVE-2025-24228, CVSS 8.8), Apple iOS, iPadOS, macOS - privilege escalation (CVE-2025-30456, CVSS 8.8), Apple iOS, iPadOS, macOS, tvOS - privilege escalation (CVE-2025-24238, CVSS 7.8), Apple iOS, iPadOS, macOS, visionOS - DoS, kernel memory write (CVE-2025-24257, CVSS 8.1)https://cyberfeed.cesnet.cz/reports/456?lang=enhttps://cyberfeed.cesnet.cz/reports/455?lang=enFortinet fixes 11 vulnerabilities in various products. The most serious are listed below. Products and their fixed versions: FortiSwitch - 7.6.1, 7.4.5, 7.2.9, 7.0.11, 6.4.15 FortiAnalyzer - 7.6.2, 7.4.6, 7.2.9, 7.0.14, 6.4.15, 6.2.14 FortiManager - 7.6.2, 7.4.6, 7.2.9, 7.0.14, 6.4.15, 6.2.14 FortiOS - 7.6.0 FortiProxy - 7.4.3, 7.2.10, 7.0.16 FortiVoice - 7.0.3, 6.4.9 FortiWeb - 7.6.3, 7.4.7 FortiIsolator - 2.4.7 FortiClientEMS - 7.4.3 Vulnerabilities: FortiSwitch - admin password change (CVE-2024-48887, CVSS 9.8), FortiOS, FortiProxy, FortiManager, FortiAnalyzer, FortiVoice, FortiWeb - management device impersonation (CVE-2024-26013, CVE-2024-50565, CVSS 7.5), FortiIsolator - OS command injection (CVE-2024-54024, CVSS 7.2), FortiClientEMS - XSS (CVE-2025-22855, CVSS 2.7), Fortinet - introhttps://cyberfeed.cesnet.cz/reports/455?lang=enhttps://cyberfeed.cesnet.cz/reports/439?lang=enWebKitGTK and WPE WebKit version 2.48.1 fix 7 vulnerabilities. Apple operating systems and applications and their latest fixed versions: macOS - 15.4, 14.7.5, iOS - 18.4, iPadOS - 18.4, 17.7.6, Safari - 18.4, visionOS - 2.4, tvOS - 18.4. Vulnerabilities: WebKitGTK and WPE WebKit - intro, WebKitGTK and WPE WebKit - DoS (CVE-2025-24264, CVSS 6.5), WebKitGTK and WPE WebKit - DoS (CVE-2024-54551, CVSS 6.5), WebKitGTK and WPE WebKit - DoS (CVE-2025-24209, CVSS 5.3), WebKitGTK and WPE WebKit - memory corruption (CVE-2025-24213, CVSS 7.1), WebKitGTK and WPE WebKit - XSS (CVE-2025-24208, CVSS 6.1), WebKitGTK and WPE WebKit - DoS (CVE-2025-24216, CVSS 4.3), WebKitGTK and WPE WebKit - DoS (CVE-2025-30427, CVSS 4.3)https://cyberfeed.cesnet.cz/reports/439?lang=enhttps://cyberfeed.cesnet.cz/reports/438?lang=enRancher fixes a critical vulnerability with versions 2.8.14, 2.9.8, 2.10.4 and 2.11.0. Vulnerabilities: Rancher - intro, Rancher - Administrator account takeover (CVE-2025-23391, CVSS 9.1)https://cyberfeed.cesnet.cz/reports/438?lang=enhttps://cyberfeed.cesnet.cz/reports/437?lang=enXWiki version 8.6.5 fixes a high-severity vulnerability in the JIRA Macro extension. Vulnerabilities: XWiki - data leak (CVE-2025-31487 , CVSS 7.7), XWiki - introhttps://cyberfeed.cesnet.cz/reports/437?lang=enhttps://cyberfeed.cesnet.cz/reports/436?lang=enIvanti fixes a critical and already actively exploited vulnerability in its products. Products and their fixes: Ivanti Connect Secure - 22.7R2.6 Pulse Connect Secure (EoS) - 22.7R2.6 Ivanti Policy Secure - 22.7R1.4 (April 21) ZTA Gateways - 22.8R2.2 (April 19) Vulnerabilities: Ivanti Connect Secure, Policy Secure & ZTA Gateways - RCE (CVE-2025-22457, CVSS 9.0), Ivanti Connect Secure, Policy Secure and ZTA Gateways - introhttps://cyberfeed.cesnet.cz/reports/436?lang=enhttps://cyberfeed.cesnet.cz/reports/435?lang=enApache fixes 1 vulnerability in Apache Traffic Server in versions 9.2.10 and 10.0.5. None of the popular operating systems has released a fix yet, or they are not affected by the vulnerability. Vulnerabilities: Apache Traffic Server - request smuggling (CVE-2024-53868, CVSS 6.5), Apache Traffic Server - introhttps://cyberfeed.cesnet.cz/reports/435?lang=enhttps://cyberfeed.cesnet.cz/reports/434?lang=enCisco fixes 4 vulnerabilities in its products. Products and their fixes: Cisco Meraki MX Firmware - 18.107.12, 18.211.4, 19.1.4 Cisco Enterprise Chat and Email - 12.6 ES 10 Cisco Evolved Programmable Network Manager - 6.1.2.3, 7.1.3.1, 8.0.0.1 Cisco Prime Infrastructure - 3.10.6.1 Vulnerabilities: Cisco Meraki MX and Meraki Z Series - DoS (CVE-2025-20212, CVSS 7.7), Cisco Enterprise Chat and Email - DoS (CVE-2025-20139, CVSS 7.5), Cisco EPNM and Cisco Prime Infrastructure - stored XSS (CVE-2025-20120, CVSS 6.1), Cisco EPNM and Cisco Prime Infrastructure - stored XSS (CVE-2025-20203, CVSS 4.8), Cisco - introhttps://cyberfeed.cesnet.cz/reports/434?lang=enhttps://cyberfeed.cesnet.cz/reports/433?lang=enPexip Infinity fixes 2 vulnerabilities in version 37.0. The vulnerability CVE-2024-12084 originally affects the rsync software, which Pexip Infinity uses, so it is also affected by this vulnerability in a limited form. Vulnerabilities: Pexip Infinity - DoS (CVE-2025-30080, CVSS 7.5), Pexip Infinity - out-of-bounds write (CVE-2024-12084, CVSS 7.8), Pexip Infinity - introhttps://cyberfeed.cesnet.cz/reports/433?lang=enhttps://cyberfeed.cesnet.cz/reports/432?lang=enOpenVPN fixes 1 vulnerability in version 2.6.14. None of the popular operating systems has released a fix yet. Vulnerabilities: OpenVPN - DoS (CVE-2025-2704, CVSS 7.5), OpenVPN - introhttps://cyberfeed.cesnet.cz/reports/432?lang=enhttps://cyberfeed.cesnet.cz/reports/431?lang=enZabbix fixes 5 vulnerabilities, two of which are high-severity. The fixes can be found in the links next to the individual vulnerabilities. Vulnerabilities: Zabbix - SQL injection (CVE-2024-36465, CVSS 8.0), Zabbix - reflected XSS (CVE-2024-45699, CVSS 7.5), Zabbix - DoS (CVE-2024-45700, CVSS 6.5), Zabbix - observable timing discrepancy (CVE-2024-36469, CVSS 3.1), Zabbix - information disclosure (CVE-2024-42325, CVSS 3.5), Zabbix - introhttps://cyberfeed.cesnet.cz/reports/431?lang=enhttps://cyberfeed.cesnet.cz/reports/430?lang=enMongoDB fixes 1 vulnerability in versions 5.0.31, 6.0.20 and 7.0.16. Vulnerabilities: MongoDB - DoS (CVE-2025-3083, CVSS 7.5), MongoDB - introhttps://cyberfeed.cesnet.cz/reports/430?lang=enhttps://cyberfeed.cesnet.cz/reports/429?lang=enVMware version 8.18 HF 5 fixes a high-severity vulnerability in its products VMware Aria Operations, VMware Telco Cloud Platform and VMware Telco Cloud Infrastructure. For VMware Cloud Foundation, follow KB92148. Vulnerabilities: VMware Aria Operations - local privilege escalation (CVE-2025-22231, CVSS 7.8), VMware Aria Operations - introhttps://cyberfeed.cesnet.cz/reports/429?lang=enhttps://cyberfeed.cesnet.cz/reports/428?lang=enApache fixes a vulnerability in ActiveMQ Artemis in version 2.40. Vulnerabilities: Apache ActiveMQ Artemis - message smuggling (CVE-2025-27427, CVSS 2.3), Apache ActiveMQ Artemis - introhttps://cyberfeed.cesnet.cz/reports/428?lang=enhttps://cyberfeed.cesnet.cz/reports/427?lang=enCisco Smart Licensing Utility version 2.3.0 fixes 2 critical vulnerabilities. The vulnerability CVE-2024-20439 has been added to CISA's Known Exploited Vulnerabilities catalog. Vulnerabilities: Cisco Smart License Utility - hardcoded credentials (CVE-2024-20439, CVSS 9.8), Cisco Smart License Utility - sensitive information disclosure (CVE-2024-20440, CVSS 9.8), Cisco Smart License Utility - introhttps://cyberfeed.cesnet.cz/reports/427?lang=enhttps://cyberfeed.cesnet.cz/reports/426?lang=enSplunk fixes 7 vulnerabilities in 2 products. The most severe of them are listed below; the remaining ones can be found at. Individual products and their fixed versions: Splunk Enterprise - 9.4.1, 9.3.3, 9.2.5, 9.1.8 Splunk Cloud Platform - 9.3.2408.107, 9.2.2406.113, 9.2.2403.115, 9.1.2312.208, 9.1.2308.214 Splunk Secure Gateway - 3.8.38, 3.7.23 Vulnerabilities: Splunk Enterprise, Cloud Platform - RCE (CVE-2025-20229, CVSS 8.0), Splunk Enterprise, Secure Gateway - information disclosure (CVE-2025-20231, CVSS 7.1), Splunk - introhttps://cyberfeed.cesnet.cz/reports/426?lang=enhttps://cyberfeed.cesnet.cz/reports/425?lang=enMozilla fixes a critical vulnerability in Firefox for Windows. Products and their fixes: Firefox - 136.0.4 Firefox ESR - 115.21.1, 128.8.1 Vulnerabilities: Mozilla Firefox, Firefox ESR - sandbox escape (CVE-2025-2857, CVSS 10.0), Mozilla Firefox, Firefox ESR - introhttps://cyberfeed.cesnet.cz/reports/425?lang=enhttps://cyberfeed.cesnet.cz/reports/424?lang=enGitLab versions 17.10.1, 17.9.3 and 17.8.6 fix 7 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE). The most severe ones are described below; the remaining vulnerabilities can be found at. Vulnerabilities: GitLab CE/EE - intro, GitLab CE/EE - XSS (CVE-2025-2255, CVSS 8.7), GitLab CE/EE - XSS (CVE-2025-0811, CVSS 8.7), GitLab CE/EE - unauthorized access (CVE-2025-2242, CVSS 7.5), GitLab CE/EE - unauthorized access (CVE-2024-12619, CVSS 5.2)https://cyberfeed.cesnet.cz/reports/424?lang=enhttps://cyberfeed.cesnet.cz/reports/423?lang=enExim fixes 1 vulnerability in version 4.98.2. Exim is the default MTA (Mail Transfer Agent) for Debian and its derived distributions. Debian has not released a fix only for Bookworm stable; the other Debian and Ubuntu releases are either fixed or not affected by the vulnerability. Gentoo has not yet released a fix. Individual OS releases and their fixed versions: Debian: bookworm (security) - 4.96-15+deb12u7 sid, trixie - 4.98.1-2 Ubuntu: oracular - 4.98-1ubuntu2.1 noble - 4.97-4ubuntu4.3 Vulnerabilities: Exim - use-after-free (CVE-2025-30232, CVSS 7.8), Exim - introhttps://cyberfeed.cesnet.cz/reports/423?lang=enhttps://cyberfeed.cesnet.cz/reports/422?lang=enIcinga fixes 6 vulnerabilities in its products. The most severe ones are described below; the rest can be found at. Products and their fixed versions: Icinga Web - 2.12.3 and 2.11.5 Icinga Director - 1.11.4 and 1.10.4 Icinga Reporting - 1.0.3 Vulnerabilities: Icinga Web, Director and Reporting - intro, Icinga Web - XSS (CVE-2025-27404, CVE-2025-27405, CVSS 8.3), Icinga Reporting - XSS, SSRF (CVE-2025-27406, CVSS 8.3), Icinga Director - unauthorized access, information disclosure (CVE-2025-23203, CVSS 5.5)https://cyberfeed.cesnet.cz/reports/422?lang=enhttps://cyberfeed.cesnet.cz/reports/421?lang=eningress-nginx, a controller for Kubernetes, fixes 5 vulnerabilities in versions 1.11.5 and 1.12.1. Vulnerabilities: Kubernetes ingress-nginx - secrets leak (CVE-2025-1974, CVSS 9.8), Kubernetes ingress-nginx - unauthorized configuration change (CVE-2025-1098, CVE-2025-1097, CVE-2025-24514, CVSS 8.8), Kubernetes ingress-nginx - intro, Kubernetes ingress-nginx - directory traversal (CVE-2025-24513, CVSS 4.8)https://cyberfeed.cesnet.cz/reports/421?lang=enhttps://cyberfeed.cesnet.cz/reports/420?lang=enVMware Tools for Windows version 12.5.1 fixes a high-severity vulnerability. Vulnerabilities: VMware Tools - intro, VMware Tools - authentication bypass (CVE-2025-22230, CVSS 7.8)https://cyberfeed.cesnet.cz/reports/420?lang=enhttps://cyberfeed.cesnet.cz/reports/419?lang=enWebKitGTK and WPE WebKit version 2.48.0 fix 3 vulnerabilities, one of which is actively exploited. Apple operating systems and their latest fixed versions: macOS - 15.3.2, iOS and iPadOS - 18.3.2, Safari - 18.3.1, visionOS - 2.3.2, tvOS - 18.3.1, watchOS - 11.3.1. Individual Debian releases and fixed product versions: bookworm (security) - 2.48.0-1~deb12u1 (package webkit2gtk), trixie, sid - 2.48.0-1 (packages webkit2gtk and wpewebkit). For CVE-2025-24201, fixes are also available from Red Hat. Vulnerabilities: WebKitGTK and WPE WebKit - intro, WebKitGTK and WPE WebKit - sandbox escape (CVE-2025-24201, CVSS 7.5), WebKitGTK and WPE WebKit - DoS (CVE-2024-44192, CVSS 6.5), WebKitGTK and WPE WebKit - data exfiltration (CVE-2024-54467, CVSS 6.5)https://cyberfeed.cesnet.cz/reports/419?lang=enhttps://cyberfeed.cesnet.cz/reports/418?lang=enPHP fixes 6 vulnerabilities in versions 8.1.32, 8.2.28, 8.3.19 and 8.4.5. The vulnerabilities have been fixed by Debian, and Gentoo has version 8.2.28 available for some architectures. Individual Debian releases and their fixed PHP versions: bullseye (security) - 7.4.33-1+deb11u8 bookworm (security) - 8.2.28-1~deb12u1 Vulnerabilities: PHP - document validation bypass (CVE-2025-1219, CVSS 6.3), PHP - use-after-free (CVE-2024-11235, CVSS 9.2), PHP - improper newline neutralization (CVE-2025-1736, CVSS 6.3), PHP - web redirection (CVE-2025-1861, CVSS 6.3), PHP - response smuggling (CVE-2025-1734, CVSS 6.3), PHP - response smuggling (CVE-2025-1217, CVSS 6.3), PHP - introhttps://cyberfeed.cesnet.cz/reports/418?lang=enhttps://cyberfeed.cesnet.cz/reports/413?lang=enVMware fixes two vulnerabilities in Spring Security with versions 5.7.16, 5.8.18, 6.0.16, 6.1.14, 6.2.10, 6.3.8 and 6.4.4. Vulnerabilities: VMware Spring - authentication bypass (CVE-2025-22228, CVSS 7.4), VMware Spring - intro, VMware Spring Security - authorization bypass (CVE-2025-22223, CVSS 5.3)https://cyberfeed.cesnet.cz/reports/413?lang=enhttps://cyberfeed.cesnet.cz/reports/412?lang=enGitHub Action tj-actions/changed-files version 46.0.1 fixes a high-severity vulnerability. Vulnerabilities: GitHub tj-actions/changed-files - intro, GitHub tj-actions/changed-files - sensitive information disclosure (CVE-2025-30066, CVSS 8.6)https://cyberfeed.cesnet.cz/reports/412?lang=enhttps://cyberfeed.cesnet.cz/reports/411?lang=enVeeam Backup & Replication version 12.3.1 (build 12.3.1.1139) fixes a critical vulnerability. Vulnerabilities: Veeam Backup & Replication - RCE (CVE-2025-23120, CVSS 9.9), Veeam Backup & Replication - introhttps://cyberfeed.cesnet.cz/reports/411?lang=enhttps://cyberfeed.cesnet.cz/reports/410?lang=enlibexpat fixes a high-severity vulnerability in version 2.7.0, which so far has been fixed only by Gentoo. Debian, Ubuntu and Red Hat have not yet released a fix for the library itself, but the software on those operating systems that uses the library is either not affected, no fix is planned, or the vulnerability check has not yet been carried out. Vulnerabilities: libexpat - DoS (CVE-2024-8176, CVSS 7.5), libexpat - introhttps://cyberfeed.cesnet.cz/reports/410?lang=enhttps://cyberfeed.cesnet.cz/reports/409?lang=enFortinet fixes a large number of vulnerabilities in various products. The most severe ones are listed below. Individual products and their fixed versions: FortiSandbox - 5.0.1, 4.4.7, 4.2.8, 4.0.6 FortiIsolator - 2.4.6 FortiADC - 7.4.1, 7.2.2, 7.1.4 FortiSIEM - 6.7.5, 6.6.4, 6.5.2, 6.4.3 FortiOS - 7.6.1, 7.4.5, 7.2.10, 7.0.16, 6.4.16 FortiProxy - 7.6.1, 7.4.7, 7.2.13, 7.0.20 FortiNDR - 7.4.1, 7.2.2, 7.1.2, 7.0.6 FortiPAM - 1.4.3, 1.3.2 FortiSRA - 1.4.3 FortiWeb - 7.6.1, 7.4.6, 7.2.11, 7.0.11 Vulnerabilities: Fortinet FortiSandbox - OS command injection (CVE-2024-52961, CVSS 8.8), Fortinet FortiIsolator - OS command injection (CVE-2024-55590, CVSS 8.8), Fortinet FortiADC GUI - XSS (CVE-2023-37933, CVSS 8.8), Fortinet FortiSIEM - sensitive information exposure (CVE-2023-40723, CVSS 8.1), Fortinet FortiSandbox - CLI command execution (CVE-2024-45328, CVSS 7.8), Fortinet Forti OS and FortiProxy - XSS (CVE-2024-26006, CVSS 7.5), Fortinet FortiNDR - cross site request forgery (CVE-2023-48790, CVSS 7.5), Fortinet FortiOS, FortiProxy, FortiPAM, FortiSRA and FortiWeb - remote command execution (CVE-2024-45324, CVSS 7.2), Fortinet FortiSandbox - unauthorized command execution (CVE-2024-54018, CVSS 7.2), Fortinet - intro, Fortinet FortiOS - privilege escalation (CVE-2024-40591, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/409?lang=enhttps://cyberfeed.cesnet.cz/reports/408?lang=enCisco fixes several vulnerabilities in its Cisco IOS, IOS XE and IOS XR Software products. The most severe are described below; the remaining vulnerabilities can be found at. Vulnerable products and their fixed versions can be found in the link for each vulnerability. Vulnerabilities: Cisco - intro, Cisco IOS XR Software - privilege escalation (CVE-2025-20138, CVSS 8.8), Cisco IOS XR Software - denial of service (CVE-2025-20142, CVSS 8.6), Cisco IOS XR Software - denial of service (CVE-2025-20146, CVSS 8.6), Cisco IOS, IOS XE, IOS XR Software - denial of service ( CVE-2025-20169, CVE-2025-20170, CVE-2025-20171, CVE-2025-20172, CVE-2025-20173, CVE-2025-20174, CVE-2025-20175, CVE-2025-20176, CVSS 7.7), Cisco IOS XR Software - Secure Boot bypass (CVE-2025-20143, CVSS 6.7), Cisco IOS XR Software - image verification bypass (CVE-2025-20177, CVSS 6.7), Cisco IOS XR Software - denial of service (CVE-2025-20115, CVSS 8.6), Cisco IOS XR Software - denial of service (CVE-2025-20209, CVSS 7.5), Cisco IOS XR Software - denial of service (CVE-2025-20141, CVSS 7.4)https://cyberfeed.cesnet.cz/reports/408?lang=enhttps://cyberfeed.cesnet.cz/reports/407?lang=enPalo Alto Networks fixes 5 vulnerabilities in its products. The most severe ones are described below; the rest can be found at. Products and their fixed versions: PAN-OS - 10.1.14-h11; - 10.2.13-h5, 10.2.14 (expected availability 3.4.2025); - 11.0.6; - 11.1.8; - 11.2.5; GlobalProtect App (for Windows) - 6.2.6; - 6.3.3 (expected availability in April 2025). Vulnerabilities: Palo Alto Networks - intro, Palo Alto Networks PAN-OS - DoS (CVE-2025-0114, CVSS 4.6), Palo Alto Networks GlobalProtect App - privilege escalation (CVE-2025-0117, CVSS 4.3), Palo Alto Networks PAN-OS - arbitrary file read (CVE-2025-0115, CVSS 4.3), Palo Alto Networks PAN-OS - DoS (CVE-2025-0116, CVSS 4.3)https://cyberfeed.cesnet.cz/reports/407?lang=enhttps://cyberfeed.cesnet.cz/reports/406?lang=enJuniper Networks fixes a medium-severity vulnerability in Junos OS. Fixed product versions: 21.2R3-S9 (future release), 21.4R3-S10, 22.2R3-S6, 22.4R3-S6, 23.2R2-S3, 23.4R2-S4 (future release), 24.2R1-S2, 24.2R2, 24.4R1. Vulnerabilities: Juniper Networks Junos OS - RCE (CVE-2025-21590, CVSS 6.7), Juniper Networks Junos OS - introhttps://cyberfeed.cesnet.cz/reports/406?lang=enhttps://cyberfeed.cesnet.cz/reports/405?lang=enApple fixes a high-severity vulnerability in its products. The company is aware of possible active exploitation of this vulnerability in specifically targeted, highly sophisticated attacks. Products and their fixed versions: macOS - 15.3.2 iOS and iPadOS - 18.3.2 Safari - 18.3.1 visionOS - 2.3.2 Vulnerabilities: Apple macOS, iOS, iPadOS, Safari, visionOS - intro, Apple macOS, iOS, iPadOS, Safari, visionOS - sandbox escape (CVE-2025-24201, CVSS 7.5)https://cyberfeed.cesnet.cz/reports/405?lang=enhttps://cyberfeed.cesnet.cz/reports/404?lang=enGitLab versions 17.9.2, 17.8.5 and 17.7.7 fix 9 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE). The most severe ones are described below; the remaining vulnerabilities can be found at. Vulnerabilities: GitLab CE/EE - intro, GitLab CE/EE - authentication bypass (CVE-2025-25291, CVE-2025-25292, CVSS 8.8), GitLab CE/EE - RCE (CVE-2025-27407, CVSS 9.0), GitLab EE - DoS (CVE-2025-1257, CVSS 6.5), GitLab CE/EE - DoS (CVE-2024-13054, CVSS 5.7), GitLab CE/EE - credential disclosure (CVE-2024-12380, CVSS 4.4)https://cyberfeed.cesnet.cz/reports/404?lang=enhttps://cyberfeed.cesnet.cz/reports/403?lang=enIvanti fixes a high-severity vulnerability in Ivanti Secure Access Client with versions 22.7R4 and 22.8R1. Vulnerabilities: Ivanti Secure Access Client - privilege escalation (CVE-2025-22454, CVSS 7.8), Ivanti Secure Access Client - introhttps://cyberfeed.cesnet.cz/reports/403?lang=enhttps://cyberfeed.cesnet.cz/reports/402?lang=enThe Apache Software Foundation fixes a vulnerability in Apache Tomcat with versions 11.0.3, 10.1.35 and 9.0.99. The fix is also available in the Apache Tomcat GitHub repository in commit 0a668e0. Vulnerabilities: Apache Tomcat - intro, Apache Tomcat - information disclosure/corruption, RCE (CVE-2025-24813, CVSS 8.7)https://cyberfeed.cesnet.cz/reports/402?lang=enhttps://cyberfeed.cesnet.cz/reports/401?lang=enZyxel fixes 3 high-severity vulnerabilities in its products. Information about the specific products and fixed versions can be found at. It is important to note that WAN access is disabled by default and the attack is only possible if a strong administrator password is compromised. Vulnerabilities: Zyxel DSL/Ethernet CPE firmware - post-authentication command injection (CVE-2024-11253, CVSS 7.2), Zyxel DSL/Ethernet CPE, fiber ONT and WiFi extender firmware - post-authentication command injection (CVE-2024-12009, CVSS 7.2), Zyxel DSL/Ethernet CPE, fiber ONT and WiFi extender firmware - post-authentication command injection (CVE-2024-12010, CVSS 7.2), Zyxel - introhttps://cyberfeed.cesnet.cz/reports/401?lang=enhttps://cyberfeed.cesnet.cz/reports/400?lang=enXWiki fixes 2 vulnerabilities in Confluence Migrator Pro with versions 1.2 and 1.11.7. Vulnerabilities: XWiki - RCE (CVE-2025-27603, CVSS 9.1), XWiki - information disclosure (CVE-2025-27604, CVSS 7.5), XWiki - introhttps://cyberfeed.cesnet.cz/reports/400?lang=enhttps://cyberfeed.cesnet.cz/reports/399?lang=enApache fixes 4 vulnerabilities in Apache Traffic Server with versions 10.0.4 and 9.2.9. Vulnerabilities: Apache Traffic Server - intro, Apache Traffic Server - request smuggling (CVE-2024-38311, CVSS 6.3), Apache Traffic Server - improper access control (CVE-2024-56195, CVSS 6.3), Apache Traffic Server - improper access control (CVE-2024-56196, CVSS 6.3), Apache Traffic Server - DoS (CVE-2024-56202, CVSS 4.3)https://cyberfeed.cesnet.cz/reports/399?lang=enhttps://cyberfeed.cesnet.cz/reports/398?lang=enLibreOffice fixes 2 vulnerabilities with versions 24.8.5 and 25.2.1. Vulnerabilities: LibreOffice - improper input validation (CVE-2025-0514, CVSS 6.5), LibreOffice - arbitrary argument execution (CVE-2025-1080, CVSS 7.6), LibreOffice - introhttps://cyberfeed.cesnet.cz/reports/398?lang=enhttps://cyberfeed.cesnet.cz/reports/397?lang=enJenkins fixes 4 vulnerabilities with versions 2.500 (weekly release) and 2.492.2 (LTS release). Vulnerabilities: Jenkins - intro, Jenkins - information disclosure (CVE-2025-27622, CVE-2025-27623, CVSS 4.3), Jenkins - CSRF (CVE-2025-27624, CVSS 5.4), Jenkins - open redirect (CVE-2025-27625, CVSS 4.3)https://cyberfeed.cesnet.cz/reports/397?lang=enhttps://cyberfeed.cesnet.cz/reports/396?lang=enCisco fixes a high-severity vulnerability in its Cisco Secure Client for Windows product with version 5.1.8.105. The company also draws attention to a vulnerability in Cisco TelePresence Management Suite, which has already reached end of life. As no further updates will be released for this software, it recommends that customers review the official end-of-support announcement. Vulnerabilities: Cisco Secure Client for Windows - arbitrary code execution (CVE-2025-20206, CVSS 7.1), Cisco TelePresence Management Suite - XSS (CVE-2025-20208, CVSS 4.6), Cisco - introhttps://cyberfeed.cesnet.cz/reports/396?lang=enhttps://cyberfeed.cesnet.cz/reports/395?lang=enElastic fixes a critical vulnerability in Kibana with version 8.17.3. Vulnerabilities: Elastic Kibana - RCE (CVE-2025-25015, CVSS 9.9), Elastic Kibana - introhttps://cyberfeed.cesnet.cz/reports/395?lang=enhttps://cyberfeed.cesnet.cz/reports/394?lang=enVMware fixes 1 critical and 2 high-severity vulnerabilities in its products VMware ESXi, Workstation and Fusion. Vulnerable products and their fixes: VMware ESXi - ESXi80U3d-24585383, ESXi80U2d-24585300, ESXi70U3s-24585291 VMware Workstation - 17.6.3 VMware Fusion - 13.6.3 Remediation procedures for products within the VMware Cloud Foundation and Telco Cloud Platform cloud platforms are available at. Vulnerabilities: VMware ESXi, Workstation - VMCI heap overflow (CVE-2025-22224, CVSS 9.3), VMware ESXi - arbitrary write (CVE-2025-22225, CVSS 8.2), VMware ESXi, Workstation, Fusion - information disclosure (CVE-2025-22226, CVSS 7.1), VMware - introhttps://cyberfeed.cesnet.cz/reports/394?lang=enhttps://cyberfeed.cesnet.cz/reports/393?lang=enEmacs fixes 2 high-severity vulnerabilities with version 30.1. Among operating systems, a fix has been released, for example, by Slackware as SSA:2025-057-01 and by Debian in version 1:27.1+1-3.1+deb11u6 for the bullseye (security) release, 1:28.2+1-15+deb12u4 for bookworm (security) and 1:30.1+1-3 for sid and trixie. Red Hat provided a fix for CVE-2025-1244. Gentoo offers version 30.1 as a testing version. Vulnerabilities: Emacs - intro, Emacs - command execution (CVE-2025-1244, CVSS 8.8), Emacs - RCE (CVE-2024-53920, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/393?lang=enhttps://cyberfeed.cesnet.cz/reports/392?lang=enRancher fixes 2 high-severity vulnerabilities with versions 2.8.13, 2.9.7 and 2.10.3. Vulnerabilities: Rancher - intro, Rancher - privilege escalation (CVE-2025-23389, CVSS 8.4), Rancher - DoS (CVE-2025-23388, CVSS 8.2)https://cyberfeed.cesnet.cz/reports/392?lang=enhttps://cyberfeed.cesnet.cz/reports/391?lang=enVim fixes a high-severity vulnerability with version 9.1.1164. Vulnerabilities: Vim - arbitrary command execution (CVE-2025-27423, CVSS 7.1), Vim - introhttps://cyberfeed.cesnet.cz/reports/391?lang=enhttps://cyberfeed.cesnet.cz/reports/390?lang=enHP fixes 3 vulnerabilities in HP LaserJet Pro, HP LaserJet Enterprise and HP LaserJet Managed printers. An overview of all vulnerable devices and their fixes can be found at. The relevant fixed firmware is available for download at. Vulnerabilities: HP LaserJet Pro, Enterprise, Managed Printers - intro, HP LaserJet Pro, Enterprise, Managed Printers - RCE, privilege escalation (CVE-2025-26506, CVSS 9.2), HP LaserJet Pro, Enterprise, Managed Printers - RCE, privilege escalation (CVE-2025-26508, CVSS 8.3), HP LaserJet Pro, Enterprise, Managed Printers - RCE, privilege escalation (CVE-2025-26507, CVSS 6.3)https://cyberfeed.cesnet.cz/reports/390?lang=enhttps://cyberfeed.cesnet.cz/reports/389?lang=enCitrix fixes 3 vulnerabilities in various products. Individual products and their fixed versions: Citrix NetScaler Console - 14.1-38.53, 13.1-56.18 Citrix NetScaler Agent - 14.1-38.53, 13.1-56.18 Citrix Secure Access Client for Mac - 25.01.2 Vulnerabilities: Citrix NetScaler Console, Agent - privilege escalation (CVE-2024-12284, CVSS 7.6), Citrix Secure Access Client for Mac - (CVE-2025-1222, CVE-2025-1223, CVSS 7.3), Citrix - introhttps://cyberfeed.cesnet.cz/reports/389?lang=enhttps://cyberfeed.cesnet.cz/reports/388?lang=enMattermost fixes 5 vulnerabilities, 3 of them critical, with versions 10.5.0, 10.4.2, 10.3.3, 10.2.3 and 9.11.8. The most serious of them are listed below; the rest can be found at. Vulnerabilities: Mattermost - intro, Mattermost - arbitrary file read (CVE-2025-25279, CVSS 9.1), Mattermost - arbitrary file read (CVE-2025-20051, CVSS 9.1), Mattermost - SQL injection (CVE-2025-24490, CVSS 9.6), Mattermost - improper access (CVE-2025-24526, CVSS 4.3)https://cyberfeed.cesnet.cz/reports/388?lang=enhttps://cyberfeed.cesnet.cz/reports/386?lang=enCisco fixes 8 vulnerabilities in various products. Individual products and their fixed versions: Cisco Application Policy Infrastructure Controller (APIC) - 6.0(8e), 6.1(2f). Cisco BroadWorks Call Center - 24_2025.01_1.310, 26_2025.01_1.310 Cisco BroadWorks BroadWorks - 24_2025.01_1.310, 26_2025.01_1.310 Cisco AsyncOS (Secure Email Gateway) - 16-0-0-054 The remaining fixed versions can be obtained at, where on the first page you need to enter the type and version of your product. On the next page, select all impact ratings and all security advisories. On the last page, select the highest of the displayed fixed versions and update your affected product to it. Vulnerabilities: Cisco Nexus 3000, 9000 - OS command injection (CVE-2025-20161, CVSS 5.1), Cisco Nexus 3000, 9000 - DoS (CVE-2025-20111, CVSS 7.4), Cisco APIC - DoS (CVE-2025-20119, CVSS 6.0), Cisco APIC - OS command execution (CVE-2025-20117, CVSS 5.1), Cisco APIC - XSS (CVE-2025-20116, CVSS 4.8), Cisco APIC - information disclosure (CVE-2025-20118, CVSS 4.4), Cisco BroadWorks Call Center/Receptionist - XSS (CVE-2025-20211, CVSS 6.1), Cisco AsyncOS (Secure Email Gateway) - filter bypass (CVE-2025-20153, CVSS 5.8), Cisco - introhttps://cyberfeed.cesnet.cz/reports/386?lang=enhttps://cyberfeed.cesnet.cz/reports/385?lang=enGitLab fixes 5 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) with versions 17.9.1, 17.8.4 and 17.7.6. Vulnerabilities: GitLab CE/EE - intro, GitLab CE/EE - XSS (CVE-2025-0475, CVSS 8.7), GitLab EE - XSS (CVE-2025-0555, CVSS 7.7), GitLab CE/EE - XSS (CVE-2024-8186, CVSS 5.4), GitLab EE - improper authorization (CVE-2024-10925, CVSS 5.3), GitLab EE - improper authorization (CVE-2025-0307, CVSS 4.3)https://cyberfeed.cesnet.cz/reports/385?lang=enhttps://cyberfeed.cesnet.cz/reports/384?lang=enX.Org X server with version 21.1.16 and Xwayland with version 24.1.6 fix 8 vulnerabilities. The fixes are also available in commits, a list of which can be found at. Among operating systems, a fix has been released by Slackware as SSA:2025-056-01 and by Ubuntu. Debian released a fix only for the unstable sid distribution in version 2:21.1.16-1 (package xorg-server) and 2:24.1.6-1 (package xwayland); Gentoo fixed the vulnerabilities in testing versions. Individual Ubuntu releases (packages in the order xorg-server and xwayland) and fixed product versions: oracular - 2:21.1.13-2ubuntu1.2 and 2:24.1.2-1ubuntu0.4; noble - 2:21.1.12-1ubuntu1.2 and 2:23.2.6-1ubuntu0.4; jammy - 2:21.1.4-2ubuntu1.7~22.04.13 and 2:22.1.1-1ubuntu0.17; focal - 2:1.20.13-1ubuntu1~20.04.19 (xorg-server). Vulnerabilities: X.Org X server and Xwayland - intro, X.Org X server and Xwayland - use-after-free (CVE-2025-26594, CVE-2025-26600, CVE-2025-26601, CVSS 7.8), X.Org X server and Xwayland - out-of-bounds access (CVE-2025-26595, CVE-2025-26596, CVE-2025-26597, CVE-2025-26598, CVSS 7.8), X.Org X server and Xwayland - uninitialized pointer access (CVE-2025-26599, CVSS 7.8)https://cyberfeed.cesnet.cz/reports/384?lang=enhttps://cyberfeed.cesnet.cz/reports/383?lang=enXWiki fixes a critical vulnerability in versions 15.10.11, 16.4.1 and 16.5.0-rc-1. Vulnerabilities: XWiki - RCE (CVE-2025-24893, CVSS 9.8), XWiki - introhttps://cyberfeed.cesnet.cz/reports/383?lang=enhttps://cyberfeed.cesnet.cz/reports/382?lang=enLibreOffice fixes two vulnerabilities with version 24.8.4. Detailed information and a PoC for them are available at. Vulnerabilities: LibreOffice - intro, LibreOffice - sensitive information disclosure (CVE-2024-12426, CVSS 8.3), LibreOffice - file write (CVE-2024-12425, CVSS 5.3)https://cyberfeed.cesnet.cz/reports/382?lang=enhttps://cyberfeed.cesnet.cz/reports/381?lang=enWinZip fixes a high-severity vulnerability with version 29.0. Vulnerabilities: WinZip - intro, WinZip - RCE (CVE-2025-1240, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/381?lang=enhttps://cyberfeed.cesnet.cz/reports/380?lang=enExim fixes a high-severity vulnerability in version 4.98.1. The most widespread operating system releases do not contain the vulnerable version of Exim. Vulnerabilities: Exim - SQL injection útok (CVE 2025-26794, CVSS 7.5), Exim - introhttps://cyberfeed.cesnet.cz/reports/380?lang=enhttps://cyberfeed.cesnet.cz/reports/379?lang=enFortinet fixes 13 vulnerabilities in various products. The most severe of them are listed below. Individual products and their fixed versions: FortiOS - 7.0.17 FortiProxy - 7.2.13, 7.0.20 FortiPortal - 7.4.3, 7.2.7, 7.0.12 FortiWeb - 7.6.1, 7.4.6 FortiSandbox - 4.4.5, 4.2.7, 4.0.5 FortiAnalyzer - 7.4.4, 7.2.6 FortiAnalyzer Cloud - 7.4.4, 7.2.6 FortiAnalyzer-BigData - 7.4.1, 7.2.8 FortiManager - 7.4.4, 7.2.6 FortiManager Cloud - 7.4.4, 7.2.6 FortiSIEM - migrate to an unaffected version (e.g. 7.3, 6.6, 5.4) FortiPAM - 1.2.0 FortiSwitchManager - 7.2.3, 7.0.3 Vulnerabilities: Fortinet FortiOS, FortiProxy - authentication bypass (CVE-2024-55591, CVE-2025-24472, CVSS 9.8), Fortinet FortiPortal - source code leak (CVE-2025-24470, CVSS 8.6), Fortinet FortiWeb - OS command injection (CVE-2024-50567, CVE-2024-50569, CVSS 7.2), Fortinet FortiSandbox - XSS (CVE-2024-27781, CVSS 7.1), Fortinet FortiAnalyzer, FortiManager - OS command execution (CVE-2024-40584, CVSS 7.2), Fortinet FortiSIEM - XSS (CVE-2024-27780, CVSS 2.6), Fortinet FortiOS, FortiSwitchManager, FortiProxy a FortiPAM - RCE (CVE-2023-40721, CVSS 6.7), Fortinet - introhttps://cyberfeed.cesnet.cz/reports/379?lang=enhttps://cyberfeed.cesnet.cz/reports/378?lang=enPalo Alto Networks fixes 6 vulnerabilities in its products. Two of them have already been added to CISA's Known Exploited Vulnerabilities catalog. Products and their fixed versions: PAN-OS 10.1 - 10.1.14-h9; 10.2 - 10.2.7-h24, 10.2.8-h21, 10.2.9-h21, 10.2.10-h14, 10.2.11-h12, 10.2.12-h6, 10.2.13-h3; 11.1 - 11.1.2-h18, 11.1.4-h13, 11.1.6-h1; 11.2 - 11.2.4-h4, 11.2.5; PAN-OS OpenConfig plugin - 2.1.2; Cortex XDR Broker VM - 26.0.116; Cortex XDR Agent (for Windows) - 8.3.101-CE, 8.5.1, 8.6 and later. Vulnerabilities: Palo Alto Networks - intro, Palo Alto Networks PAN-OS - authentication bypass, PHP script invocation (CVE-2025-0108, CVSS 8.8), Palo Alto Networks PAN-OS OpenConfig Plugin - command execution (CVE-2025-0110, CVSS 7.3), Palo Alto Networks PAN-OS - file read (CVE-2025-0111, CVSS 7.1), Palo Alto Networks PAN-OS - unauthenticated file deletion (CVE-2025-0109, CVSS 5.5), Palo Alto Networks Cortex XDR Broker VM - unauthorized access (CVE-2025-0113, CVSS 4.9), Palo Alto Networks Cortex XDR Agent - agent disablement (CVE-2025-0112, CVSS 4.3)https://cyberfeed.cesnet.cz/reports/378?lang=enhttps://cyberfeed.cesnet.cz/reports/377?lang=enPostgreSQL versions 17.4, 16.8, 15.12, 14.17 and 13.20 fix a regression of a high-severity vulnerability originally fixed on 13 February 2025. Vulnerabilities: PostgreSQL - intro, PostgreSQL - SQL injection (CVE-2025-1094, CVSS 8.1)https://cyberfeed.cesnet.cz/reports/377?lang=enhttps://cyberfeed.cesnet.cz/reports/376?lang=enlibxml2 fixes 3 vulnerabilities in versions 2.12.10 and 2.13.6, which so far have been fixed only by Slackware. Vulnerabilities: libxml2 - use-after-free (CVE-2024-56171, CVSS 7.8), libxml2 - buffer overflow (CVE-2025-24928, CVSS 7.8), libxml2 - NULL pointer dereference (CVE-2025-27113, CVSS 2.9), libxml2 - introhttps://cyberfeed.cesnet.cz/reports/376?lang=enhttps://cyberfeed.cesnet.cz/reports/375?lang=enIvanti fixes 8 vulnerabilities in its products, 3 of them critical. The most serious ones are described below; the remaining ones can be found at. Products and their fixes: Ivanti Connect Secure (ICS) - 22.7R2.6 Ivanti Policy Secure (IPS) - 22.7R1.3 Ivanti Secure Access Client (ISAC) - 22.8R1 Vulnerabilities: Ivanti Connect Secure, Policy Secure and Secure Access Client - intro, Ivanti Connect Secure - RCE (CVE-2025-22467, CVSS 9.9), Ivanti Connect Secure, Policy Secure - RCE (CVE-2024-10644, CVSS 9.1), Ivanti Connect Secure, Policy Secure - arbitrary file write (CVE-2024-38657, CVSS 9.1), Ivanti Secure Access Client - arbitrary file deletion (CVE-2024-13813, CVSS 7.1), Ivanti Connect Secure, Policy Secure - arbitrary file read (CVE-2024-12058, CVSS 6.8)https://cyberfeed.cesnet.cz/reports/375?lang=enhttps://cyberfeed.cesnet.cz/reports/374?lang=enOpenSSH version 9.9p2 fixes two vulnerabilities. The vulnerability CVE-2025-26465 was introduced into the product in version 6.8p1, CVE-2025-26466 in version 9.5p1. Among operating systems, fixes have been provided, for example, by Debian for the first vulnerability (the stable releases are not affected by the second one); Ubuntu; Slackware. Red Hat Enterprise Linux 9 is affected by the first vulnerability and no fix has been released yet; the systems are not affected by the second vulnerability. Gentoo has provided the fixed version 9.9_p2 for various architectures as stable or testing. For OpenBSD, fixes are available as errata. Operating system releases and fixed OpenSSH versions: Debian: bullseye (security) - 1:8.4p1-5+deb11u4 bookworm (security) - 1:9.2p1-2+deb12u5 sid - 1:9.9p2-1 Ubuntu: oracular - 1:9.7p1-7ubuntu4.2 noble - 1:9.6p1-3ubuntu13.8 jammy - 1:8.9p1-3ubuntu0.11 focal - 1:8.2p1-4ubuntu0.12 bionic - 1:7.6p1-4ubuntu0.7+esm4 xenial - 1:7.2p2-4ubuntu2.10+esm7 Slackware: openssh-9.9p2-i586-1_slack15.0 openssh-9.9p2-x86_64-1_slack15.0 openssh-9.9p2-i686-1 openssh-9.9p2-x86_64-1 A detailed analysis of the vulnerabilities is available at. Vulnerabilities: OpenSSH - intro, OpenSSH - machine-in-the-middle (CVE-2025-26465, CVSS 6.8), OpenSSH - DoS (CVE-2025-26466, CVSS 5.9)https://cyberfeed.cesnet.cz/reports/374?lang=enhttps://cyberfeed.cesnet.cz/reports/373?lang=enGitHub Enterprise Server versions 3.11.17, 3.12.14, 3.13.10, 3.14.7 and 3.15.2 fix 3 high-severity vulnerabilities. Vulnerabilities: GitHub Enterprise Server - intro, GitHub Enterprise Server - SAML authentication bypass (CVE-2025-23369, CVSS 7.1), GitHub Enterprise Server - code injection, sensitive data exfiltration (CVE-2024-10001, CVSS 7.1), GitHub Enterprise Server - privilege escalation, RCE (CVE-2024-10007, CVSS 7.5)https://cyberfeed.cesnet.cz/reports/373?lang=enhttps://cyberfeed.cesnet.cz/reports/372?lang=enNVIDIA fixes a high-severity vulnerability in its products. Products and their fixed versions: NVIDIA Container Toolkit - 1.17.4 NVIDIA GPU Operator - 24.9.2 Vulnerabilities: NVIDIA Container Toolkit and GPU Operator - intro, NVIDIA Container Toolkit and GPU Operator - privilege escalation, RCE, DoS (CVE-2025-23359, CVSS 8.3)https://cyberfeed.cesnet.cz/reports/372?lang=enhttps://cyberfeed.cesnet.cz/reports/371?lang=enGitLab versions 17.8.2, 17.7.4 and 17.6.5 fix 8 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE). Vulnerabilities: GitLab - XSS (CVE-2025-0376, CVSS 8.7), GitLab - denial of service (CVE-2024-12379, CVSS 6.5), GitLab - private content access (CVE-2024-3303, CVSS 6.4), GitLab - repository settings override (CVE-2025-1042, CVSS 2.7), GitLab - information disclosure (CVE-2025-1212, CVSS 4.3), GitLab - SSRF (CVE-2024-9870, CVSS 4.3), GitLab - improper authorization (CVE-2025-0516, CVSS 4.3), GitLab - insufficient session expiration (CVE-2025-1198, CVSS 4.2), GitLab - introhttps://cyberfeed.cesnet.cz/reports/371?lang=enhttps://cyberfeed.cesnet.cz/reports/370?lang=enApple fixes over 70 vulnerabilities in its products. The most serious ones are described below; the remaining ones can be found at. An overview of all vulnerabilities can be found at. Products and their fixed versions: macOS - 13.7.3, 14.7.3, 15.3 iOS - 18.3.1 iPadOS - 17.7.5, 18.3.1 watchOS - 11.3 tvOS - 18.3 visionOS - 2.3 Safari - 18.3 Vulnerabilities: Apple macOS, iOS, iPadOS, watchOS, tvOS, visionOS, Safari - intro, Apple macOS, iOS, iPadOS, visionOS, watchOS, tvOS - DoS (CVE-2025-24106, CVE-2025-24123, CVE-2025-24124, CVE-2025-24163, CVSS 7.5), Apple macOS, iPadOS - privilege escalation, RCE, DoS (CVE-2025-24118, CVSS 7.7), Apple macOS - filesystem modification (CVE-2025-24130, CVSS 9.8), Apple macOS - privilege escalation (CVE-2025-24135, CVSS 9.8), Apple macOS, iOS, iPadOS, visionOS, watchOS, tvOS - privilege escalation (CVE-2025-24085, CVSS 7.8), Apple iOS, iPadOS - unauthorized access (CVE-2025-24200, CVSS 6.1), Apple macOS, iOS, iPadOS, visionOS - kernel memory corruption, DoS (CVE-2025-24154, CVSS 9.1), Apple macOS - kernel address leak (CVE-2024-54531, CVSS 5.5)https://cyberfeed.cesnet.cz/reports/370?lang=enhttps://cyberfeed.cesnet.cz/reports/369?lang=enOpenSSL versions 3.4.1, 3.3.3 and 3.2.4 fix a high-severity vulnerability. The FIPS modules 3.4, 3.3, 3.2, 3.1 and 3.0, as well as OpenSSL 3.1, 3.0, 1.1.1 and 1.0.2, are not affected. The fixes are also available in the OpenSSL git repository in the commits: 738d4f9 - 3.4.1, 87ebd20 - 3.3.3, 798779d - 3.2.4. Among operating systems, fixes have been released, for example, by: Slackware - for the current branch in openssl-3.4.1, the stable one is not affected; Red Hat - for Red Hat Enterprise Linux 9, others are not affected; Debian - for the sid release in version 3.4.1-1, the bullseye and bookworm releases are not affected; Ubuntu - in version 3.3.1-2ubuntu2.1 for the oracular release, others are not affected; Gentoo - has some versions for various architectures available as stable or testing; SUSE - for SUSE Liberty Linux 9 in 3.2.2-6.el9_5.1. Vulnerabilities: OpenSSL - intro, OpenSSL - man-in-the-middle (CVE-2024-12797, CVSS 7.4)https://cyberfeed.cesnet.cz/reports/369?lang=enhttps://cyberfeed.cesnet.cz/reports/368?lang=enGnuTLS version 3.8.9 fixes one medium-severity vulnerability. Among operating systems, a fix has been provided, for example, by Debian in the sid release in version 3.8.9-2 and by Slackware with the release of gnutls-3.8.9 as part of SSA:2025-039-01. Libtasn1 has been updated to the latest version 4.20.0. Vulnerabilities: GnuTLS - denial of service (CVE-2024-12243, CVSS 5.3), GnuTLS - introhttps://cyberfeed.cesnet.cz/reports/368?lang=enhttps://cyberfeed.cesnet.cz/reports/367?lang=enZimbra versions 9.0.0 Patch 43, 10.0.12 and 10.1.4 fix 2 vulnerabilities in the Zimbra Collaboration product. Vulnerabilities: Zimbra Collaboration - SQL injection (CVE-2025-25064, CVSS 9.8), Zimbra Collaboration - server-side request forgery (CVE-2025-25065, CVSS 5.3), Zimbra Collaboration - introhttps://cyberfeed.cesnet.cz/reports/367?lang=enhttps://cyberfeed.cesnet.cz/reports/366?lang=enCisco fixes several vulnerabilities in its products. The vulnerable products and their fixed versions can be found in the link for each vulnerability. Vulnerabilities: Cisco Identity Services Engine - arbitrary commands execution (CVE-2025-20124, CVSS 9.9), Cisco Identity Services Engine - authorization bypass (CVE-2025-20125, CVSS 9.1), Cisco IOS, IOS XE, and IOS XR Software - denial of service (CVE-2025-20169, CVE-2025-20170, CVE-2025-20171, CVE-2025-20172, CVE-2025-20173, CVE-2025-20174, CVE-2025-20175, CVE-2025-20176, CVSS 7.7), Cisco Expressway Series - cross-site scripting (CVE-2025-20179, CVSS 6.1), Cisco Secure Email Gateway, Secure Web Appliance - command injection (CVE-2025-20184, CVSS 6.5), Cisco Secure Web Appliance - range request bypass (CVE-2025-20183, CVSS 5.8), Cisco Identity Services Engine - stored cross-site scripting (CVE-2025-20204, CVE-2025-20205, CVSS 4.8), Cisco Secure Email and Web Manager, Secure Email Gateway - stored cross-site scripting (CVE-2025-20180, CVSS 4.8), Cisco Secure Email and Web Manager, Secure Email Gateway, Secure Web Appliance - information disclosure (CVE-2025-20207, CVSS 4.3), Cisco - introhttps://cyberfeed.cesnet.cz/reports/366?lang=enhttps://cyberfeed.cesnet.cz/reports/365?lang=enF5 fixes 17 vulnerabilities in its products. The most severe vulnerabilities are listed below. Individual products and their fixed versions: BIG-IP (all modules) - 17.1.2.1, 16.1.5.2, 15.1.10.6, Hotfix-BIGIP-16.1.5.2.0.7.5-ENG.iso, Hotfix-BIGIP-15.1.10.6.0.11.6-ENG.iso BIG-IP Next Central Manager - 20.3.0 BIG-IP Next SPK - 1.9.1, 1.7.7 BIG-IP Next CNF - 1.4.0 NGINX Plus - R33 P2, R32 P2 NGINX Open Source - 1.27.4, 1.26.3 Detailed information on the fixed versions for individual vulnerabilities can be found in the overview table at. Vulnerabilities: F5 BIG-IP - intro, F5 BIG-IP - system command execution (CVE-2025-20029, CVSS 8.8), F5 BIG-IP - system command execution (CVE-2025-23239, CVSS 8.7), F5 BIG-IP - XSS (CVE-2025-24320, CVSS 8.0), F5 BIG-IP - DoS (CVE-2025-21087, CVSS 7.5), F5 BIG-IP - DoS (CVE-2025-20045, CVSS 7.5)https://cyberfeed.cesnet.cz/reports/365?lang=enhttps://cyberfeed.cesnet.cz/reports/364?lang=enSplunk version 3.1.1 fixes a medium-severity vulnerability in the Splunk Supporting Add-on for Active Directory (SA-ldapsearch) product. Vulnerabilities: Splunk - intro, Splunk Supporting Add-on for Active Directory - ReDoS (CVE-2025-0367, CVSS 6.5)https://cyberfeed.cesnet.cz/reports/364?lang=enhttps://cyberfeed.cesnet.cz/reports/363?lang=enVeeam fixes a vulnerability in the Veeam Updater component, which is part of Veeam Backup backup systems. Fixed version of Veeam Updater for individual Veeam Backup products: for Salesforce – 7.9.0.1124 for Nutanix AHV – 9.0.0.1125 for AWS – 9.0.0.1126 for Microsoft Azure – 9.0.0.1128 for Google Cloud – 9.0.0.1128 for Oracle Linux Virtualization Manager and Red Hat Virtualization – 9.0.0.1127 Versions of Veeam Backup products with automatic updates enabled that are not affected by this vulnerability: for Nutanix AHV - 6 and higher for AWS - v8 for Microsoft Azure - v7 for Google Cloud - v6 for Oracle Linux Virtualization Manager and Red Hat Virtualization - 5 and higher Older versions of the products require a manual update of the Veeam Updater component. If backup is managed through Veeam Backup & Replication version 12.3, no manual update is necessary. The exception is Veeam Backup for Salesforce, where the current version (3.1 and older) is still vulnerable and requires a manual update. Vulnerabilities: Veeam Backup - RCE (CVE-2025-23114, CVSS 9.0), Veeam Backup - introhttps://cyberfeed.cesnet.cz/reports/363?lang=enhttps://cyberfeed.cesnet.cz/reports/362?lang=enBroadcom fixes 1 vulnerability in the VMware Avi Load Balancer product in versions 30.1.2-2p2, 30.2.1-2p5 and 30.2.2-2p2 Vulnerabilities: VMware Avi Load Balancer - SQL injection (CVE-2025-22217, CVSS 8.6), VMware Avi Load Balancer - introhttps://cyberfeed.cesnet.cz/reports/362?lang=enhttps://cyberfeed.cesnet.cz/reports/361?lang=enBroadcom fixes 1 vulnerability in the VMware Avi Load Balancer product in versions 30.1.2-2p2, 30.2.1-2p5 and 30.2.2-2p2 Vulnerabilities: VMware Avi Load Balancer - SQL injection (CVE-2025-22217, CVSS 8.6), VMware Avi Load Balancer - introhttps://cyberfeed.cesnet.cz/reports/361?lang=enhttps://cyberfeed.cesnet.cz/reports/360?lang=enVulnerabilities: Acronis Cyber Protect Cloud Agent (Windows) - privilege escalation (CVE-2025-24828, CVE-2025-24827 , CVE-2025-24829, CVE-2025-24830, CVSS 6.3), Acronis Cyber Protect Cloud Agent a Home Office - privilege escalation (Windows) (CVE-2023-48677, CVSS 7.3), Acronis Cyber Protect Cloud Agent (Windows) - privilege escalation (CVE-2025-24831, CVSS 6.6), Acronis Snap Deploy (Windows) - privilege escalation (CVE-2025-24826, CVSS 6.7)https://cyberfeed.cesnet.cz/reports/360?lang=enhttps://cyberfeed.cesnet.cz/reports/358?lang=enVMware fixes 5 vulnerabilities in its products, two of them highly severe. Products and their fixes: VMware Aria Operations for logs - 8.18.3 VMware Aria Operations - 8.18.3 VMware Cloud Foundation - KB92148 Vulnerabilities: VMware Aria Operations - information disclosure (CVE-2025-22218, CVSS 8.5), VMware Aria Operations - cross-site scripting (CVE-2025-22219, CVSS 6.8), VMware Aria Operations - broken access control (CVE-2025-22220, CVSS 4.3), VMware Aria Operations - cross-site scripting (CVE-2025-22221, CVSS 5.2), VMware Aria Operations - information disclosure (CVE-2025-22222, CVSS 7.7), VMware Aria Operations - introhttps://cyberfeed.cesnet.cz/reports/358?lang=enhttps://cyberfeed.cesnet.cz/reports/357?lang=enBIND 9 versions 9.21.4, 9.20.5, 9.18.33 and 9.18.33-S1 fix 2 highly severe vulnerabilities. Debian released a fix for the bookworm distribution in version 1:9.18.33-1~deb12u2 and for sid in version 1:9.20.5-1. Ubuntu fixed it in versions 1:9.20.0-2ubuntu3.1 (24.10 oracular), 1:9.18.30-0ubuntu0.24.04.2 (24.04 LTS noble), 1:9.18.30-0ubuntu0.22.04.2 (22.04 LTS jammy) and 1:9.18.30-0ubuntu0.20.04.2 (20.04 LTS focal). Slackware released a fix as part of SSA:2025-029-01 here. Vulnerabilities: BIND - CPU exhaustion (CVE-2024-11187, CVSS 7.5), BIND - heavy query load (CVE-2024-12705, CVSS 7.5), BIND - introhttps://cyberfeed.cesnet.cz/reports/357?lang=enhttps://cyberfeed.cesnet.cz/reports/356?lang=enApache Solr version 9.8.0 fixes 2 vulnerabilities. Vulnerabilities: Apache Solr - intro, Apache Solr - RCE (CVE-2025-24814, CVSS 5.0), Apache Solr - arbitrary filepath write (CVE-2024-52012, CVSS 5.4)https://cyberfeed.cesnet.cz/reports/356?lang=enhttps://cyberfeed.cesnet.cz/reports/355?lang=enCodeQL Action version 3.28.3 and CodeQL CLI version 2.20.3 fix one vulnerability. Vulnerabilities: GitHub CodeQL Action, CodeQL CLI - sensitive information exposure (CVE-2025-24362, CVSS 5.3), GitHub CodeQL Action, CodeQL CLI - introhttps://cyberfeed.cesnet.cz/reports/355?lang=enhttps://cyberfeed.cesnet.cz/reports/354?lang=enFleet Server version 8.15.0 fixes a critical vulnerability. Vulnerabilities: Fleet Server - sensitive information exposure (CVE-2024-52975, CVSS 9.0), Fleet Server - introhttps://cyberfeed.cesnet.cz/reports/354?lang=enhttps://cyberfeed.cesnet.cz/reports/353?lang=enOTRS AG fixes 4 vulnerabilities in the OTRS and ((OTRS)) products. The fix was released in version 2025.1 for OTRS and in 6.0.34 for ((OTRS)). Vulnerabilities: OTRS - content spoofing (CVE-2024-43445, CVSS 5.4), OTRS - unauthorized status change (CVE-2024-43446, CVSS 3.5), OTRS - information leak (CVE-2025-24389, CVSS 6.3), OTRS - session hijacking (CVE-2025-24390, CVSS 6.8), OTRS - introhttps://cyberfeed.cesnet.cz/reports/353?lang=enhttps://cyberfeed.cesnet.cz/reports/351?lang=enJenkins warns of 8 vulnerabilities in its plugins. The most severe of them are described below; the rest can be found at. Plugins and their fixed versions (if available): Azure Service Fabric Plugin - no fix available at the time of publication Bitbucket Server Integration Plugin - 4.1.4 Eiffel Broadcaster Plugin - 2.10.3 Folder-based Authorization Strategy Plugin - no fix available at the time of publication GitLab Plugin - 1.9.7 OpenId Connect Authentication Plugin - 4.453.v4d7765c854f4 Zoom Plugin - 1.6 Vulnerabilities: Jenkins - intro, Jenkins Bitbucket Server Integration Plugin - CSRF (CVE-2025-24398, CVSS 8.8), Jenkins OpenId Connect Authentication Plugin - privilege escalation (CVE-2025-24399, CVSS 8.8), Jenkins Folder-based Authorization Strategy Plugin - unauthorised access (CVE-2025-24401, CVSS 6.8), Jenkins GitLab Plugin - credential ID enumeration (CVE-2025-24397, CVSS 4.3)https://cyberfeed.cesnet.cz/reports/351?lang=enhttps://cyberfeed.cesnet.cz/reports/350?lang=enCisco fixes 3 vulnerabilities in the Cisco Meeting Management, BroadWorks and ClamAV products. The vulnerable products and their fixed versions can be found at. Vulnerabilities: Cisco Meeting Management - privilege escalation (CVE-2025-20156, CVSS 9.9), Cisco BroadWorks - denial of Service (CVE-2025-20165, CVSS 7.5), Cisco ClamAV - denial of service (CVE-2025-20128, CVSS 5.3), Cisco - introhttps://cyberfeed.cesnet.cz/reports/350?lang=enhttps://cyberfeed.cesnet.cz/reports/349?lang=enFortinet fixes 31 vulnerabilities in various products. The most severe vulnerabilities are listed below. Individual products and their fixed versions: FortiWeb - 7.4.2, 7.2.8 FortiRecorder - 7.2.2, 7.0.5 FortiManager - 7.4.4 FortiManager Cloud - 7.4.4 FortiClientEMS - 7.2.5, 7.0.11 FortiPortal - 7.2.5, 7.0.9 FortiAP - 7.4.3, 7.2.4 FortiAP-S - 6.4.10 FortiAP-W2 - 7.4.3, 7.2.4 FortiVoice - 7.0.2, 6.4.9 FortiSwitch - 7.4.1, 7.2.6, 7.0.8, 6.4.14, 6.2.8 FortiSandbox - 4.4.5, 4.2.7, 4.0.5 FortiAnalyzer - 7.6.2, 7.4.4 FortiAnalyzer Cloud - 7.4.4 FortiOS - 7.0.17 FortiProxy - 7.2.13, 7.0.20 Vulnerabilities: Fortinet FortiWeb - RCE (CVE-2024-21758, CVSS 6.4), Fortinet FortiRecorder - file deletion (CVE-2024-47566, CVSS 5.1), Fortinet FortiManager - configuration leak (CVE-2024-35277, CVSS 8.6), Fortinet FortiClientEMS - bruteforce attack (CVE-2024-23106, CVSS 8.1), Fortinet - intro, Fortinet FortiPortal - database schema leak (CVE-2024-35278, CVSS 4.3), Fortinet FortiSIEM - connection DoS (CVE-2024-46667, CVSS 7.5), Fortinet FortiAP(-S), FortiAP-W2 - RCE (CVE-2024-26012, CVSS 6.7), Fortinet FortiVoice Entreprise - SQL injection (CVE-2023-37931, CVSS 8.8), Fortinet FortiSwitch - RCE (CVE-2023-37936, CVSS 9.8), Fortinet FortiSandbox - command execution (CVE-2024-27778, CVSS 8.8), Fortinet FortiOS, FortiProxy - authentication bypass (CVE-2024-55591, CVSS 9.8), Fortinet FortiAnalyzer, FortiManager, FortiOS, FortiProxy - (CVE-2024-48886, CVE-2024-50563, CVSS 9.0)https://cyberfeed.cesnet.cz/reports/349?lang=enhttps://cyberfeed.cesnet.cz/reports/348?lang=enFortinet fixes 31 vulnerabilities in various products. The most severe vulnerabilities are listed below. Individual products and their fixed versions: FortiWeb - 7.4.2, 7.2.8 FortiRecorder - 7.2.2, 7.0.5 FortiManager - 7.4.4 FortiManager Cloud - 7.4.4 FortiClientEMS - 7.2.5, 7.0.11 FortiPortal - 7.2.5, 7.0.9 FortiAP - 7.4.3, 7.2.4 FortiAP-S - 6.4.10 FortiAP-W2 - 7.4.3, 7.2.4 FortiVoice - 7.0.2, 6.4.9 FortiSwitch - 7.4.1, 7.2.6, 7.0.8, 6.4.14, 6.2.8 FortiSandbox - 4.4.5, 4.2.7, 4.0.5 FortiAnalyzer - 7.6.2, 7.4.4 FortiAnalyzer Cloud - 7.4.4 FortiOS - 7.0.17 FortiProxy - 7.2.13, 7.0.20 Vulnerabilities: Fortinet FortiWeb - RCE (CVE-2024-21758, CVSS 6.4), Fortinet FortiRecorder - file deletion (CVE-2024-47566, CVSS 5.1), Fortinet FortiManager - configuration leak (CVE-2024-35277, CVSS 8.6), Fortinet FortiClientEMS - bruteforce attack (CVE-2024-23106, CVSS 8.1), Fortinet - intro, Fortinet FortiPortal - database schema leak (CVE-2024-35278, CVSS 4.3), Fortinet FortiSIEM - connection DoS (CVE-2024-46667, CVSS 7.5), Fortinet FortiAP(-S), FortiAP-W2 - RCE (CVE-2024-26012, CVSS 6.7), Fortinet FortiVoice Entreprise - SQL injection (CVE-2023-37931, CVSS 8.8), Fortinet FortiSwitch - RCE (CVE-2023-37936, CVSS 9.8), Fortinet FortiSandbox - command execution (CVE-2024-27778, CVSS 8.8), Fortinet FortiOS, FortiProxy - authentication bypass (CVE-2024-55591, CVSS 9.8), Fortinet FortiAnalyzer, FortiManager, FortiOS, FortiProxy - (CVE-2024-48886, CVE-2024-50563, CVSS 9.0)https://cyberfeed.cesnet.cz/reports/348?lang=enhttps://cyberfeed.cesnet.cz/reports/347?lang=enElastic Kibana version 8.15.0 fixes 4 vulnerabilities. Vulnerabilities: Elastic Kibana - sensitive information exposure (CVE-2024-43707, CVSS 7.7), Elastic Kibana - denial of service (CVE-2024-43708, CVSS 6.5), Elastic Kibana - denial of service (CVE-2024-52972, CVSS 6.5), Elastic Kibana - server-side request forgery (CVE-2024-43710, CVSS 4.3), Elastic Kibana - introhttps://cyberfeed.cesnet.cz/reports/347?lang=enhttps://cyberfeed.cesnet.cz/reports/346?lang=enGitLab versions 17.8.1, 17.7.3 and 17.6.4 fix 3 vulnerabilities in the GitLab Community Edition (CE) and Enterprise Edition (EE) products. Vulnerabilities: GitLab CE/EE - intro, GitLab CE/EE - XSS (CVE-2025-0314, CVSS 8.7), GitLab CE/EE - CI/CD variable exfiltration (CVE-2024-11931, CVSS 6.4), GitLab CE/EE - DoS (CVE-2024-6324, CVSS 4.3)https://cyberfeed.cesnet.cz/reports/346?lang=enhttps://cyberfeed.cesnet.cz/reports/345?lang=enHPE Aruba Networking fixes 2 highly severe vulnerabilities in the Mobility Conductors, Mobility Controllers and WLAN and SD-WAN Gateways (AOS-10 and AOS-8) products. Fixes are available in versions: AOS-10 - 10.7.0.0 and 10.4.1.5 AOS-8 - 8.12.0.3 and 8.10.0.15 As a temporary fix for these vulnerabilities, it is possible to restrict the command line and the web interface intended for management to a dedicated layer 2 segment and/or to control access using a firewall at layer 3 or higher. Vulnerabilities: HPE Aruba Networking Mobility Conductors, Controllers, and WLAN/SD-WAN Gateways - intro, HPE Aruba Networking Mobility Conductors, Controllers, and WLAN/SD-WAN Gateways - RCE (CVE-2025-23051, CVSS 7.2), HPE Aruba Networking Mobility Conductors, Controllers, and WLAN/SD-WAN Gateways - OS command execution (CVE-2025-23052, CVSS 7.2)https://cyberfeed.cesnet.cz/reports/345?lang=enhttps://cyberfeed.cesnet.cz/reports/344?lang=enGit Credential Manager version 2.6.1 fixes a high-severity vulnerability. If it is not possible to update to the fixed version immediately, it is recommended to interact only with trusted remote repositories and to avoid cloning with the "--recursive" option, so that submodule URLs can be checked beforehand. Vulnerabilities: Git Credential Manager - intro, Git Credential Manager - credential leak (CVE-2024-50338, CVSS 7.4)https://cyberfeed.cesnet.cz/reports/344?lang=enhttps://cyberfeed.cesnet.cz/reports/343?lang=enNagios XI version 2024R1.1.5 fixes a medium-severity vulnerability. Vulnerabilities: Nagios XI - intro, Nagios XI - XSS (CVE-2024-42898, CVSS 5.4)https://cyberfeed.cesnet.cz/reports/343?lang=enhttps://cyberfeed.cesnet.cz/reports/342?lang=enVeeam Backup for Microsoft Azure version 7.1.0.59 fixes a high-severity vulnerability. Vulnerabilities: Veeam - intro, Veeam Backup for Microsoft Azure Vulnerability - SSRF (CVE-2025-23082, CVSS 7.2)https://cyberfeed.cesnet.cz/reports/342?lang=enhttps://cyberfeed.cesnet.cz/reports/341?lang=enIvanti fixes several critical and high-severity vulnerabilities in Ivanti Endpoint Manager (EPM), Application Control and Avalanche. The most severe are described below; the remaining ones can be found at. Products and their fixes: Ivanti Endpoint Manager - 2024 January-2025 Security Update, 2022 SU6 January-2025 Security Update Ivanti Application Control - 2024.3 HF1, 2024.1 HF2, 2023.3 HF3 Ivanti Avalanche - 6.4.7 Vulnerabilities: Ivanti EPM - sensitive information leakage (CVE-2024-10811, CVE-2024-13161, CVE-2024-13160, CVE-2024-13159, CVSS 9.8), Ivanti EPM - remote code execution (CVE-2024-13172, CVE-2024-13171, CVE-2024-13163, CVSS 7.8), Ivanti EPM - privilege escalation (CVE-2024-13169, CVSS 7.8), Ivanti Application Control - configured protection bypass (CVE-2024-10630, CVSS 7.8), Ivanti Avalanche - sensitive information leakage (CVE-2024-13180, CVSS 7.5), Ivanti Avalanche - authentication bypass (CVE-2024-13181, CVE-2024-13179, CVSS 7.3), Ivanti - introhttps://cyberfeed.cesnet.cz/reports/341?lang=enhttps://cyberfeed.cesnet.cz/reports/340?lang=enZyxel fixes a high-severity vulnerability in the web management interface of certain firmware versions of access points (AP) and a security router. Information about the specific products and fixed versions can be found at. Vulnerabilities: Zyxel - intro, Zyxel - privilege escalation (CVE-2024-12398, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/340?lang=enhttps://cyberfeed.cesnet.cz/reports/339?lang=enrsync version 3.4.0 fixes 6 vulnerabilities, some of which affect the rsync server and some the client. Version 3.4.1 was subsequently released, which fixes some regressions from version 3.4.0. The vulnerability CVE-2024-12084 (RCE) does not affect instances running an operating system from the Red Hat family; in Debian this vulnerability does not affect only the bullseye release, and Ubuntu is vulnerable only in the noble and jammy releases. Individual OS releases and their fixed versions: Debian: bookworm (security) - 3.2.7-1+deb12u2 sid, trixie - 3.3.0+ds1-4 Ubuntu - noble - 3.2.7-1ubuntu1.1 jammy - 3.2.7-0ubuntu0.22.04.3 focal - 3.1.3-8ubuntu0.8 bionic - 3.1.2-2.1ubuntu1.6+esm1 xenial - 3.1.1-3ubuntu1.3+esm3 Gentoo - update available for commonly used architectures Red Hat Vulnerabilities: rsync - buffer overflow (CVE-2024-12084, CVSS 9.8), rsync - data leak (CVE-2024-12085, CVSS 7.5), rsync - data leak (CVE-2024-12086, CVSS 6.1), rsync - path traversal (CVE-2024-12087, CVE-2024-12088, CVSS 6.5), rsync - sensitive information leak (CVE-2024-12747, CVSS 5.6), rsync - introhttps://cyberfeed.cesnet.cz/reports/339?lang=enhttps://cyberfeed.cesnet.cz/reports/338?lang=enApple fixes 49 vulnerabilities in its products. The most severe of them are described below; the remaining ones can be found at. Products and their fixed versions: macOS - 13.7.2, 14.7.2, 15.2 iOS - 18.2 iPadOS - 17.7.3, 18.2 watchOS - 11.2 tvOS - 18.2 visionOS - 2.2 Safari - 18.2 Vulnerabilities: Apple macOS, iOS, iPadOS, watchOS, tvOS, visionOS, Safari - intro, Apple macOS, iOS, iPadOS, Safari, watchOS, visionOS a tvOS - memory corruption (CVE-2024-54534, CVSS 7.1), Apple macOS - privilege escalation (CVE-2024-54465, CVSS 9.8), Apple macOS - DoS, RCE (CVE-2024-54506, CVSS 9.8), Apple macOS - RCE (CVE-2024-54529, CVSS 7.8), Apple macOS - Sandbox escape, unauthorized access (CVE-2024-54498, CVSS 8.8), Apple macOS, iOS, iPadOS, watchOS a tvOS - Sandbox escape, unauthorized access (CVE-2024-54514, CVSS 8.6), Apple macOS - privilege escalation (CVE-2024-44224, CVE-2024-44291, CVSS 7.8), Apple macOS - unauthorized filesystem modification (CVE-2024-44243, CVSS 5.5), Apple macOS, iOS, iPadOS, watchOS a tvOS - sensitive information leakage (CVE-2024-54527, CVSS 5.5)https://cyberfeed.cesnet.cz/reports/338?lang=enhttps://cyberfeed.cesnet.cz/reports/337?lang=enJuniper Networks fixes two vulnerabilities in its products. Products and their fixed versions: Junos OS - 21.2R3-S9, 21.4R3-S9, 22.2R3-S5, 22.3R3-S4, 22.4R3-S5, 23.2R2-S2, 23.4R2-S1, 24.2R1-S1, 24.2R2, 24.4R1 Junos OS Evolved - 21.4R3-S9-EVO, 22.2R3-S5-EVO, 22.3R3-S4-EVO, 22.4R3-S5-EVO, 23.2R2-S2-EVO, 23.4R2-S2-EVO, 24.2R1-S2-EVO, 24.2R2-EVO (to be released), 24.4R1-EVO Vulnerabilities: Juniper Networks Junos OS a Junos OS Evolved - intro, Juniper Networks Junos OS Evolved - DoS (CVE-2025-21599, CVSS 7.5), Juniper Networks Junos OS and Junos OS Evolved - DoS (CVE-2025-21598, CVSS 7.5)https://cyberfeed.cesnet.cz/reports/337?lang=enhttps://cyberfeed.cesnet.cz/reports/336?lang=enPalo Alto Networks fixes 5 vulnerabilities in the Expedition product with version 1.2.101. This version is also the last one released, as the product has reached end of life. As a temporary workaround for all disclosed vulnerabilities, access from untrusted sources can be blocked. The most severe vulnerabilities are listed below. Vulnerabilities: Palo Alto Networks Expedition - SQL injection (CVE-2025-0103, CVSS 7.1), Palo Alto Networks Expedition - XSS (CVE-2025-0104, CVSS 7.1), Palo Alto Networks Expedition - OS command execution (CVE-2025-0107, CVSS 7.4), Palo Alto Networks Expedition - introhttps://cyberfeed.cesnet.cz/reports/336?lang=enhttps://cyberfeed.cesnet.cz/reports/334?lang=enMozilla fixes 11 vulnerabilities in Thunderbird, Thunderbird ESR, Firefox and Firefox ESR. The most severe vulnerabilities are listed below. Individual products and their fixed versions: Firefox - 134 Firefox ESR - 128.6, 115.19 Thunderbird - 134 Thunderbird ESR - 128.6 Vulnerabilities: Mozilla Firefox & Thunderbird - data spoofing (CVE-2025-0244, CVSS 5.3), Mozilla Firefox & Thunderbird - RCE (CVE-2025-0242, CVSS 8.1), Mozilla Firefox & Thunderbird - RCE (CVE-2025-0247, CVSS 8.1), Mozilla Firefox & Thunderbird - introhttps://cyberfeed.cesnet.cz/reports/334?lang=enhttps://cyberfeed.cesnet.cz/reports/333?lang=enGitLab versions 17.7.1, 17.6.3 and 17.5.5 fix 4 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE). Vulnerabilities: GitLab - access token leak (CVE-2025-0194, CVSS 6.5), GitLab - DoS (CVE-2024-6324, CVSS 4.3), GitLab - unauthorized change (CVE-2024-12431, CVSS 4.3), GitLab - unauthorized access (CVE-2024-13041, CVSS 4.2), GitLab - introhttps://cyberfeed.cesnet.cz/reports/333?lang=enhttps://cyberfeed.cesnet.cz/reports/332?lang=enIvanti fixes two vulnerabilities in its products, one of which is critical and actively exploited. Fixed product versions and their availability: Ivanti Connect Secure (ICS) - 22.7R2.5, available Ivanti Policy Secure (IPS) - patch availability planned for 21 January 2025 Ivanti Neurons for ZTA gateways - 22.7R2.5, patch availability planned for 21 January 2025 The company recommends regular monitoring of the system using the Integrity Checker Tool (ICT) or other tools. As a precaution, for ICS it is recommended to perform a factory reset before deploying version 22.7R2.5, even if the tool does not detect a problem. If signs of compromise are detected, a factory reset is necessary before deploying version 22.7R2.5. Detailed recommendations for ICS and for products for which patches are not yet available can be found at. Vulnerabilities: Ivanti - intro, Ivanti Connect Secure, Policy Secure, Neurons for ZTA gateways - RCE (CVE-2025-0282, CVSS 9.0), Ivanti Connect Secure, Policy Secure, Neurons for ZTA gateways - privilege escalation (CVE-2025-0283, CVSS 7.0)https://cyberfeed.cesnet.cz/reports/332?lang=enhttps://cyberfeed.cesnet.cz/reports/331?lang=eniTerm2 versions 3.5.11 and 3.5.12beta1 fix a critical vulnerability. Vulnerabilities: iTerm2 - sensitive information leak (CVE-2025-22275, CVSS 9.3), iTerm2 - introhttps://cyberfeed.cesnet.cz/reports/331?lang=enhttps://cyberfeed.cesnet.cz/reports/330?lang=enSplunk App for SOAR version 1.0.71 fixes a medium-severity vulnerability arising from a misconfiguration recommended by the product documentation. This configuration assigns the "admin_all_objects" capability to the low-privileged role "splunk_app_soar", which allows a user to access and modify any object in the system regardless of the restrictions set on it. If an immediate update to the fixed version is not possible, it is recommended to remove this capability from the role manually. Vulnerabilities: Splunk App for SOAR - intro, Splunk App for SOAR - privilege escalation (CVE-2025-22621, CVSS 6.4)https://cyberfeed.cesnet.cz/reports/330?lang=enhttps://cyberfeed.cesnet.cz/reports/329?lang=enApache fixes a vulnerability in the Tomcat product. The vulnerability arose due to an insufficient fix for the vulnerability CVE-2024-50379. To fix it, it is necessary to update to version 11.0.2, 10.1.34 or 9.0.98 and then adjust the configuration as follows: if you use Java 8 or 11 - set sun.io.useCanonCaches to false if you use Java 17 - if you use sun.io.useCanonCaches, set it to false if you use Java 21 - no configuration change is needed Vulnerabilities: Apache Tomcat - TOCTOU RCE (CVE-2024-56337, CVSS 9.8), Apache Tomcat - introhttps://cyberfeed.cesnet.cz/reports/329?lang=enhttps://cyberfeed.cesnet.cz/reports/328?lang=enAs part of the December "Patch Tuesday", Microsoft fixes 71 vulnerabilities, including a critical and a high-severity vulnerability affecting Windows LDAP. Fixes for these two vulnerabilities affecting individual Microsoft products can be found at. Vulnerabilities: Windows LDAP - RCE (CVE-2024-49112, CVSS 9.8), Windows LDAP - DoS (CVE-2024-49113, CVSS 7.5), Windows LDAP - introhttps://cyberfeed.cesnet.cz/reports/328?lang=enhttps://cyberfeed.cesnet.cz/reports/327?lang=enAcronis Cyber Protect 16 build 39169 fixes 6 vulnerabilities. Vulnerabilities: Acronis Cyber Protect 16 - local privilege escalation (CVE-2024-55543, CVSS 7.3), Acronis Cyber Protect 16 - local privilege escalation (CVE-2024-55540, CVSS 6.6), Acronis Cyber Protect 16 - missing session invalidation (CVE-2024-56413, CVSS 6.1), Acronis Cyber Protect 16 - use of weak hash (CVE-2024-56414, CVSS 5.5), Acronis Cyber Protect 16 - local privilege escalation (CVE-2024-55542, CVSS 4.4), Acronis Cyber Protect 16 - stored cross-site scripting (CVE-2024-55541, CVSS 3.1), Acronis Cyber Protect 16 - introhttps://cyberfeed.cesnet.cz/reports/327?lang=enhttps://cyberfeed.cesnet.cz/reports/326?lang=enQNAP fixes 10 vulnerabilities in its products. The most severe of them are described below; the remaining ones can be found at. Products and their fixed versions: QTS - 5.1.9.2954 build 20241120 and 5.2.2.2950 build 20241114 QuTS hero - h5.1.9.2954 build 20241120 and h5.2.2.2952 build 20241116 License Center - 1.9.43 Qsync Central - 4.4.0.16_20240819 (2024/08/19) Vulnerabilities: QNAP - intro, QNAP QTS a QuTS hero - application data modification (CVE-2024-48868, CVSS 8.8), QNAP QTS a QuTS hero - command execution (CVE-2024-50393, CVSS 8.8), QNAP QTS a QuTS hero - system security compromise (CVE-2024-48865, CVSS 8.6), QNAP License Center - OS command execution (CVE-2024-48863, CVSS 8.8), QNAP Qsync Central - unauthorized access (CVE-2024-50404, CVSS 5.7)https://cyberfeed.cesnet.cz/reports/326?lang=enhttps://cyberfeed.cesnet.cz/reports/325?lang=enApache Struts since version 6.4.0 contains a fix for a critical vulnerability, which, however, requires not only updating the framework but also a change in the application code. If the older File Upload mechanism is used, migration to the newer Action File Upload mechanism is necessary due to backward incompatibility. Without this change, the application remains vulnerable even after the framework is updated. Vulnerabilities: Apache Struts 2 - intro, Apache Struts 2 - RCE (CVE-2024-53677, CVSS 9.0)https://cyberfeed.cesnet.cz/reports/325?lang=enhttps://cyberfeed.cesnet.cz/reports/324?lang=enApache Traffic Control version 8.0.2 fixes a critical vulnerability. Vulnerabilities: Apache Traffic Control - SQL injection (CVE-2024-45387, CVSS 9.9), Apache Traffic Control - introhttps://cyberfeed.cesnet.cz/reports/324?lang=enhttps://cyberfeed.cesnet.cz/reports/323?lang=enlibxml2 versions 2.11.9, 2.12.9 and 2.13.3 fix 1 vulnerability. Vulnerabilities: libxml2 - XXE (CVE-2024-40896, CVSS 6.5), libxml2 - introhttps://cyberfeed.cesnet.cz/reports/323?lang=enhttps://cyberfeed.cesnet.cz/reports/322?lang=enPalo Alto Networks versions 11.2.3, 11.1.5, 10.2.14 and 10.1.15 fix a high-severity and actively exploited vulnerability in PAN-OS. The vulnerability affects PA-Series, VM-Series and CN-Series firewalls and the Prisma Access platform. If the product cannot be updated to the fixed version, it is recommended to apply the temporary mitigations described at. Applying the temporary mitigation is also recommended for Prisma Access users who use DNS Security on an affected PAN-OS version. Scheduled upgrades of these systems will be carried out over the next two weekends. An expedited upgrade can be requested from technical support. Vulnerabilities: Palo Alto Networks PAN-OS - intro, Palo Alto Networks PAN-OS - denial of service (CVE-2024-3393, CVSS 7.5)https://cyberfeed.cesnet.cz/reports/322?lang=enhttps://cyberfeed.cesnet.cz/reports/321?lang=enGitLab versions 17.6.2, 17.5.4 and 17.4.6 fix 12 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE). The most severe of them are listed below; the remaining ones can be found at. Vulnerabilities: GitLab CE/EE - intro, GitLab CE/EE - session data exfiltration, ATO (CVE-2024-11274, CVSS 8.7), GitLab CE/EE - denial of service (CVE-2024-8233, CVSS 7.5), GitLab CE/EE - session token disclosure (CVE-2024-12570, CVSS 6.7), GitLab CE/EE - open redirection (CVE-2024-9387, CVSS 6.4), GitLab CE/EE - CSRF token leakage (CVE-2024-8647, CVSS 5.4), GitLab CE/EE - XSS (CVE-2024-8179, CVSS 5.4)https://cyberfeed.cesnet.cz/reports/321?lang=enhttps://cyberfeed.cesnet.cz/reports/320?lang=enSplunk fixes a high-severity vulnerability in its products. Products and their fixes: Splunk Enterprise - 9.3.2, 9.2.4 and 9.1.7 Splunk Secure Gateway versions - 3.7.13 and 3.4.261 Vulnerabilities: Splunk Enterprise a Splunk Secure Gateway - intro, Splunk Enterprise a Splunk Secure Gateway - RCE (CVE-2024-53247, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/320?lang=enhttps://cyberfeed.cesnet.cz/reports/319?lang=enIvanti fixes 5 vulnerabilities in its products, 2 of them critical. Products and their fixes: Ivanti Connect Secure (ICS) - 22.7R2.4 Ivanti Policy Secure (IPS) - 22.7R1.2 Vulnerabilities: Ivanti Connect Secure and Policy Secure - intro, Ivanti Connect Secure and Policy Secure - RCE (CVE-2024-11634, CVSS 9.1), Ivanti Connect Secure - RCE (CVE-2024-11633, CVSS 9.1), Ivanti Connect Secure - denial of service (CVE-2024-37401, CVSS 7.5), Ivanti Connect Secure - restriction bypass (CVE-2024-9844, CVSS 7.1), Ivanti Connect Secure - denial of service (CVE-2024-37377, CVSS 7.5)https://cyberfeed.cesnet.cz/reports/319?lang=enhttps://cyberfeed.cesnet.cz/reports/318?lang=enGoogle is fixing a high-severity vulnerability in Google Chrome and in Chromium-based web browsers. Google fixed the vulnerability for Chrome on Linux in version 131.0.6778.108 and for Chrome on Windows/Mac in version 131.0.6778.108/.109. Among operating systems, Debian provided a fix for the bookworm (security) release in version 131.0.6778.139-1~deb12u1 and for trixie and sid in version 131.0.6778.139-1. Ubuntu releases are not affected. Vulnerabilities: Google Chrome - intro, Google Chrome - information disclosure, RCE, DoS (CVE-2024-12053, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/318?lang=enhttps://cyberfeed.cesnet.cz/reports/317?lang=enIvanti Cloud Service Application (CSA) for Endpoint Manager (EPM) version 5.0.3 fixes 3 critical vulnerabilities. Vulnerabilities: Ivanti EPM Cloud Services Application - intro, Ivanti EPM Cloud Services Application - authentication bypass (CVE-2024-11639, CVSS 10.0), Ivanti EPM Cloud Services Application - RCE (CVE-2024-11772, CVSS 9.1), Ivanti EMP Cloud Services Application - SQL injection (CVE-2024-11773, CVSS 9.1)https://cyberfeed.cesnet.cz/reports/317?lang=enhttps://cyberfeed.cesnet.cz/reports/316?lang=enApache fixes a vulnerability in the Apache Subversion product with version 1.14.5. A patch that can be applied manually without the need to update can be found at. Vulnerabilities: Apache Subversion - DoS (CVE-2024-46901, CVSS 3.1), Apache Subversion - introhttps://cyberfeed.cesnet.cz/reports/316?lang=enhttps://cyberfeed.cesnet.cz/reports/315?lang=enVeeam Service Provider Console (VSPC) version 8.1.0.21999 fixes 2 vulnerabilities, one of which is critical. Vulnerabilities: Veeam Service Provider Console - intro, Veeam Service Provider Console - RCE (CVE-2024-42448, CVSS 9.9), Veeam Service Provider Console - sensitive data leakage (CVE-2024-42449, CVSS 7.1)https://cyberfeed.cesnet.cz/reports/315?lang=enhttps://cyberfeed.cesnet.cz/reports/313?lang=enQNAP fixes 28 vulnerabilities in QNAP Photo, QuRouter, Notes Station 3, QuLog Center, AI Core, QTS and QuTS Hero. Individual products and their fixed versions: QNAP Photo - 6.4.3 QNAP QuRouter - 2.4.3.103 QNAP Notes Station - 3.9.7 QNAP QuLog Center - 1.7.0.831, 1.8.0.888 QNAP AI Core - 3.4.1 QNAP QTS - 5.2.1.2930 build 20241025 QNAP QuTS Hero - h5.2.1.2929 build 20241025 Vulnerabilities: QNAP Photo Station - XSS (CVE-2024-32767, CVE-2024-32768, CVE-2024-32769, CVE-2024-32770, CVSS 6.3), QNAP QuRouter - command execution (CVE-2024-48860, CVE-2024-48861, CVSS 10.0), QNAP Notes Station 3 - missing authentication (CVE-2024-38643, CVSS 9.1), QNAP Notes Station 3 - command execution (CVE-2024-38644, CVSS 8.8), QNAP QuLog Center - file system traversal (CVE-2024-48862, CVSS 8.8), QNAP AI Core - security compromise (CVE-2024-38647, CVSS 8.3), QNAP QTS and Quts Hero - data read and overwrite (CVE-2024-50397, CVSS 7.5), QNAP QTS and Quts Hero - data read and overwrite (CVE-2024-50396, CVSS 8.8), QNAP - introhttps://cyberfeed.cesnet.cz/reports/313?lang=enhttps://cyberfeed.cesnet.cz/reports/312?lang=enPHP versions 8.4.1, 8.3.14, 8.2.26 and 8.1.31 fix 5 vulnerabilities. Among operating systems, Slackware and Debian provided a fix, the latter for the bookworm (security) release in version 8.2.26-1~deb12u1 and for sid in version 8.2.26-4. Gentoo has some of the fixed versions available as testing. Vulnerabilities: PHP - intro, PHP - out-of-bounds write (CVE-2024-8932, CVSS 9.8), PHP - out-of-bounds write (CVE-2024-11236, CVSS 9.8), PHP - out-of-bounds read (CVE-2024-8929, CVSS 5.8), PHP - out-of-bounds read, denial of service (CVE-2024-11233, CVSS 4.8), PHP - SSRF, header manipulation (CVE-2024-11234, CVSS 4.8)https://cyberfeed.cesnet.cz/reports/312?lang=enhttps://cyberfeed.cesnet.cz/reports/311?lang=enZyxel is fixing 3 vulnerabilities found in 4G LTE/5G NR CPE, DSL/Ethernet CPE, Fiber ONT and WiFi extender products. The products and their fixed versions can be found in the tables at. Vulnerabilities: Zyxel 4G LTE/5G NR CPE, DSL/Ethernet CPE, fiber ONT and WiFi extender firmware - denial of service (CVE-2024-8748, CVSS 7.5), Zyxel DSL/Ethernet CPE, fiber ONT and WiFi extender firmware - denial of service (CVE-2024-9197, CVSS 4.9), Zyxel DSL/Ethernet CPE firmware - command execution (CVE-2024-9200, CVSS 7.2), Zyxel - introhttps://cyberfeed.cesnet.cz/reports/311?lang=enhttps://cyberfeed.cesnet.cz/reports/310?lang=enGitLab versions 17.6.1, 17.5.3 and 17.4.5 fix 6 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE). Vulnerabilities: GitLab - privilege escalation (CVE-2024-8114, CVSS 8.2), GitLab - denial of service (CVE-2024-8237, CVSS 6.5), GitLab - unintended access (CVE-2024-11669, CVSS 6.5), GitLab - denial of service (CVE-2024-8177, CVSS 5.3), GitLab - resource exhaustion, denial of service (CVE-2024-11828, CVSS 4.3), GitLab - unauthorized access (CVE-2024-11668, CVSS 4.2), GitLab Community Edition and Enterprise Edition - introhttps://cyberfeed.cesnet.cz/reports/310?lang=enhttps://cyberfeed.cesnet.cz/reports/309?lang=enVMware Aria Operations version 8.18.2 fixes 5 vulnerabilities. Vulnerabilities: VMware Aria Operations - intro, VMware Aria Operations - privilege escalation (CVE-2024-38830, CVSS 7.8), VMware Aria Operations - privilege escalation (CVE-2024-38831, CVSS 7.8), VMware Aria Operations - XSS (CVE-2024-38832, CVSS 7.1), VMware Aria Operations - XSS (CVE-2024-38833, CVSS 6.8), VMware Aria Operations - XSS (CVE-2024-38834, CVSS 6.5)https://cyberfeed.cesnet.cz/reports/309?lang=enhttps://cyberfeed.cesnet.cz/reports/308?lang=enWebKitGTK and WPE WebKit version 2.46.4 fix 2 vulnerabilities. Apple is aware of reports that they may have been actively exploited on Mac systems with Intel processors. The vulnerabilities were also added to the CISA Known Exploited Vulnerabilities catalog. Individual Apple products and their fixed versions: iOS - 17.7.2, 18.1.1 iPadOS - 17.7.2, 18.1.1 Safari - 18.1.1 visionOS - 2.1.1 macOS Sequoia - 15.1.1 Individual Debian releases (package webkit2gtk) and fixed versions of the product: bookworm (security) - 2.46.4-1~deb12u1 bullseye (security) - 2.46.4-1~deb11u1 trixie, sid - 2.46.4-1 Red Hat has fixes available for the less severe vulnerability. The systems are not affected by the second vulnerability or no fix has been released; however, affected installations of Red Hat Enterprise Linux 7 can mitigate the impact of this vulnerability by setting the environment variable JavaScriptCoreUseJIT to the value 0. Vulnerabilities: WebKitGTK and WPE WebKit - intro, WebKitGTK and WPE WebKit - RCE (CVE-2024-44308, CVSS 8.8), WebKitGTK and WPE WebKit - XSS (CVE-2024-44309, CVSS 6.3)https://cyberfeed.cesnet.cz/reports/308?lang=enhttps://cyberfeed.cesnet.cz/reports/307?lang=enNetScaler fixes 2 vulnerabilities in NetScaler ADC and NetScaler Gateway. Ways to verify affected instances can be found at. Individual products and their fixed versions: NetScaler Gateway - 14.1-29.72, 13.1-55.34 NetScaler ADC - 14.1-29.72, 13.1-55.34 NetScaler ADC FIPS - 13.1-37.207, 12.1-55.321 NetScaler ADC NDcPP - 12.1-55.321 Vulnerabilities: NetScaler ADC, Gateway - memory corruption (CVE-2024-8534, CVSS 10.0), NetScaler ADC, Gateway - unathorized access (CVE-2024-8535, CVSS 7.4), NetScaler ADC, Gateway - introhttps://cyberfeed.cesnet.cz/reports/307?lang=enhttps://cyberfeed.cesnet.cz/reports/306?lang=enIvanti is fixing 49 vulnerabilities in its products. The most severe of them are listed below; others can be found at. Products and their fixed versions: Ivanti Avalanche - 6.4.6 Ivanti Endpoint Manager (EPM) - 2024 November Security Update, 2022 SU6 November Security Update Ivanti Connect Secure (ICS) - 22.7R2.3 Ivanti Policy Secure (IPS) - 22.7R1.2 Vulnerabilities: Ivanti - intro, Ivanti Avalanche - denial of service (CVE-2024-50317, CVE-2024-50318, CVSS 7.5), Ivanti Avalanche - denial of service (CVE-2024-50319, CVE-2024-50320, CVE-2024-50321, CVSS 7.5), Ivanti Avalanche - sensitive information leakage (CVE-2024-50331, CVSS 7.5), Ivanti Endpoint Manager - RCE (CVE-2024-50330, CVSS 9.8), Ivanti Endpoint Manager - RCE (CVE-2024-50329, CVSS 8.8), Ivanti Endpoint Manager - RCE (CVE-2024-34787, CVE-2024-50322, CVSS 7.8), Ivanti Endpoint Manager - RCE (CVE-2024-50323, CVSS 7.8), Ivanti Endpoint Manager - RCE (CVE-2024-32839, CVE-2024-32841, CVE-2024-32844, CVE-2024-32847, CVE-2024-34780, CVE-2024-37376, CVE-2024-34781, CVE-2024-34782, CVE-2024-34784, CVE-2024-50326, CVE-2024-50327, CVE-2024-50328, CVSS 7.2), Ivanti Connect Secure and Policy Secure - RCE (CVE-2024-38655, CVE-2024-38656, CVE-2024-39710, CVE-2024-39711, CVE-2024-39712, CVSS 9.1), Ivanti Connect Secure and Policy Secure - RCE (CVE-2024-11005, CVE-2024-11006, CVE-2024-11007, CVSS 9.1)https://cyberfeed.cesnet.cz/reports/306?lang=enhttps://cyberfeed.cesnet.cz/reports/305?lang=enElastic Kibana version 8.15.1 fixes 2 critical vulnerabilities. If an update is not possible, the issue for CVE-2024-37288 can be mitigated by disabling the Integration Assistant using the setting 'xpack.integration_assistant.enabled: false' in the kibana.yml configuration file. Vulnerabilities: Elastic Kibana - arbitrary code execution (CVE-2024-37288, CVSS 9.9), Elastic Kibana - intro, Elastic Kibana - arbitrary code execution (CVE-2024-37285, CVSS 9.1)https://cyberfeed.cesnet.cz/reports/305?lang=enhttps://cyberfeed.cesnet.cz/reports/304?lang=enKubernetes kubelet versions 1.28.12, 1.29.7 and 1.30.3 fix a high-severity vulnerability. Vulnerabilities: Kubernetes kubelet - arbitrary command execution (CVE-2024-10220, CVSS 8.1), Kubernetes kubelet - introhttps://cyberfeed.cesnet.cz/reports/304?lang=enhttps://cyberfeed.cesnet.cz/reports/303?lang=enApache versions 4.18.2.5 and 4.19.1.3 fix a high-severity vulnerability. Vulnerabilities: Apache CloudStack - unauthorized access, data disclosure, DoS (CVE-2024-50386, CVSS 8.5), Apache CloudStack - introhttps://cyberfeed.cesnet.cz/reports/303?lang=enhttps://cyberfeed.cesnet.cz/reports/302?lang=enNextcloud fixes 16 vulnerabilities in Nextcloud Mail, Nextcloud Tables, Nextcloud Desktop Client, Nextcloud User OIDC and Nextcloud (Enterprise) Server. Individual products and their fixed versions: Nextcloud Mail - 1.14.6, 1.15.4, 2.2.11, 3.6.3, 3.7.7, 4.0.0 Nextcloud Tables - 0.8.1 Nextcloud Server - 28.0.12, 29.0.9, 30.0.2 Nextcloud Enterprise Server - 25.0.13.14, 26.0.13.10, 27.1.11.10, 28.0.12, 29.0.9, 30.0.2 Nextcloud Desktop Client - 3.14.2 Nextcloud User OIDC - 6.1.0 Vulnerabilities: Nextcloud Mail - information leak (CVE-2024-52508, CVSS 8.2), Nextcloud Tables - unauthorized alteration (CVE-2024-52511, CVSS 6.3), Nextcloud Server - SVG preview leak (CVE-2024-52515, CVSS 5.7), Nextcloud (Enterprise) Server - DoS (CVE-2024-52520, CVSS 5.7), Nextcloud Desktop Client - improper signature validation (CVE-2024-52510, CVSS 4.2), Nextcloud User OIDC - unsafe URL redirect (CVE-2024-52512, CVSS 6.1), Nextcloud - introhttps://cyberfeed.cesnet.cz/reports/302?lang=enhttps://cyberfeed.cesnet.cz/reports/301?lang=enGitHub CLI version 2.62.0 fixes a high-severity vulnerability. Vulnerabilities: GitHub CLI - remote code execution (CVE-2024-52308, CVSS 8.0), GitHub CLI - introhttps://cyberfeed.cesnet.cz/reports/301?lang=enhttps://cyberfeed.cesnet.cz/reports/300?lang=enJenkins is fixing 7 vulnerabilities in its plugins. Plugins and fixed versions: Authorize Project Plugin - 1.8.0 IvyTrigger Plugin - 1.02 OpenId Connect Authentication Plugin - 4.421.v5422614eb_e0a_ Declarative Plugin - 2.2218.v56d0cda_37c72 Groovy Plugin - 3993.v3e20a_37282f8 Script Security Plugin - 1368.vb_b_402e3547e7 Shared Library Version Override Plugin - 19.v3a_c975738d4a_ Vulnerabilities: Jenkins - script security bypass (CVE-2024-52554, CVSS 8.8), Jenkins - insufficient session expiration (CVE-2024-52553, CVSS 8.8), Jenkins - stored cross-site scripting (CVE-2024-52552, CVSS 8.0), Jenkins - incorrect default permissions (CVE-2024-52551, CVSS 8.0), Jenkins - incorrect default permissions (CVE-2024-52550, CVSS 8.0), Jenkins - XML external entity injection (CVE-2022-46751, CVSS 7.1), Jenkins - missing permission check (CVE-2024-52549, CVSS 4.3), Jenkins - introhttps://cyberfeed.cesnet.cz/reports/300?lang=enhttps://cyberfeed.cesnet.cz/reports/299?lang=enneedrestart version 3.8 fixes 4 high-severity vulnerabilities. Needrestart is a tool that detects which services need to be restarted (usually after an update). In the default configuration, this tool is available on all Ubuntu Server instances since version 21.04, but the vulnerabilities also affect other Linux distributions where it can be installed additionally. Further details about these vulnerabilities can be found at. A command to check whether your machine is vulnerable and options for a temporary workaround can be found at. Individual Linux distributions and their fixed versions: Ubuntu: Oracular - 3.6-8ubuntu4 Noble - 3.6-7ubuntu4.1 Jammy - 3.5-5ubuntu2.1 Focal - 3.4-6ubuntu0.1 Bionic - 3.1-1ubuntu0.1 Xenial - 2.6-1 Debian: bullseye (security) - 3.5-4+deb11u4 bookworm (security) - 3.6-4+deb12u2 Vulnerabilities: needrestart - RCE (CVE-2024-48990, CVE-2024-48992, CVSS 7.8), needrestart - RCE (CVE-2024-48991, CVSS 7.8), needrestart - command execution (CVE-2024-11003, CVSS 7.8), needrestart - introhttps://cyberfeed.cesnet.cz/reports/299?lang=enhttps://cyberfeed.cesnet.cz/reports/298?lang=enGitLab fixes 6 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) in versions 17.5.2, 17.4.4 and 17.3.7. The most severe vulnerabilities are listed below. Vulnerabilities: GitLab CE/EE - unauthorized Kubernetes access (CVE-2024-9693, CVSS 8.5), GitLab CE/EE - unauthorized API access (CVE-2024-7404, CVSS 6.8), GitLab CE/EE - DoS (CVSS 6.5), GitLab CE/EE - XSS (CVE-2024-8648, CVSS 6.1), GitLab CE/EE - introhttps://cyberfeed.cesnet.cz/reports/298?lang=enhttps://cyberfeed.cesnet.cz/reports/297?lang=enSonatype version 2.15.2 fixes two vulnerabilities in the product Nexus Repository 2. Vulnerabilities: Sonatype Nexus Repository - remote code execution (CVE-2024-5082, CVSS 4.3), Sonatype Nexus Repository - cross-site scripting (CVE-2024-5083, CVSS 4.6), Sonatype Nexus Repository - introhttps://cyberfeed.cesnet.cz/reports/297?lang=enhttps://cyberfeed.cesnet.cz/reports/296?lang=enApache fixes 3 vulnerabilities in Apache Traffic Server in versions 10.0.2 and 9.2.6. Vulnerabilities: Apache Traffic Server - cache poisoning (CVE-2024-38479, CVSS 7.5), Apache Traffic Server - DoS (CVE-2024-50305, CVSS 7.5), Apache Traffic Server - privilege drop failure (CVE-2024-50306, CVSS 9.1), Apache Traffic Server - introhttps://cyberfeed.cesnet.cz/reports/296?lang=enhttps://cyberfeed.cesnet.cz/reports/295?lang=enPostgreSQL versions 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 fix 4 vulnerabilities. Version 12 will no longer be supported, so migration to newer versions of the product is recommended. Vulnerabilities: PostgreSQL - intro, PostgreSQL - RCE (CVE-2024-10979, CVSS 8.8), PostgreSQL - unauthorized data manipulation (CVE-2024-10978, CVSS 4.2), PostgreSQL - unauthorized data manipulation (CVE-2024-10976, CVSS 4.2), PostgreSQL - false query results (CVE-2024-10977, CVSS 3.1)https://cyberfeed.cesnet.cz/reports/295?lang=enhttps://cyberfeed.cesnet.cz/reports/293?lang=enPalo Alto Networks fixes 5 vulnerabilities in Expedition with version 1.2.96, two of which have been added to CISA's list of known, actively exploited vulnerabilities. In addition, the company warns of a critical vulnerability affecting devices whose management interface is openly accessible from the internet. We strongly recommend restricting access to this interface to trusted IP addresses only. According to Palo Alto Networks, this vulnerability is already being actively exploited. Vulnerabilities: Palo Alto Networks - intro, Palo Alto Networks Expedition - SQL injection (CVE-2024-9465, CVSS 9.1), Palo Alto Networks Expedition - OS command execution (CVE-2024-9463, CVSS 9.8), Palo Alto Networks Expedition - OS command execution (CVE-2024-9464, CVSS 8.8), Palo Alto Networks Expedition - credential disclosure (CVE-2024-9466, CVSS 6.5), Palo Alto Networks Expedition - XSS (CVE-2024-9467, CVSS 5.4), Palo Alto Networks management interface - command execution (CVSS 10.0)https://cyberfeed.cesnet.cz/reports/293?lang=enhttps://cyberfeed.cesnet.cz/reports/292?lang=enCisco fixes 26 vulnerabilities in its products. The most severe of them are listed below; the rest can be found at the link. Products and their fixed versions: Cisco Unified Industrial Wireless Software - 17.15.1 Cisco Nexus Dashboard Fabric Controller (NDFC) - 12.2.1 Cisco Enterprise Chat and Email (ECE) - 12.5(1) ES9 and 12.6(1) ES9 ET3 Cisco Unified Communications Manager IM & Presence (CM IM&P) - 12.5(1)SU9, 14SU5 (2025) and 15SU2 Cisco Identity Services Engine (ISE) - fixes for the individual vulnerabilities can be found at Cisco Unified Communications Manager (CM) and Unified CM Session Management Edition (CM SME) - 14SU5 (2025) and 15SU2 Vulnerabilities: Cisco - intro, Cisco Unified Industrial Wireless Software - OS command injection (CVE-2024-20418, CVSS 10.0), Cisco NDFC - SQL command execution (CVE-2024-20536, CVSS 8.8), Cisco ECE - denial of service (CVE-2024-20484, CVSS 7.5), Cisco Unified CM IM&P - credential disclosure (CVE-2024-20457, CVSS 6.5), Cisco Identity Services Engine - authorization bypass (CVE-2024-20537, CVSS 6.5), Cisco Identity Services Engine - XSS (CVE-2024-20525, CVE-2024-20530, CVSS 6.1), Cisco Identity Services Engine - XSS (CVE-2024-20538, CVSS 6.1), Cisco Unified CM and Unified CM SME - XSS (CVE-2024-20511, CVSS 6.1), Cisco Identity Services Engine - arbitrary file read/delete (CVE-2024-20527, CVE-2024-20529, CVE-2024-20532, CVSS 5.5), Cisco Identity Services Engine - arbitrary file read, SSRF (CVE-2024-20531, CVSS 5.5)https://cyberfeed.cesnet.cz/reports/292?lang=enhttps://cyberfeed.cesnet.cz/reports/291?lang=enMozilla fixes 11 vulnerabilities in Thunderbird, Firefox and Firefox ESR. The most severe vulnerabilities are listed below. Individual products and their fixed versions: Firefox - 132 Firefox ESR - 128.4, 115.17 Thunderbird - 128.4, 132 Vulnerabilities: Firefox and Thunderbird - permission leak (CVE-2024-10458, CVSS 6.5), Firefox and Thunderbird - DoS (CVE-2024-10459, CVSS 6.5), Firefox and Thunderbird - RCE (CVE-2024-10467, CVSS 8.8), Firefox and Thunderbird - introhttps://cyberfeed.cesnet.cz/reports/291?lang=enhttps://cyberfeed.cesnet.cz/reports/290?lang=enIcinga fixes a critical vulnerability in Icinga 2 with versions v2.14.3, v2.13.10, v2.12.11 and v2.11.12. If updating to a fixed version is not possible, access to the Icinga 2 API port can be restricted using a firewall to mitigate the potential impact. Among operating systems, Gentoo has released a fix in version 2.14.3 for the most commonly used architectures. Debian provides a fix only for the sid release in version 2.14.3-1. Vulnerabilities: Icinga 2 - intro, Icinga 2 - certificate validation bypass (CVE-2024-49369, CVSS 9.8)https://cyberfeed.cesnet.cz/reports/290?lang=enhttps://cyberfeed.cesnet.cz/reports/289?lang=enRabbitMQ fixes 1 vulnerability in RabbitMQ and Tanzu RabbitMQ. The vulnerability is fixed in version 3.12.11 for RabbitMQ and in versions 1.5.2, 3.13.0 and 4.0.0 for Tanzu RabbitMQ. Vulnerabilities: RabbitMQ - unauthorized deletion (CVE-2024-51988, CVSS 6.5), RabbitMQ - introhttps://cyberfeed.cesnet.cz/reports/289?lang=enhttps://cyberfeed.cesnet.cz/reports/288?lang=enHPE Aruba Networking fixes 6 vulnerabilities in the Access Points product (Instant AOS-8 and AOS-10), 2 of which are critical. The vulnerabilities are fixed in versions 8.12.0.3 and 8.10.0.14 for Instant AOS and in 10.7.0.0 and 10.4.1.5 for AOS. Information on temporary fixes for the vulnerabilities can be found at. Vulnerabilities: Aruba Networking Access Points - RCE (CVE-2024-42509, CVSS 9.8), Aruba Networking Access Points - OS command injection (CVE-2024-47461, CVSS 7.2), Aruba Networking Access Points - RCE (CVE-2024-47460, CVSS 9.0), Aruba Access Points - RCE (CVE-2024-47462, CVE-2024-47463, CVSS 7.2), Aruba Networking Access Points - arbitrary file read (CVE-2024-47464, CVSS 6.8), Aruba Networking Access Points - introhttps://cyberfeed.cesnet.cz/reports/288?lang=enhttps://cyberfeed.cesnet.cz/reports/287?lang=enF5 fixes a medium-severity vulnerability in the NGINX OpenID Connect component, which is implemented in several products. Products and their fixes: NGINX Instance Manager - 2.17.4 NGINX API Connectivity Manager - 1.9.3 NGINX Ingress Controller - 3.7.1 NGINX Plus - it is recommended to update the product to version R31 or newer and to further update the nginx-plus-module-njs module and the nginx-openid-connect component. Detailed information can be found at. Vulnerabilities: F5 NGINX OpenID Connect - intro, F5 NGINX OpenID Connect - session misuse (CVE-2024-10318, CVSS 5.4)https://cyberfeed.cesnet.cz/reports/287?lang=enhttps://cyberfeed.cesnet.cz/reports/286?lang=enPfSense fixes a vulnerability in PfSense CE in version 2.7.1 and in PfSense Plus in version 23.09. Vulnerabilities: PfSense - RCE (CVE-2024-46538, CVSS 9.0), PfSense - introhttps://cyberfeed.cesnet.cz/reports/286?lang=enhttps://cyberfeed.cesnet.cz/reports/285?lang=enAutodesk fixes a vulnerability in AutoCAD 2024 with version 2024.1.6 and 21 vulnerabilities in AutoCAD 2025 with version 2025.1.1. A detailed description of the individual vulnerabilities can be found at. Vulnerabilities: Autodesk AutoCAD - intro, Autodesk AutoCAD - RCE, DoS, data write (CVE-2024-8592, CVSS 7.8), Autodesk AutoCAD - RCE, DoS, data write (CVE-2024-8590, CVE-2024-8595, CVE-2024-9826, CVSS 7.8), Autodesk AutoCAD - RCE, DoS, data write (CVE-2024-8896, CVSS 7.8), Autodesk AutoCAD - RCE, DoS, data write/read (CVE-2024-7991, CVE-2024-7992, CVE-2024-8587, CVE-2024-8588, CVE-2024-8589, CVE-2024-8591, CVE-2024-8593, CVE-2024-8594, CVE-2024-8596, CVE-2024-8597, CVE-2024-8598, CVE-2024-8599, CVE-2024-8560, CVE-2024-9489, CVE-2024-9827, CVE-2024-9996, CVE-2024-9997, CVSS 7.8)https://cyberfeed.cesnet.cz/reports/285?lang=enhttps://cyberfeed.cesnet.cz/reports/284?lang=enApache fixes a high-severity vulnerability in the Lucene.Net.Replicator library with version 4.8.0-beta00017. Vulnerabilities: Apache Lucene.Net.Replicator - intro, Apache Lucene.Net.Replicator - remote code execution (CVE-2024-43383, CVSS 8.0)https://cyberfeed.cesnet.cz/reports/284?lang=enhttps://cyberfeed.cesnet.cz/reports/283?lang=enBased on evidence of active exploitation, CISA has added to its catalog of known exploited vulnerabilities a vulnerability affecting the Remote Access VPN (RAVPN) service in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software. The fixed versions can be determined using the Cisco Software Checker tool: on the first page, enter the product type and version; on the second, select all impact assessments and security advisories; and on the last page, choose the highest of the displayed fixed versions and update the affected device to it. If updating is not possible, to reduce the likelihood of an attack and limit the possible impacts it is recommended to enable logging and configure threat detection features for RAVPN services, which automatically block IP addresses exceeding the configured limits of login attempts. If these features are not supported in the given Secure Firewall version, it is recommended to use hardening measures such as disabling AAA authentication or disabling Secure Firewall Posture (Hostscan). Detailed information can be found at. Vulnerabilities: Cisco Adaptive Security Appliance and Firepower Threat Defense - intro, Cisco Adaptive Security Appliance and Firepower Threat Defense - denial of service (CVE-2024-20481, CVSS 5.8)https://cyberfeed.cesnet.cz/reports/283?lang=enhttps://cyberfeed.cesnet.cz/reports/282?lang=enZimbra fixes another vulnerability in Zimbra Collaboration with versions 9.0.0 Patch 41, 10.0.9, 10.1.1 and 8.8.15 Patch 46. Vulnerabilities: Zimbra Collaboration - remote code execution (CVE-2024-45518, CVSS 8.8), Zimbra Collaboration - introhttps://cyberfeed.cesnet.cz/reports/282?lang=enhttps://cyberfeed.cesnet.cz/reports/281?lang=enSynology fixes a critical vulnerability in Synology Photos in versions 1.7.0-0795 and 1.6.2-0720. Synology Photos is an application that can be installed on Synology DiskStation storage systems, and on Synology BeeStation products it is pre-installed and enabled in the default configuration. Synology Photos 1.7.0 requires Synology DiskStation Manager version 7.2.2 or higher to be installed, and 1.6.2 requires version 7.2 or higher. Vulnerabilities: Synology Photos - RCE (CVSS 10.0), Synology Photos - introhttps://cyberfeed.cesnet.cz/reports/281?lang=enhttps://cyberfeed.cesnet.cz/reports/280?lang=enVMware fixes 3 vulnerabilities in its products. Products and their fixes: Spring Framework - 5.3.41, 6.0.25 and 6.1.14 Spring Security - 5.7.13, 5.8.15, 6.0.13, 6.1.11, 6.2.7 and 6.3.4 Vulnerabilities: VMware Spring - path traversal (CVE-2024-38819, CVSS 7.5), VMware Spring - sensitive match exception (CVE-2024-38820, CVSS 5.3), VMware Spring - authorization bypass (CVE-2024-38821, CVSS 9.1), VMware Spring - introhttps://cyberfeed.cesnet.cz/reports/280?lang=enhttps://cyberfeed.cesnet.cz/reports/279?lang=enXerox fixes a high-severity vulnerability affecting EC80xx, AltaLink, VersaLink and WorkCentre printers. The vulnerable versions and their fixes can be found here. Vulnerabilities: Xerox - remote code execution (CVE-2024-6333, CVSS 7.2), Xerox - introhttps://cyberfeed.cesnet.cz/reports/279?lang=enhttps://cyberfeed.cesnet.cz/reports/278?lang=enX.Org X server with version 21.1.14 and Xwayland with version 24.1.4 fix a high-severity vulnerability. Debian has already released fixes for the bullseye distribution in version 2:1.20.11-1+deb11u14, bookworm in version 2:21.1.7-3+deb12u8 and sid in version 2:21.1.14-1. Slackware released a fix as part of SSA:2024-304-04. Vulnerabilities: X.Org and Xwayland - privilege escalation (CVE-2024-9632, CVSS 7.8), X.Org and Xwayland - introhttps://cyberfeed.cesnet.cz/reports/278?lang=enhttps://cyberfeed.cesnet.cz/reports/277?lang=enSquid fixes a high-severity vulnerability with version 6.10. Vulnerabilities: Squid - intro, Squid - denial of service (CVE-2024-45802, CVSS 7.5)https://cyberfeed.cesnet.cz/reports/277?lang=enhttps://cyberfeed.cesnet.cz/reports/276?lang=enFortinet fixes a critical vulnerability in FortiManager Cloud in versions 7.4.5, 7.2.8 and 7.0.13. Vulnerabilities: FortiManager Cloud - RCE (CVE-2024-47575, CVSS 9.8), FortiManager - introhttps://cyberfeed.cesnet.cz/reports/276?lang=enhttps://cyberfeed.cesnet.cz/reports/275?lang=enSolarWinds fixes several vulnerabilities in its products, one of them critical. Products and their fixes: SolarWinds Web Help Desk - 12.8.3 HF3 SolarWinds Platform - 2024.4 SolarWinds Serv-U - 15.5 SolarWinds Kiwi CatTools - 3.12.4 Vulnerabilities: SolarWinds Web Help Desk - remote code execution (CVE-2024-28988, CVSS 9.8), SolarWinds Platform - privilege escalation (CVE-2024-45710, CVSS 7.8), SolarWinds Serv-U - remote code execution (CVE-2024-45711, CVSS 7.5), SolarWinds Platform - cross-site scripting (CVE-2024-45715, CVSS 7.1), SolarWinds Serv-U - cross site scripting (CVE-2024-45714, CVSS 5.7), SolarWinds Kiwi CatTools - sensitive information disclosure (CVE-2024-45713, CVSS 5.1), SolarWinds - introhttps://cyberfeed.cesnet.cz/reports/275?lang=enhttps://cyberfeed.cesnet.cz/reports/274?lang=enGitLab fixes 2 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) with versions 17.5.1, 17.4.3 and 17.3.6. Vulnerabilities: GitLab CE/EE - intro, GitLab CE/EE - XSS (CVE-2024-8312, CVSS 8.7), GitLab CE/EE - denial of service (CVE-2024-6826, CVSS 6.5)https://cyberfeed.cesnet.cz/reports/274?lang=enhttps://cyberfeed.cesnet.cz/reports/273?lang=enVMware HCX fixes a high-severity vulnerability with versions 4.8.3, 4.9.2 and 4.10.1. Vulnerabilities: VMware HCX - intro, VMware HCX - SQL injection (CVE-2024-38814, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/273?lang=enhttps://cyberfeed.cesnet.cz/reports/272?lang=enCisco fixes a critical vulnerability in Cisco Adaptive Security Appliance Software (ASA). The fixed versions can be obtained at, where the product type and version must be entered on the first page. On the next page, all impact assessments and all security advisories must be selected. On the last page, the highest of the displayed fixed versions must be selected and the affected device updated to it. If an update cannot be performed, the vulnerability can be worked around as a mitigation by enabling the native SSH stack and disabling the CiscoSSH stack with the command 'no ssh stack ciscossh'. For the change to persist after a restart, it is necessary to log in again and save the configuration. Although the workaround has been successfully tested, customers should assess its suitability and performance impact in their own environment and under their own operating conditions, as it may negatively affect network functionality. Vulnerabilities: Cisco Adaptive Security Appliance Software - remote command injection (CVE-2024-20329, CVSS 9.9), Cisco Adaptive Security Appliance Software - introhttps://cyberfeed.cesnet.cz/reports/272?lang=enhttps://cyberfeed.cesnet.cz/reports/271?lang=enOpenSSL warns of a vulnerability that allows writing outside the bounds of allocated memory. Due to the low severity of this issue, no new OpenSSL versions will be released at this time. The fix will be included in the next release of each branch once available, in versions 3.3.3, 3.2.4, 3.1.8, 3.0.16, 1.1.1zb and 1.0.2zl. However, fixes are already available in the OpenSSL git repository in commit c0d3e4d3 (for version 3.3), commit bc7e04d7 (for version 3.2), commit fdf67233 (for version 3.1) and commit 72ae83ad (for version 3.0). For premium support customers, the fix is available in commit 8efc0cba (for version 1.1.1) and in commit 9d576994 (for version 1.0.2). Slackware released a fix as part of SSA:2024-295-01 - openssl-1.1.1zb. Vulnerabilities: OpenSSL - out-of-bounds memory write (CVE-2024-9143, CVSS 8.8), OpenSSL - introhttps://cyberfeed.cesnet.cz/reports/271?lang=enhttps://cyberfeed.cesnet.cz/reports/270?lang=enGitHub Enterprise Server versions 3.11.16, 3.12.10, 3.13.5 and 3.14.2 fix two vulnerabilities, one of which is of high severity. Vulnerabilities: GitHub Enterprise Server - intro, GitHub Enterprise Server - authentication bypass (CVE-2024-9487, CVSS 8.9), GitHub Enterprise Server - metadata disclosure (CVE-2024-9539, CVSS 4.8)https://cyberfeed.cesnet.cz/reports/270?lang=enhttps://cyberfeed.cesnet.cz/reports/268?lang=enSplunk versions 9.1.6, 9.2.3 and 9.3.1 fix several vulnerabilities in Splunk Enterprise. Three high-severity vulnerabilities are described below; others can be found here. Vulnerabilities: Splunk Enterprise - intro, Splunk Enterprise - remote code execution (CVE-2024-45733, CVSS 8.8), Splunk Enterprise - remote code execution (CVE-2024-45731, CVSS 8.0), Splunk Enterprise - restricted data access (CVE-2024-45732, CVSS 7.1)https://cyberfeed.cesnet.cz/reports/268?lang=enhttps://cyberfeed.cesnet.cz/reports/267?lang=enApache Solr versions 8.11.4 and 9.7.0 fix 2 vulnerabilities. Vulnerabilities: Apache Solr - intro, Apache Solr - authentication bypass (CVE-2024-45216, CVSS 9.8), Apache Solr - arbitrary code execution (CVE-2024-45217, CVSS 8.1)https://cyberfeed.cesnet.cz/reports/267?lang=enhttps://cyberfeed.cesnet.cz/reports/266?lang=enMozilla versions 131.0.2, 115.16.1 (ESR) and 128.3.1 (ESR) fix an actively exploited critical vulnerability in Firefox. Among operating systems, the vulnerability has been fixed by Slackware in version 15.0; Gentoo has some fixed versions available as stable and some as testing; Red Hat has fixes available. Ubuntu released the fixed version 131.0.2+build1-0ubuntu0.20.04.1 for Focal 20.04 LTS. Jammy 22.04 LTS and Noble 24.04 LTS use snap and are therefore not affected. Debian released fixes for Firefox in version 131.0.2-1, and for Firefox (ESR) in the bullseye release in version 128.3.1esr-1~deb11u1 and in bookworm in version 128.3.1esr-1~deb12u1. Vulnerabilities: Firefox - intro, Firefox - code execution (CVE-2024-9680, CVSS 9.8)https://cyberfeed.cesnet.cz/reports/266?lang=enhttps://cyberfeed.cesnet.cz/reports/265?lang=enKubernetes Image Builder v0.1.38 fixes two vulnerabilities, the first of which is rated critical. The second, similar vulnerability received a lower CVSS score because it is harder to exploit. Vulnerabilities: Kubernetes Image Builder - default credentials use (CVE-2024-9486, CVSS 9.8), Kubernetes Image Builder - default credentials use (CVE-2024-9594, CVSS 6.3), Kubernetes Image Builder - introhttps://cyberfeed.cesnet.cz/reports/265?lang=enhttps://cyberfeed.cesnet.cz/reports/264?lang=enIvanti version 6.4.5 fixes 5 high-severity vulnerabilities in the Avalanche product. Vulnerabilities: Ivanti - intro, Ivanti Avalanche - sensitive information leakage (CVE-2024-47008, CVSS 7.5), Ivanti Avalanche - sensitive information leakage (CVE-2024-47011, CVSS 7.5), Ivanti Avalanche - denial of service (CVE-2024-47007, CVSS 7.5), Ivanti Avalanche - authentication bypass (CVE-2024-47009, CVE-2024-47010, CVSS 7.3)https://cyberfeed.cesnet.cz/reports/264?lang=enhttps://cyberfeed.cesnet.cz/reports/263?lang=enVMware fixes 3 vulnerabilities in its VMware NSX and Cloud Foundation products. Products and their fixes: NSX - 4.2.1 NSX-T - 3.2.4.1 Cloud Foundation (NSX) - Async Patch to 4.2.1 Cloud Foundation (NSX-T) - Async Patch to 3.2.4.1 Vulnerabilities: VMware NSX and Cloud Foundation - local privilege escalation (CVE-2024-38818, CVSS 6.7), VMware NSX and Cloud Foundation - arbitrary command execution (CVE-2024-38817, CVSS 6.7), VMware NSX and Cloud Foundation - sensitive information disclosure (CVE-2024-38815, CVSS 4.3), VMware NSX and Cloud Foundation - introhttps://cyberfeed.cesnet.cz/reports/263?lang=enhttps://cyberfeed.cesnet.cz/reports/262?lang=enThe libarchive library version 3.7.5 fixes 4 high-severity vulnerabilities. In addition, the latest version 3.7.7 is also available. Vulnerabilities: libarchive - intro, libarchive - remote code execution (CVE-2024-20696, CVSS 7.3), libarchive - remote code execution (CVE-2024-26256, CVSS 7.8), libarchive - out-of-bound memory access (CVE-2024-48957, CVSS 7.8), libarchive - out-of-bound memory access (CVE-2024-48958, CVSS 7.8)https://cyberfeed.cesnet.cz/reports/262?lang=enhttps://cyberfeed.cesnet.cz/reports/261?lang=enFoxit PDF Editor 12.1.8 and Foxit PDF Reader 2024.3.0.26795 fix a high-severity vulnerability. Vulnerabilities: Foxit PDF Reader and Foxit PDF Editor - arbitrary code execution (CVE-2024-28888, CVSS 8.8), Foxit PDF Reader and Foxit PDF Editor - introhttps://cyberfeed.cesnet.cz/reports/261?lang=enhttps://cyberfeed.cesnet.cz/reports/260?lang=enGNOME Project G Structured File Library (libgsf) version 1.14.53 fixes high-severity vulnerabilities. Vulnerabilities: libgsf - arbitrary code execution (CVE-2024-36474, CVE-2024-42415, CVSS 8.4), libgsf - introhttps://cyberfeed.cesnet.cz/reports/260?lang=enhttps://cyberfeed.cesnet.cz/reports/259?lang=enOATH Toolkit, a component for PAM login using one-time passwords, fixes a privilege escalation vulnerability in version 2.6.12. Debian 12 fixed the vulnerability in version 2.6.7-3.1+deb12u1. Ubuntu 24.04 LTS Noble fixed it in version 2.6.11-2.1ubuntu0.1 and 22.04 LTS Jammy in version 2.6.7-3ubuntu0.1; older LTS versions are not vulnerable. Arch fixed the vulnerability in version 2.6.12-1. Red Hat tracks the vulnerability in Ceph Storage 5 - 7 and Openshift Container Storage 4, but no fix is available yet. Fedora 39, 40 and 41 have received the fix, as has Gentoo. Slackware does not include oath-toolkit. Vulnerabilities: oath-toolkit - LPE (CVE-2024-47191, CVSS 7.8), liboath - Introhttps://cyberfeed.cesnet.cz/reports/259?lang=enhttps://cyberfeed.cesnet.cz/reports/258?lang=enApple iOS 18.0.1 and iPadOS 18.0.1 fix two vulnerabilities. Vulnerabilities: Apple - intro, Apple iOS, iPadOS - password disclosure (CVE-2024-44204, CVSS 2.1), Apple iOS, iPadOS - audio capture (CVE-2024-44207, CVSS 4.3)https://cyberfeed.cesnet.cz/reports/258?lang=enhttps://cyberfeed.cesnet.cz/reports/257?lang=enApache Avro Java Software Development Kit (SDK) versions 1.11.4 and 1.12.0 fix a high-severity vulnerability. If updating is not possible, it is recommended to sanitize schemas before parsing them and to avoid parsing user-supplied schemas. Vulnerabilities: Apache Avro - arbitrary code execution (CVE-2024-47561, CVSS 7.3), Apache Avro - introhttps://cyberfeed.cesnet.cz/reports/257?lang=enhttps://cyberfeed.cesnet.cz/reports/256?lang=enBased on evidence of active exploitation, CISA added to its Known Exploited Vulnerabilities catalog a vulnerability affecting Endpoint Manager (EPM) version 2022 SU5 and earlier, which the company disclosed in May this year. If you use one of these versions, implement the released patch immediately. Vulnerabilities: Ivanti Endpoint Manager - arbitrary code execution (CVE-2024-29824, CVSS 9.6), Ivanti EPM - introhttps://cyberfeed.cesnet.cz/reports/256?lang=enhttps://cyberfeed.cesnet.cz/reports/255?lang=enZimbra fixes 1 vulnerability in Zimbra Collaboration in versions 9.0.0 Patch 41, 10.0.9, 10.1.1 and 8.8.15 Patch 46. Vulnerabilities: Zimbra Collaboration - command injection (CVE-2024-45519, CVSS 10.0), Zimbra Collaboration - introhttps://cyberfeed.cesnet.cz/reports/255?lang=enhttps://cyberfeed.cesnet.cz/reports/254?lang=enNextcloud Desktop Client version 3.13.4 fixes a critical vulnerability in the Linux operating system. Vulnerabilities: Nextcloud - unauthorized file access (CVE-2024-46958, CVSS 9.1), Nextcloud - introhttps://cyberfeed.cesnet.cz/reports/254?lang=enhttps://cyberfeed.cesnet.cz/reports/253?lang=enCUPS and related components (cups-browsed, libcupsfilters, libppd, cups-filters) from OpenPrinting are affected by 4 vulnerabilities, which are critically severe if exploited as a chain. Although the affected components are present on most popular UNIX systems, in the default configuration they are enabled only on some of them - Ubuntu version 24.04 is confirmed, but it can be expected that other versions are affected too, and the same cannot be ruled out for other UNIX systems. The first precondition for exploiting the vulnerabilities is the "cups-browsed" service listening on port 631 of the affected device over the UDP protocol, which can be verified with the command "lsof -i :631". An official fix from the developers is not yet available. As a temporary fix, the "cups-browsed" service can be disabled/removed, or, if the system needs this service, any incoming UDP traffic to port 631 can be blocked. For operating system updates, fixing the vulnerability CVE-2024-47176 should suffice to prevent a remote attacker from executing commands in the OS; nevertheless, the remaining vulnerabilities also pose a security risk, so we strongly recommend updating the individual components to a version in which all the vulnerabilities are fixed as soon as possible. Individual distributions and their fixed versions: Ubuntu: noble: cups - 2.4.7-1.2ubuntu7.3, libppd - 2:2.0.0-0ubuntu4.1, libcupsfilters - 2.0.0-0ubuntu7.1, cups-browsed - 2.0.0-0ubuntu10.1 jammy: cups - 2.4.1op1-1ubuntu4.11, cups-filters - 1.28.15-0ubuntu1.3, focal: cups - 2.3.1-9ubunt:u1.9, cups-filters - 1.27.4-1ubuntu0.3 Debian: bullseye (security): cups - 2.3.3op2-3+deb11u9, cups-filters - 1.28.7-1+deb11u3 bookworm (security): cups - 2.4.2-3+deb12u8, cups-filters - 1.28.17-3+deb12u1 Vulnerabilities: CUPS - RCE (CVE-2024-47176, CVE-2024-47076, CVE-2024-47175, CVE-2024-47177, CVSS 8.3), CUPS - introhttps://cyberfeed.cesnet.cz/reports/253?lang=enhttps://cyberfeed.cesnet.cz/reports/252?lang=enIvanti fixes a critical vulnerability in the Cloud Services Appliance (CSA) product. Fixes were released in CSA 5.0 (recommended) and CSA 4.6 Patch 519. The vulnerability was added to CISA's list of known actively exploited vulnerabilities. Vulnerabilities: Ivanti Cloud Services Appliance - restricted functionality access (CVE-2024-8963, CVSS 9.4), Ivanti CSA - introhttps://cyberfeed.cesnet.cz/reports/252?lang=enhttps://cyberfeed.cesnet.cz/reports/251?lang=enCurl version 8.10.0 fixes a medium-severity vulnerability. Among operating systems, a fix was released for example by Debian for the sid and trixie releases in version 8.10.1-1. Ubuntu released a fix in versions 7.68.0-1ubuntu2.24, 7.81.0-1ubuntu1.18 and 8.5.0-2ubuntu10.4. Vulnerabilities: Curl - OCSP stapling bypass (CVE-2024-8096, CVSS 6.5), Curl - introhttps://cyberfeed.cesnet.cz/reports/251?lang=enhttps://cyberfeed.cesnet.cz/reports/250?lang=enIvanti fixes several vulnerabilities in the Ivanti Endpoint Manager product and one vulnerability (CVE-2024-8190) in the Ivanti Cloud Service Appliance product. Products and their fixes: Ivanti Endpoint Manager - 2022 SU6, 2024 with the security patch (both the July and September patches must be applied), 2024 SU1 (to be released) Ivanti Cloud Services Appliance - CSA 5.0 (recommended), CSA 4.6 Patch 519 Vulnerabilities: Ivanti Endpoint Manager - API secrets leakage (CVE-2024-37397, CVSS 8.2), Ivanti Endpoint Manager - remote code execution (CVE-2024-8191, CVSS 7.8), Ivanti Endpoint Manager - remote code execution (CVSS 7.2), Ivanti Endpoint Manager - Network Isolation spoofing (CVE-2024-8320, CVSS 5.3), Ivanti Endpoint Manager - managed device isolation (CVE-2024-8321, CVSS 5.8), Ivanti Endpoint Manager - restricted functionality access (CVE-2024-8322, CVSS 4.3), Ivanti Endpoint Manager - remote code execution (CVE-2024-29847, CVSS 9.8), Ivanti Endpoint Manager - privilege escalation (CVE-2024-8441, CVSS 6.7), Ivanti Cloud Service Appliance - remote code execution (CVE-2024-8190, CVSS 7.2), Ivanti - introhttps://cyberfeed.cesnet.cz/reports/250?lang=enhttps://cyberfeed.cesnet.cz/reports/249?lang=enCitrix fixes 2 vulnerabilities in Citrix Workspace Windows. The vulnerabilities are fixed in version 2405 for Citrix Workspace Windows and in version 2402 CU1 for Citrix Workspace Windows LTSR. Vulnerabilities: Citrix Workspace Windows - privilege escalation (CVE-2024-7889, CVSS 7.3), Citrix Workspace Windows - privilege escalation (CVE-2024-7890, CVSS 6.7), Citrix Workspace Windows - introhttps://cyberfeed.cesnet.cz/reports/249?lang=enhttps://cyberfeed.cesnet.cz/reports/248?lang=enRuby SAML and OmniAuth SAML fix a critical vulnerability. Ruby SAML fixes the vulnerability in versions 1.17.0 and 1.12.3 and OmniAuth SAML in version 2.2.0. The vulnerability also affects all products that use one of the mentioned libraries, such as GitLab. GitLab Community Edition (CE) and Enterprise Edition (EE) fix this vulnerability in versions 17.3.3, 17.2.7, 17.1.8, 17.0.8 and 16.11.10. As a temporary fix for GitLab, two-factor authentication can be configured (not the multi-factor authentication of the identity provider) and its bypass disabled. Options for finding successful and unsuccessful attempts to exploit the vulnerability can be found at. Vulnerabilities: Ruby SAML, OmniAuth SAML - SAML response forge (CVE-2024-45409, CVSS 10.0), Ruby SAML, OmniAuth SAML - introhttps://cyberfeed.cesnet.cz/reports/248?lang=enhttps://cyberfeed.cesnet.cz/reports/247?lang=enQNAP fixes several vulnerabilities in its products. The most severe of them can be found below. Products and their fixed versions: Video Station - 5.8.2 Download Station - 5.8.6.283 (2024/06/21) QuMagie - 2.3.1 QuLog Center - 1.8.0.872 (2024/06/17), 1.7.0.827 (2024/06/17) Helpdesk - 3.3.1 Music Station - 5.4.0 QVR Smart Client - 2.4.0.0570 Notes Station 3 - 3.9.6 QTS - 5.1.8.2823 build 20240712, 5.2.0.2782 build 20240601 QuTS hero - h5.1.8.2823 build 20240712, h5.2.0.2782 build 20240601 Vulnerabilities: Video Station - command injection (CVE-2023-47563, CVSS 7.4), Video Station - SQL injection (CVE-2023-50360, CVSS 8.8), Download Station - malicious code injection (CVE-2024-38640, CVSS 5.4), QuMagie - improper certificate validation (CVE-2024-38642, CVSS 7.8), QuLog Center - malicious code injection (CVE-2024-32762, CVSS 8.2), Helpdesk - malicious code injection (CVE-2024-27125, CVSS 3.5), Music Station - system compromise (CVE-2023-45038, CVSS 4.3), QVR Smart Client - unauthorized code execution, command execution (CVE-2022-27592, CVSS 6.7), Notes Station 3 - malicious code injection (CVE-2024-27122, CVE-2024-27126, CVSS 6.3), QTS and QuTS hero - arbitrary code execution (CVE-2024-38641, CVSS 7.8), QTS and QuTS hero - malicious command injection (CVE-2023-34974, CVSS 8.8), QTS and QuTS hero - data disclosure (CVE-2023-39298, CVSS 7.8), QNAP - Introhttps://cyberfeed.cesnet.cz/reports/247?lang=enhttps://cyberfeed.cesnet.cz/reports/246?lang=enFortinet fixes 9 vulnerabilities in various products. Individual products and their fixed versions: FortiSOAR - 7.4.4, 7.3.3 FortiClientEMS Cloud - 7.2.5, 7.0.13 FortiClientEMS - 7.2.5 FortiClientLinux - 7.2.1, 7.0.12 FortiClientMac - 7.2.5, 7.0.12 FortiClientWindows - 7.2.3, 7.0.12 FortiSandbox - 4.4.5, 4.2.7 FortiAnalyzer - 7.4.1, 7.2.5 FortiAnalyzer-BigData - 7.4.0, 7.2.6 FortiManager - 7.4.1, 7.2.5 FortiADC - 7.4.5 FortiEDR Manager - 6.2.2 FortiClientiOS - 7.4 Vulnerabilities: FortiSOAR - password bruteforce (CVE-2024-45327, CVSS 7.5), FortiClientEMS Cloud, FortiClientEMS - Command injection (CVE-2024-33508, CVSS 7.3), FortiClientEMS - path traversal (CVE-2024-21753, CVSS 5.5), FortiClient - MITM attack (CVE-2024-31489, CVSS 6.8), FortiSandbox - information leak (CVE-2024-31490, CVSS 4.3), FortiAnalyzer, FortiManager - information leak (CVE-2023-44254, CVSS 5.0), FortiADC - data leak (CVE-2024-36511, CVSS 3.7), FortiEDR Manager - information leak (CVE-2024-45323, CVSS 2.7), FortiClientiOS - password leak (CVE-2024-35282, CVSS 4.2), Fortinet - introhttps://cyberfeed.cesnet.cz/reports/246?lang=enhttps://cyberfeed.cesnet.cz/reports/204?lang=enGitLab versions 17.3.2, 17.2.5 and 17.1.7 fix 17 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE). The most severe vulnerabilities are listed below; the rest can be found in the link. Vulnerabilities: GitLab - authentication bypass (CVE-2024-6678, CVSS 9.9), GitLab - command injection (CVE-2024-8640, CVSS 8.8), GitLab - server-side request forgery (CVE-2024-8635, CVSS 7.7), GitLab - denial of service (CVE-2024-8124, CVSS 7.5), GitLab - obtaining a GitLab session token (CVE-2024-8641, CVSS 6.7), GitLab - protection bypass (CVE-2024-8311, CVSS 6.5), GitLab - source code read (CVE-2024-4660, CVSS 6.5), GitLab - open redirect (CVE-2024-4283, CVSS 6.4), GitLab Community Edition and Enterprise Edition - introhttps://cyberfeed.cesnet.cz/reports/204?lang=enhttps://cyberfeed.cesnet.cz/reports/203?lang=enPython fixes several vulnerabilities in versions 3.13.0RC2, 3.12.6, 3.11.10, 3.10.15, 3.9.20, and 3.8.20, several of which have no CVE identifier assigned. The most severe vulnerabilities are listed below. So far, Slackware has fixed the vulnerabilities. Debian and Ubuntu have fixed only some of the vulnerabilities in some releases. Gentoo has some fixed versions available in the stable branch and some in the testing branch. Vulnerabilities: Python - wrong IP type (CVE-2024-4032, CVSS 7.5), Python - incorrect directory permissions (CVE-2024-4030, CVSS 7.1), Python - type confusion, Python - introhttps://cyberfeed.cesnet.cz/reports/203?lang=enhttps://cyberfeed.cesnet.cz/reports/202?lang=enIntel has released a security advisory addressing several vulnerabilities in the hardware and UEFI firmware of some processors. If exploited, these vulnerabilities could allow privileged users to escalate their privileges, cause a denial of service or disclose sensitive information. A wide range of Intel processors is vulnerable, including: Intel Xeon D and E families Intel Core 10th, 11th and 12th generation Intel Atom Intel Pentium and Celeron The first two vulnerabilities, relating to hardware, are fixed by microcode-20240910; to fix the following ones and many others, users must wait for UEFI firmware updates from computer manufacturers. Lenovo users can already download fixes from the support site with specific instructions. Vulnerabilities: Intel processor - information disclosure (CVE-2024-23984, CVSS 5.3), Intel processor - denial of service (CVE-2024-24968, CVSS 5.3), UEFI firmware - denial of service (CVE-2024-23599, CVSS 7.9), UEFI firmware - privilege escalation (CVE-2024-21871, CVSS 7.5), UEFI firmware - privilege escalation (CVE-2023-42772, CVSS 8.2), UEFI firmware - privilege escalation (CVE-2024-21829, CVSS 7.5), UEFI firmware - information disclosure, denial of service (CVE-2024-21781, CVSS 7.2), Intel - introhttps://cyberfeed.cesnet.cz/reports/202?lang=enhttps://cyberfeed.cesnet.cz/reports/201?lang=enMozilla fixes 9 vulnerabilities in Firefox in versions 130, 128.2 (ESR) and 115.15 (ESR). Among operating systems, the vulnerabilities were fixed by Debian (some releases) and Slackware; Gentoo has some fixed versions available as stable and some as testing; and Ubuntu released the fixed version 130.0+build2-0ubuntu0.20.04.1 for the focal release, while the remaining releases are not affected by the vulnerabilities. Only the most severe vulnerabilities are listed below. A detailed list of vulnerable versions for each vulnerability can be found on the VA2AM site. Individual Debian releases and fixed versions: bullseye (security) - 115.15.0esr-1~deb11u1 bookworm (security) - 115.15.0esr-1~deb12u1 sid, trixie - 115.15.0esr-1 sid - 130.0-2 Vulnerabilities: Firefox - type confusion (CVE-2024-8381, CVSS 9.8), Firefox - type confusion (CVE-2024-8385, CVSS 9.8), Firefox - memory corruption, RCE (CVE-2024-8387, CVSS 9.8), Firefox - memory corruption, RCE (CVE-2024-8389, CVSS 9.8), Firefox - introhttps://cyberfeed.cesnet.cz/reports/201?lang=enhttps://cyberfeed.cesnet.cz/reports/200?lang=enthe administration tools Webmin 2.202 and Virtualmin 7.20.2 fix a UDP communication loop. Vulnerabilities: UDP loop - remote unauthenticated DoS/resource exhaustion (CVE-2024-2169, CVSS 8.6)https://cyberfeed.cesnet.cz/reports/200?lang=enhttps://cyberfeed.cesnet.cz/reports/199?lang=enExpat, an XML parser used in a large number of distributions (Debian, Ubuntu, Arch, Gentoo, CentOS, etc.) and software (Firefox, Chromium, LibreOffice, Thunderbird, Unbound, etc.), fixes 3 vulnerabilities in version 2.6.3. Of the operating systems, the vulnerabilities have so far been fixed by Slackware; Gentoo has released a fix for the most commonly used architectures, and Debian has so far released a fix only for the unstable and testing releases. Vulnerabilities: Expat - RCE, DoS (CVE-2024-45490, CVSS 9.8), Expat - RCE, DoS (CVE-2024-45491, CVE-2024-45492, CVSS 9.8), Expat - introhttps://cyberfeed.cesnet.cz/reports/199?lang=enhttps://cyberfeed.cesnet.cz/reports/198?lang=enRoundcube Webmail fixes 3 vulnerabilities in versions 1.6.8 and 1.5.8. Gentoo has the fixed version 1.6.9 available as testing. Individual Debian releases and fixed versions: bullseye - 1.4.15+dfsg.1-1+deb11u4 bookworm - 1.6.5+dfsg-1+deb12u4 trixie, sid - 1.6.9+dfsg-1 Vulnerabilities: Roundcube - XSS (CVE-2024-42009, CVSS 9.3), Roundcube - XSS (CVE-2024-42008, CVSS 9.3), Roundcube - information leak (CVE-2024-42010, CVSS 7.5), Roundcube Webmail - introhttps://cyberfeed.cesnet.cz/reports/198?lang=enhttps://cyberfeed.cesnet.cz/reports/196?lang=enGoogle fixes 37 vulnerabilities (19 of them publicly disclosed) in Google Chrome and also in web browsers based on Chromium. Google fixed the vulnerabilities for Chrome on Linux in version 128.0.6613.84 and for Chrome on Windows/Mac in version 128.0.6613.84/.85. The vulnerability CVE-2024-7971 was fixed by Microsoft for Edge in version 128.0.2739.42. The most severe vulnerabilities are listed below. Vulnerabilities: Google Chrome - type confusion (CVE-2024-7971, CVE-2024-7969, CVSS 8.8), Google Chrome - use after free (CVE-2024-7964, CVE-2024-7968, CVSS 8.8), Google Chrome - out-of-bound write (CVE-2024-7965, CVSS 8.8), Google Chrome - out-of-bound write (CVE-2024-7973, CVSS 8.8), Google Chrome - privilege escalation (CVE-2024-7977, CVE-2024-7979, CVE-2024-7980, CVSS 7.8), Google Chrome - introhttps://cyberfeed.cesnet.cz/reports/196?lang=enhttps://cyberfeed.cesnet.cz/reports/195?lang=enWebKitGTK and WPE WebKit fix 6 vulnerabilities in version 2.44.3. Gentoo fixed the vulnerabilities in the testing version. Individual Apple products and fixed versions: iOS - 16.7.9, 17.6 iPadOS - 16.7.9, 17.6 Safari - 17.6 watchOS - 10.6 tvOS - 17.6 visionOS - 1.3 macOS Sonoma - 14.6 Individual Debian releases (package webkit2gtk) and fixed product versions: bookworm - 2.44.2-1~deb12u1 bookworm (security) - 2.44.3-1~deb12u1 trixie, sid - 2.44.3-1 Vulnerabilities: WebKitGTK - out-of-bounds access (CVE-2024-40789, CVSS 6.5), WebKitGTK - use after free (CVE-2024-40782, CVE-2024-40776, CVSS 9.8), WebKitGTK - out-of-bounds read (CVE-2024-40779, CVE-2024-40780, CVSS 5.5), WebKitGTK - user after free (CVE-2024-4558, CVSS 7.5), WebKitGTK - introhttps://cyberfeed.cesnet.cz/reports/195?lang=enhttps://cyberfeed.cesnet.cz/reports/194?lang=enCisco fixes 5 vulnerabilities in Cisco Unified Communications Manager (UCM) and Cisco Identity Services Engine (ISE). The vulnerabilities are fixed in version 15SU1 for UCM and in version 3.3P3 for ISE. The vulnerability CVE-2024-20417 will be fixed in the near future by a patch (more information at). Vulnerabilities: Cisco Unified Communications Manager - DoS (CVE-2024-20375, CVSS 8.6), Cisco Unified Communications Manager - XSS (CVE-2024-20488, CVSS 6.1), Cisco Identity Services Engine - information leak (CVE-2024-20466, CVSS 6.5), Cisco Identity Services Engine - SQL injection (CVE-2024-20417, CVSS 6.5), Cisco Identity Services Engine - CSRF (CVE-2024-20486, CVSS 6.5), Cisco - introhttps://cyberfeed.cesnet.cz/reports/194?lang=enhttps://cyberfeed.cesnet.cz/reports/193?lang=enFFmpeg (a multimedia framework used by popular applications such as VLC Media Player and OBS Studio) fixes 3 vulnerabilities in versions 7.0.2, 6.1.2, 6.0.1, 4.4.5, 4.3.8 and 4.2.10. A detailed list of the affected versions for each vulnerability can be found in the web version of the report (link below). The vulnerabilities CVE-2024-7055 and CVE-2024-7272 are fixed by Debian in the bookworm (security) release with version 7:5.1.6-0+deb12u1. Slackware fixes the vulnerabilities CVE-2023-47342 and CVE-2024-7055. Vulnerabilities: FFmpeg - Heap buffer overflow (CVE-2024-7055, CVSS 6.3), FFmpeg - Heap buffer overflow (CVE-2024-7272, CVSS 6.3), FFmpeg - Out of array access (CVE-2023-47342), FFmpeg - introhttps://cyberfeed.cesnet.cz/reports/193?lang=enhttps://cyberfeed.cesnet.cz/reports/192?lang=enGitHub fixes 3 vulnerabilities and several bugs in GitHub Enterprise Server in versions 3.13.3, 3.12.8, 3.11.14 and 3.10.16. Vulnerabilities: GitHub Enterprise Server - information leak (CVE-2024-6337, CVSS 5.8), GitHub Enterprise Server - information change (CVE-2024-7711, CVSS 6.4), GitHub Enterprise Server - admin account access (CVE-2024-6800, CVSS 8.7), GitHub Enterprise Server - introhttps://cyberfeed.cesnet.cz/reports/192?lang=enhttps://cyberfeed.cesnet.cz/reports/191?lang=enF5 fixes 9 vulnerabilities in BIG-IP, BIG-IP Next Central Manager, BIG-IP Next SPK and BIG-IP Next CNF. The most severe vulnerabilities are listed below. Individual products and their fixed versions: BIG-IP (all modules) - 17.1.1, 16.1.5 BIG-IP Next Central Manager - 20.2.1 BIG-IP Next SPK - 1.9.0 BIG-IP Next CNF - 1.2.0 Vulnerabilities: F5 BIG-IP Next Central Manager - session token reuse (CVE-2024-39809, CVSS 7.5), F5 BIG-IP Next Central Manager - account lock-out (CVE-2024-37028, CVSS 5.3), F5 BIG-IP - DoS (CVE-2024-39778, CVSS 7.5), F5 BIG-IP - DoS (CVE-2024-41727, CVSS 7.5), F5 BIG-IP, BIG-IP Next (SPK, CNF) - DoS (CVE-2024-41164, CVSS 5.9), F5 BIG-IP - introhttps://cyberfeed.cesnet.cz/reports/191?lang=enhttps://cyberfeed.cesnet.cz/reports/190?lang=enXWiki fixes 2 vulnerabilities in version 15.10.6. Vulnerabilities: XWiki - execution of payload in editor (CVE-2024-43401, CVSS 9.0), XWiki - XSS (CVE-2024-43400, CVSS 9.0), XWiki - introhttps://cyberfeed.cesnet.cz/reports/190?lang=enhttps://cyberfeed.cesnet.cz/reports/189?lang=enSolarWinds Web Help Desk fixes a critical remote code execution vulnerability. All WHD versions should be updated to version 12.8.3, after which a hotfix should be installed. WHD 12.8.3 Hotfix 1 should not be installed if SAML Single Sign-On is used; the new hotfix resolves this issue. Vulnerabilities: SolarWinds Web Help Desk - remote code execution (CVE-2024-28986, CVSS 9.8), SolarWinds Web Help Desk - introhttps://cyberfeed.cesnet.cz/reports/189?lang=enhttps://cyberfeed.cesnet.cz/reports/188?lang=enKubernetes fixes a vulnerability in ingress-nginx in version 1.11.2. The use of the ingress-nginx controller in your instance can be verified by running the command "kubectl get po -A" and searching for the string "ingress-nginx-controller". Compromise of the system can be verified by searching the Kubernetes audit logs for the creation of ingress objects with an annotation containing the '\r' (carriage return) character. Vulnerabilities: Kubernetes ingress-nginx - credentials leak (CVE-2024-7646, CVSS 8.8), Kubernetes ingress-nginx - introhttps://cyberfeed.cesnet.cz/reports/188?lang=enhttps://cyberfeed.cesnet.cz/reports/186?lang=enDovecot (an IMAP and POP3 server) fixes 2 vulnerabilities in version 2.3.21.1. Vulnerabilities: Dovecot - DoS (CVE-2024-23185, CVSS 7.5), Dovecot - DoS (CVE-2024-23184, CVSS 7.5), Dovecot - introhttps://cyberfeed.cesnet.cz/reports/186?lang=enhttps://cyberfeed.cesnet.cz/reports/185?lang=enWordPress Zephyr Project Manager plugin version 3.3.102 fixes a high-severity privilege escalation vulnerability. Vulnerabilities: Zephyr Project Manager - privilege escalation (CVE-2024-7624, CVSS 8.1), Zephyr Project Manager - introhttps://cyberfeed.cesnet.cz/reports/185?lang=enhttps://cyberfeed.cesnet.cz/reports/183?lang=enIvanti fixes 8 vulnerabilities in Neurons for ITSM, Virtual Traffic Manager and Avalanche. The vulnerabilities in Neurons for ITSM were fixed by a patch. Products and their fixed versions: Ivanti Neurons for ITSM - 2023.4 w/ patch, 2023.3 w/ patch, 2023.2 w/ patch Ivanti Virtual Traffic Manager - 22.2R1, 22.3R3, 22.3R3, 22.5R2, 22.6R2, 22.7R2 Ivanti Avalanche - 6.4.4 Vulnerabilities: Ivanti Neurons for ITSM - information leak (CVE-2024-7569, CVSS 9.6), Ivanti Neurons for ITSM - access token craft (CVE-2024-7570, CVSS 8.3), Ivanti Virtual Traffic Manager - authentication bypass (CVE-2024-7593, CVSS 9.8), Ivanti Avalanche - DoS (CVE-2024-38652, CVSS 8.2), Ivanti Avalanche - XXE (CVE-2024-38653, CVSS 8.2), Ivanti Avalanche - DoS (CVE-2024-36136, CVSS 7.5), Ivanti Avalanche - DoS (CVE-2024-37399, CVSS 7.5), Ivanti Avalanche - RCE (CVE-2024-37373, CVSS 7.2), Ivanti - introhttps://cyberfeed.cesnet.cz/reports/183?lang=enhttps://cyberfeed.cesnet.cz/reports/182?lang=enMicrosoft warns of a critical TCP/IP remote code execution vulnerability affecting all supported versions of Windows and Windows Server. Microsoft has released urgent security patches and recommends updating immediately: Windows 10 1507: KB5041782 Windows 10 1607: KB5041773 Windows 10 1809: KB5041578 Windows 10 21h2: KB5041580 Windows 10 22h2: KB5041580 Windows 11 21h2: KB5041592 Windows 11 22h2: KB5041585 Windows 11 23h2: KB5041585 Windows 11 24h2: KB5041571 Windows Server 2016 1607: KB5041773 Windows Server 2019 1809: KB5041578 Windows Server 2022 21h2: KB5041160 Windows Server 2022 22h2: KB5041160 Windows Server 2022 23h2: KB5041573 Furthermore, disabling IPv6 is recommended as a temporary workaround, although the company warns of possible problems with the functioning of Windows. Vulnerabilities: Microsoft Windows - remote code execution (CVE-2024-38063, CVSS 9.8), Microsoft Windows - introhttps://cyberfeed.cesnet.cz/reports/182?lang=enhttps://cyberfeed.cesnet.cz/reports/177?lang=enElastic Kibana versions 8.14.2 and 7.17.23 fix a critical vulnerability. If updating is not possible, the company recommends mitigating the impact by reviewing the security of user permissions; the Connector Actions and Machine Learning features can also be disabled if they are not required. Vulnerabilities: Elastic Kibana - arbitrary code execution (CVE-2024-37287, CVSS 9.1), Elastic Kibana - introhttps://cyberfeed.cesnet.cz/reports/177?lang=enhttps://cyberfeed.cesnet.cz/reports/175?lang=enMSI fixes 1 vulnerability affecting motherboards of the Z590, Z490, Z790, B760, B560, B660 and B460 series on the Intel 300, 400, 500, 600, 700 and AMD AM4, AM5 platforms. To fix it, the UEFI must be updated to the latest available version. A reasonable method of detecting compromise is not yet known. If a compromise has already occurred, it can be removed only by an update that does not require the UEFI function (e.g. using a hardware memory programmer). Vulnerabilities: MSI motherboards - RCE (CVE-2024-36877, CVSS 8.2), MSI motherboards - introhttps://cyberfeed.cesnet.cz/reports/175?lang=enhttps://cyberfeed.cesnet.cz/reports/174?lang=enZabbix fixes 7 vulnerabilities, 2 of them critical. Fixes can be found in the links next to the individual vulnerabilities. Vulnerabilities: Zabbix - remote code execution (CVE-2024-22116, CVSS 9.9), Zabbix - remote code execution (CVE-2024-36461, CVSS 9.1), Zabbix - password data leak (CVE-2024-36460, CVSS 8.1), Zabbix - denial of service (CVE-2024-36462, CVSS 7.5), Zabbix - incorrectly configured access control security levels (CVE-2024-22121, CVSS 6.1), Zabbix - information elicitation (CVE-2024-22114, CVSS 4.3), Zabbix - arbitrary file read, denial of service (CVE-2024-22123, CVSS 2.7), Zabbix - introhttps://cyberfeed.cesnet.cz/reports/174?lang=enhttps://cyberfeed.cesnet.cz/reports/173?lang=enPostgreSQL fixes 1 vulnerability and several bugs that were not assigned a CVE identifier in versions 16.4, 15.8, 14.13, 13.16 and 12.20. Details can be found at. Vulnerabilities: PostgreSQL - SQL privilege escalation (CVE-2024-7348, CVSS 8.8), PostgreSQL - introhttps://cyberfeed.cesnet.cz/reports/173?lang=enhttps://cyberfeed.cesnet.cz/reports/172?lang=enGitLab fixes 11 medium-severity vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) in versions 17.2.2, 17.1.4 and 17.0.6. The most severe vulnerabilities are listed below; the rest can be found at. Vulnerabilities: GitLab CE/EE - unathorized access (CVE-2024-3035, CVSS 6.8), GitLab CE/EE - unathorized access (CVE-2024-6356, CVSS 4.4), GitLab CE/EE - DoS (CVE-2024-5423, CVSS 6.5), GitLab CE/EE - DoS (CVE-2024-4210, CVSS 6.5), GitLab CE/EE - DoS (CVE-2024-2800, CVSS 6.5), GitLab CE/EE - repository impersonation (CVE-2024-3958, CVSS 5.3), GitLab CE/EE - information leak (CVE-2024-7586, CVSS 4.1), GitLab CE/EE - introhttps://cyberfeed.cesnet.cz/reports/172?lang=enhttps://cyberfeed.cesnet.cz/reports/171?lang=enJenkins fixes 2 vulnerabilities in version 2.471 of Jenkins weekly and in versions 2.452.4 and 2.462.1 of Jenkins LTS. Vulnerabilities: Jenkins - path traversal and RCE (CVE-2024-43044, CVSS 8.3), Jenkins - unauthorized access (CVE-2024-43045, CVSS 5.4), Jenkins - introhttps://cyberfeed.cesnet.cz/reports/171?lang=enhttps://cyberfeed.cesnet.cz/reports/170?lang=enCisco fixes 2 vulnerabilities in the Identity Services Engine product with versions 3.1P9, 3.2P7 and 3.3P3. Vulnerabilities: Cisco Identity Services Engine - XSS (CVE-2024-20443, CVSS 5.4), Cisco Identity Services Engine - XSS (CVE-2024-20479, CVSS 4.8), Cisco Identity Services Engine - introhttps://cyberfeed.cesnet.cz/reports/170?lang=enhttps://cyberfeed.cesnet.cz/reports/169?lang=enVulnerabilities: Mattermost Server - introhttps://cyberfeed.cesnet.cz/reports/169?lang=enhttps://cyberfeed.cesnet.cz/reports/168?lang=enIvanti fixes two vulnerabilities in Ivanti Endpoint Manager and Docs@Work. The vulnerability in Docs@Work is fixed in version 2.26.1, while the vulnerability in Ivanti Endpoint Manager is addressed by a Hot Patch. Vulnerabilities: Ivanti Endpoint Manager - arbitrary code execution (CVE-2024-37381, CVSS 8.4), Ivanti Docs@Work - sensitive information leak (CVE-2024-37403, CVSS 5.0), Ivanti - introhttps://cyberfeed.cesnet.cz/reports/168?lang=enhttps://cyberfeed.cesnet.cz/reports/167?lang=enSolarWinds Access Rights Manager version 2024.3 fixes a critical vulnerability. Vulnerabilities: SolarWinds Access Rights Manager - traversal and information disclosure (CVE-2024-23475, CVSS 9.6), SolarWinds ARM - introhttps://cyberfeed.cesnet.cz/reports/167?lang=enhttps://cyberfeed.cesnet.cz/reports/166?lang=enElastic fixes 1 vulnerability in the APM Server product with version 8.14.0. Vulnerabilities: APM Server - information leak (CVE-2024-37286, CVSS 5.7), APM Server - introhttps://cyberfeed.cesnet.cz/reports/166?lang=enhttps://cyberfeed.cesnet.cz/reports/165?lang=enCurl version 8.9.1 fixes a medium-severity vulnerability in curl and libcurl. Among operating systems, Debian, for example, has released a fix for the sid release in version 8.9.1-1. Gentoo has curl 8.9.1 available as testing. Vulnerabilities: Curl - out-of-bounds read (CVE-2024-7264, CVSS 4.8), Curl - introhttps://cyberfeed.cesnet.cz/reports/165?lang=enhttps://cyberfeed.cesnet.cz/reports/163?lang=enXWiki fixes 5 vulnerabilities, 3 of them critical. Fixes can be found in the links next to the individual vulnerabilities. Vulnerabilities: XWiki - (CVE-2024-38369, CVSS 9.9), XWiki - (CVE-2024-37901, CVSS 9.9), XWiki - (CVE-2024-41947, CVSS 9.0), XWiki - (CVE-2024-37900, CVSS 6.4), XWiki - (CVE-2024-37898, CVSS 4.3), XWiki - introhttps://cyberfeed.cesnet.cz/reports/163?lang=enhttps://cyberfeed.cesnet.cz/reports/162?lang=enIvanti Endpoint Manager Mobile versions 11.12.0.3, 12.0.0.3 and 12.1.0.1 fix 4 vulnerabilities, one of them critical. Vulnerabilities: Ivanti Endpoint Manager Mobile - command execution (CVE-2024-36130, CVSS 9.8), Ivanti Endpoint Manager Mobile - command execution (CVE-2024-36131, CVSS 8.8), Ivanti Endpoint Manager Mobile - authentication bypass (CVE-2024-36132, CVSS 8.2), Ivanti Endpoint Manager Mobile - sensitive information leak (CVE-2024-34788, CVSS 5.3), Ivanti Endpoint Manager Mobile - introhttps://cyberfeed.cesnet.cz/reports/162?lang=enhttps://cyberfeed.cesnet.cz/reports/160?lang=enLabVIEW version 2024 Q3 fixes 3 high-severity vulnerabilities. Vulnerabilities: LabVIEW - (CVE-2024-4079, CVSS 7.8), LabVIEW - (CVE-2024-4080, CVE-2024-4081, CVSS 7.8), LabVIEW - introhttps://cyberfeed.cesnet.cz/reports/160?lang=enhttps://cyberfeed.cesnet.cz/reports/159?lang=enAruba fixes 7 vulnerabilities in the HPE Aruba Networking EdgeConnect SD-WAN Gateways product, which uses ECOS software, with versions 9.5.0.0, 9.4.2.0 and 9.3.4.0. As a temporary fix for these vulnerabilities, the command line and the web interface intended for management can be restricted to a dedicated layer 2 segment and/or access can be controlled by a firewall at layer 3 or higher. It is also recommended that network traffic related to RADIUS and TACACS management be routed through secure SD-WAN tunnels. Vulnerabilities: Aruba EdgeConnect SD-WAN - command execution (CVE-2024-33519, CVSS 7.2), Aruba EdgeConnect SD-WAN - command execution (CVE-2024-41133 - CVE-2024-41135, CVSS 7.2), Aruba EdgeConnect SD-WAN - command execution (CVE-2024-41136, CVSS 6.8), Aruba EdgeConnect SD-WAN - command execution (CVE-2023-51385, CVSS 6.5), Aruba EdgeConnect SD-WAN - Terrapin attack (CVE-2023-48795, CVSS 5.9), Aruba EdgeConnect SD-WAN - introhttps://cyberfeed.cesnet.cz/reports/159?lang=enhttps://cyberfeed.cesnet.cz/reports/158?lang=enAcronis fixes 1 critical vulnerability in the Acronis Cyber Infrastructure product with versions 5.0.1-61, 5.1.1-71, 5.2.1-69, 5.3.1-53 and 5.4.4-132. Vulnerabilities: Acronis Cyber Infrastructure - command execution (CVE-2023-45249, CVSS 9.8), Acronis Cyber Infrastructure - introhttps://cyberfeed.cesnet.cz/reports/158?lang=enhttps://cyberfeed.cesnet.cz/reports/157?lang=enDocker Engine version v27.1.1 fixes a critical vulnerability. If updating is not possible, the company recommends avoiding the use of AuthZ plugins and restricting access to the Docker API to trusted parties in line with the principle of least privilege. Vulnerabilities: Docker Engine - (CVE-2024-41110, CVSS 9.9), Docker Engine - introhttps://cyberfeed.cesnet.cz/reports/157?lang=enhttps://cyberfeed.cesnet.cz/reports/156?lang=enCurl fixes 2 vulnerabilities in the curl and libcurl products with version 8.9.0. Among operating systems, only Debian has so far released a fix, for the sid release in version 8.9.0-1; the other Debian releases and all Ubuntu releases are not affected by the vulnerabilities. Vulnerabilities: Curl - memory over-write (CVE-2024-6197, CVSS 7.5), Curl - memory over-read (CVE-2024-6874, CVSS 4.3), Curl - introhttps://cyberfeed.cesnet.cz/reports/156?lang=enhttps://cyberfeed.cesnet.cz/reports/155?lang=enVMware version 2.11.4 fixes a critical vulnerability in the Skipper server component of Spring Cloud Data Flow. Vulnerabilities: Spring Cloud Data Flow - RCE (CVE-2024-37084, CVSS 9.8), VMware Spring Cloud Data Flow - introhttps://cyberfeed.cesnet.cz/reports/155?lang=enhttps://cyberfeed.cesnet.cz/reports/154?lang=enGitLab fixes 6 vulnerabilities in the GitLab Community Edition (CE) and Enterprise Edition (EE) products with versions 17.2.1, 17.1.3 and 17.0.5. Vulnerabilities: GitLab CE/EE - XSS (CVSS 7.7), GitLab CE/EE - settings leak (CVE-2024-5067, CVSS 4.4), GitLab CE/EE - job artifacts leak (CVE-2024-7057, CVSS 4.3), GitLab CE/EE - information leak (CVSS 4.1), GitLab CE/EE - commits misdirect (CVE-2024-0231, CVSS 2.7), GitLab CE/EE - information leak (CVSS 2.6), GitLab CE/EE - introhttps://cyberfeed.cesnet.cz/reports/154?lang=enhttps://cyberfeed.cesnet.cz/reports/152?lang=enGNU fixes 5 vulnerabilities in the glibc product with version 2.40, 4 of which specifically affect nscd (Name Service Cache Daemon). OS releases and their fixed versions: Debian: bullseye - 2.31-13+deb11u10 bookworm - 2.36-9+deb12u7 buster - 2.28-10+deb10u4 Ubuntu: bionic - 2.27-3ubuntu1.6+esm2 focal - 2.31-0ubuntu9.15 jammy - 2.35-0ubuntu3.7 mantic - 2.38-1ubuntu6.2 noble - 2.39-0ubuntu8.1 Gentoo: all architectures - 2.38-r13 Redhat: more information at Slackware: more information at Vulnerabilities: glibc - buffer overflow (CVE-2024-2961, CVSS 7.3), glibc - buffer overflow (CVE-2024-33599, CVSS 8.1), glibc - DoS (CVE-2024-33600, CVSS 5.9), glibc - DoS (CVE-2024-33601, CVSS 7.5), glibc - memory corruption (CVE-2024-33602, CVSS 8.6), glibc - introhttps://cyberfeed.cesnet.cz/reports/152?lang=enhttps://cyberfeed.cesnet.cz/reports/151?lang=enApache fixes 2 vulnerabilities in the Apache HTTP Server product with version 2.4.62. Vulnerabilities: Apache HTTP Server - source code leak (CVE-2024-40725, CVSS 5.3), Apache HTTP Server - SSRF (CVE-2024-40898, CVSS 7.5), Apache HTTP Server - introhttps://cyberfeed.cesnet.cz/reports/151?lang=enhttps://cyberfeed.cesnet.cz/reports/150?lang=enExim version 4.97.1 fixes a medium-severity vulnerability. Debian has fixed this vulnerability for bullseye in version 4.94.2-7+deb11u3 and for bookworm in version 4.96-15+deb12u5. Vulnerabilities: Exim - (CVE-2024-39929, CVSS 5.4), Exim - introhttps://cyberfeed.cesnet.cz/reports/150?lang=enhttps://cyberfeed.cesnet.cz/reports/148?lang=enJuniper versions 20.4R3-S7-EVO, 21.2R3-S8-EVO, 21.4R3-S7-EVO, 22.2R3-EVO, 22.3R2-EVO, 22.4R2-EVO, 23.2R1-EVO and later fix 5 high-severity vulnerabilities in Junos OS Evolved. Vulnerabilities: Juniper Junos OS Evolved - intro, Junos OS EVO - privilege escalation (CVE-2024-39520-CVE-2024-39524, CVSS 7.8)https://cyberfeed.cesnet.cz/reports/148?lang=enhttps://cyberfeed.cesnet.cz/reports/147?lang=enGitLab versions 17.1.2, 17.0.4 and 16.11.6 fix 6 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE). Vulnerabilities: GitLab Community Edition and Enterprise Edition - intro, GitLab - (CVE-2024-6385, CVSS 9.6), GitLab - (CVE-2024-5257, CVSS 4.9), GitLab - (CVE-2024-5470, CVSS 3.8), GitLab - (CVE-2024-6595, CVSS 3.0), GitLab - (CVE-2024-2880, CVSS 2.7), GitLab - (CVE-2024-5528, CVSS 3.5)https://cyberfeed.cesnet.cz/reports/147?lang=enhttps://cyberfeed.cesnet.cz/reports/146?lang=enVMware fixes 3 vulnerabilities in its products. Products and their fixes: VMware Aria Automation - 8.17.0 VMware Cloud Director - 4.7.2 Spring Cloud Function - 4.0.8, 4.1.2 Vulnerabilities: VMware Aria - SQL injection (CVE-2024-22280, CVSS 8.5), VMware Cloud Director - HTML injection (CVE-2024-22277, CVSS 6.4), VMware Spring - DoS (CVE-2024-22271, CVSS 8.2), VMware - introhttps://cyberfeed.cesnet.cz/reports/146?lang=enhttps://cyberfeed.cesnet.cz/reports/145?lang=enCisco has released firmware updates for Nexus switches that fix a vulnerability allowing command injection into the underlying NX-OS. Vulnerabilities: Cisco NX-OS - command injection (CVE-2024-20399, CVSS 6.0)https://cyberfeed.cesnet.cz/reports/145?lang=enhttps://cyberfeed.cesnet.cz/reports/144?lang=enApache fixes 2 critical vulnerabilities in the Apache CloudStack product with versions 4.18.2.1 and 4.19.0.2. As a temporary fix, access to the server can be restricted to only the ports necessary for proper operation, and the cluster service port (9090 in the default configuration) can be restricted to access from trusted networks or IP addresses only. Vulnerabilities: Apache CloudStack - RCE (CVE-2024-38346, CVSS 9.8), Apache CloudStack - RCE (CVE-2024-39864, CVSS 9.8), Apache CloudStack - introhttps://cyberfeed.cesnet.cz/reports/144?lang=enhttps://cyberfeed.cesnet.cz/reports/143?lang=enGeoServer and GeoTools fix 2 vulnerabilities. The fix is available in versions 2.23.6, 2.24.4 and 2.25.2 for GeoServer and in versions 31.2, 30.4 and 29.6 for GeoTools. Vulnerabilities: GeoServer - RCE (CVE-2024-36401, CVSS 9.8), GeoTools - RCE (CVE-2024-36404, CVSS 9.8), GeoServer - introhttps://cyberfeed.cesnet.cz/reports/143?lang=enhttps://cyberfeed.cesnet.cz/reports/142?lang=enMastodon versions 4.1.18 and 4.2.10 fix a high-severity vulnerability. Vulnerabilities: Mastodon - intro, Mastodon - Missing authorization (CVE-2024-37903, CVSS 8.2)https://cyberfeed.cesnet.cz/reports/142?lang=enhttps://cyberfeed.cesnet.cz/reports/141?lang=enApache fixes a regression of a vulnerability that affects only version 2.4.60. The fix is available in version 2.4.61. Debian released a fix in packages 2.4.61-1~deb11u1 and 2.4.61-1~deb12u1, Slackware within httpd-2.4.60-x86_64-2_slack15.0.txz (backport). Vulnerabilities: Apache HTTP Server - source code leak (CVE-2024-39884, CVSS 6.2), Apache HTTP Server - introhttps://cyberfeed.cesnet.cz/reports/141?lang=enhttps://cyberfeed.cesnet.cz/reports/140?lang=enMIT fixes 2 vulnerabilities in the Kerberos 5 product with version 1.21.3. Vulnerabilities: MIT Kerberos 5 - incorrect memory size (CVE-2024-37370, CVSS 7.5), MIT Kerberos 5 - out-of-bounds write (CVE-2024-37371, CVSS 9.1), MIT Kerberos 5 - introhttps://cyberfeed.cesnet.cz/reports/140?lang=enhttps://cyberfeed.cesnet.cz/reports/139?lang=enElastic fixes a vulnerability in the Elastic Cloud Enterprise product with version 3.7.2. Vulnerabilities: Elastic Cloud Enterprise - privileges escalation (CVE-2024-37282, CVSS 8.1), Elastic Cloud Enterprise - introhttps://cyberfeed.cesnet.cz/reports/139?lang=enhttps://cyberfeed.cesnet.cz/reports/138?lang=enJuniper fixes 1 vulnerability in the Junos OS product running on SRX Series devices with versions 21.4R3-S7.9, 22.1R3-S5.3, 22.2R3-S4.11, 22.3R3, 22.4R3 and 23.2R1. Vulnerabilities: Juniper Junos OS - DoS (CVE-2024-21586, CVSS 7.5), Juniper Junos OS - introhttps://cyberfeed.cesnet.cz/reports/138?lang=enhttps://cyberfeed.cesnet.cz/reports/137?lang=enApache fixes 8 vulnerabilities in the Apache HTTP Server product with version 2.4.60. The most severe vulnerabilities are described below. Vulnerabilities: Apache HTTP Server - SSRF (CVE-2024-38472, CVSS 7.5), Apache HTTP Server - RCE (CVE-2024-38474, CVSS 9.8), Apache HTTP Server - RCE (CVE-2024-38475, CVSS 9.1), Apache HTTP Server - RCE (CVE-2024-38476, CVSS 9.8), Apache HTTP Server - DoS (CVE-2024-38477, CVSS 7.5), Apache HTTP Server - introhttps://cyberfeed.cesnet.cz/reports/137?lang=enhttps://cyberfeed.cesnet.cz/reports/136?lang=enOpenSSH fixes two vulnerabilities with version 9.8. The vulnerability CVE-2024-6387 was introduced into the product in version 8.5p1 and the vulnerability CVE-2024-39894 in version 9.5. Among operating systems, the first-mentioned vulnerability has so far been fixed by Debian, Ubuntu, Slackware. Red Hat (affects only Red Hat Enterprise Linux 9), Gentoo has released a testing version 9.8_p1-r2 and OpenBSD is not vulnerable at all. The second-mentioned vulnerability does not affect the most popular stable releases of operating systems. Operating system releases and fixed OpenSSH versions: Debian: bookworm (security) - 1:9.2p1-2+deb12u3 Ubuntu: jammy - 1:8.9p1-3ubuntu0.10 mantic - 1:9.3p1-1ubuntu3.6 noble - 1:9.6p1-3ubuntu13.3 Slackware: openssh-9.8p1-i586-1_slack15.0 openssh-9.8p1-x86_64-1_slack15.0 openssh-9.8p1-i586-1 openssh-9.8p1-x86_64-1 Vulnerabilities: OpenSSH - RCE (CVE-2024-6387, CVSS 8.1), OpenSSH - intro, OpenSSH - timing attack (CVE-2024-39894, CVSS 7.5)https://cyberfeed.cesnet.cz/reports/136?lang=enhttps://cyberfeed.cesnet.cz/reports/135?lang=enGhostscript version 10.03.1 fixes multiple vulnerabilities. Vulnerabilities: Ghostsript - intro, Ghostsript - RCE (CVE-2024-33871, CVSS 8.8), Ghostsript - arbitrary file acces (CVE-2024-33870, CVSS 6.8), Ghostsript - (CVE-2024-29510, CVSS 5.5), Ghostsript - (CVE-2024-33869, CVSS 5.3), Ghostsript - (CVE-2023-52722, CVSS 5.3)https://cyberfeed.cesnet.cz/reports/135?lang=enhttps://cyberfeed.cesnet.cz/reports/134?lang=enJenkins warns of the fix of 2 vulnerabilities in the Jenkins plugins Structs and Plain Credentials. The fix for the Structs plugin is in version 338.v848422169819 and for Plain Credentials in version 183.va_de8f1dd5a_2b_. Vulnerabilities: Jenkins - information disclosure (CVE-2024-39458, CVSS 3.1), Jenkins - information disclosure (CVE-2024-39460, CVSS 4.3), Jenkins - introhttps://cyberfeed.cesnet.cz/reports/134?lang=enhttps://cyberfeed.cesnet.cz/reports/133?lang=enJuniper fixes a critical vulnerability in the Session Smart Router and Session Smart Conductor products with versions 5.6.15, 6.1.9-lts and 6.2.5-sts, and in the WAN Assurance Router product with versions 6.1.9-lts and 6.2.5. If the devices are part of a Conductor-managed environment, it is sufficient to update the Conductor devices and the fix will also be applied to the connected routers; nevertheless, it is good practice to update all affected devices. All WAN Assurance routers connected to the Mist Cloud were fixed automatically. Vulnerabilities: Juniper - authentication bypass (CVE-2024-2973, CVSS 10.0), Juniper - introhttps://cyberfeed.cesnet.cz/reports/133?lang=enhttps://cyberfeed.cesnet.cz/reports/132?lang=enGitLab versions 17.1.1, 17.0.3 and 16.11.5 fix 14 vulnerabilities, including 1 critical and 3 high-severity ones, in GitLab Community Edition (CE) and Enterprise Edition (EE). The most severe vulnerabilities are described below; others can be found at. Vulnerabilities: GitLab Community Edition and Enterprise Edition - intro, GitLab - (CVE-2024-5655, CVSS 9.6), GitLab - XSS (CVE-2024-4901, CVSS 8.7), GitLab - CSRF (CVE-2024-4994, CVSS 8.1), GitLab - (CVE-2024-6323, CVSS 7.5)https://cyberfeed.cesnet.cz/reports/132?lang=enhttps://cyberfeed.cesnet.cz/reports/131?lang=enMoodle fixes 4 vulnerabilities with versions 4.4.1, 4.3.5, 4.2.8 and 4.1.11. Vulnerabilities: Moodle - XSS (CVE-2024-38274, CVSS 6.1), Moodle - HTTP header leak (CVE-2024-38275, CVSS 7.5), Moodle - CSRF (CVE-2024-38276, CVSS 8.8), Moodle - unauthorized access (CVE-2024-38273, CVSS 5.4), Moodle - introhttps://cyberfeed.cesnet.cz/reports/131?lang=enhttps://cyberfeed.cesnet.cz/reports/130?lang=enElastic Kibana versions 7.17.22 and 8.14.0 fix a medium-severity vulnerability. Vulnerabilities: Elastic Kibana - intro, Elastic Kibana - (CVE-2024-23443, CVSS 4.9)https://cyberfeed.cesnet.cz/reports/130?lang=enhttps://cyberfeed.cesnet.cz/reports/129?lang=enGoogle is fixing 4 vulnerabilities in Google Chrome (originally in the V8 and Dawn components), which also affect Chromium-based web browsers such as Opera or Microsoft Edge, of which only Microsoft has fixed the vulnerabilities so far. Chrome fixed the vulnerabilities in versions 126.0.6478.114/115 for Windows and Mac and in version 126.0.6478.114 for Linux. Vulnerabilities: Google Chrome - RCE (CVE-2024-6100, CVSS 8.8), Google Chrome - out-of-bound memory access (CVE-2024-6101, CVSS 8.8), Google Chrome - heap corruption (CVE-2024-6102, CVSS 8.8), Google Chrome - heap corruption (CVE-2024-6103, CVSS 8.8), Google Chrome - introhttps://cyberfeed.cesnet.cz/reports/129?lang=enhttps://cyberfeed.cesnet.cz/reports/128?lang=enWordPress HTML5 Video Player plugin version 2.5.27 fixes an SQL injection vulnerability. Vulnerabilities: WordPress - intro, WordPress HTML5 Video Player plugin - SQL injection (CVE-2024-5522, CVSS 6.5)https://cyberfeed.cesnet.cz/reports/128?lang=enhttps://cyberfeed.cesnet.cz/reports/127?lang=enEmacs and Org Mode are fixing 1 critical vulnerability. Emacs fixes the vulnerability in version 29.4 and Org Mode in version 9.7.5. A patch is available at and is applicable to the Org Mode Git repository. The vulnerability in Emacs has so far been fixed only by Slackware. Vulnerabilities: Emacs Org mode - shell command execution, Emacs Org mode - introhttps://cyberfeed.cesnet.cz/reports/127?lang=enhttps://cyberfeed.cesnet.cz/reports/126?lang=enSolarWinds Serv-U version 15.4.2 HF 2 fixes a high-severity vulnerability. A PoC has been published for the vulnerability. Vulnerabilities: SolarWinds Serv-U - intro, SolarWinds Serv-U - Directory Traversal (CVE-2024-28995, CVSS 8.6)https://cyberfeed.cesnet.cz/reports/126?lang=enhttps://cyberfeed.cesnet.cz/reports/124?lang=enGitHub is fixing vulnerability CVE-2024-5746 in GitHub Enterprise Server in versions 3.12.5, 3.11.11, 3.10.13 and 3.9.16. Vulnerabilities: GitHub Enterprise Server - RCE (CVE-2024-5746, CVSS 7.6), GitHub Enterprise Server - introhttps://cyberfeed.cesnet.cz/reports/124?lang=enhttps://cyberfeed.cesnet.cz/reports/123?lang=enXWiki versions 16.0.0, 15.5.5, 15.10.6 and 14.10.2 fix a critical vulnerability. Vulnerabilities: XWiki - intro, XWiki - RCE (CVE-2024-37899, CVSS 9.0)https://cyberfeed.cesnet.cz/reports/123?lang=enhttps://cyberfeed.cesnet.cz/reports/122?lang=enVMware vCenter Server versions 7.0 U3r, 8.0 U1e and 8.0 U2d fix 3 vulnerabilities. For VMware Cloud Foundation, follow KB88287. Vulnerabilities: VMware - intro, VMware - RCE (CVE-2024-37079, CVE-2024-37080, CVSS 9.8), VMware - privilege escalation (CVE-2024-37081, CVSS 7.8)https://cyberfeed.cesnet.cz/reports/122?lang=enhttps://cyberfeed.cesnet.cz/reports/120?lang=enAs part of its Patch Tuesday, Microsoft released patches for 51 vulnerabilities. Among them is one critical remote code execution (RCE) vulnerability. Seven browser vulnerabilities were published separately this month and are not included in the total. An overview of all vulnerabilities can be found in the SANS table. Vulnerabilities: Patch Tuesday - intro, MSMQ - RCE (CVE-2024-30080, CVSS 9.8), Outlook - RCE (CVE-2024-30103, CVSS 8.8), Azure - DoS (CVE-2024-35254, CVSS 7.1), Windows OLE - RCE (CVE-2024-30077, CVSS 8.0), Windows kernel - privilege escalation (CVE-2024-30068, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/120?lang=enhttps://cyberfeed.cesnet.cz/reports/119?lang=enGitLab is fixing 5 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) in versions 17.0.2, 16.11.4 and 16.10.7. Vulnerabilities: GitLab - ReDoS (CVE-2024-1495, CVSS 6.5), GitLab - ReDoS (CVE-2024-1736, CVSS 6.5), GitLab - ReDoS (CVE-2024-1963, CVSS 6.5), GitLab - XSS (CVE-2024-4201, CVSS 4.4), GitLab - DoS (CVE-2024-5469, CVSS 3.1), GitLab - introhttps://cyberfeed.cesnet.cz/reports/119?lang=enhttps://cyberfeed.cesnet.cz/reports/118?lang=enJupyter is fixing a vulnerability in Jupyter server in version 2.14.1. Vulnerabilities: Jupyter server - password hash leak (CVE-2024-35178 , CVSS 7.5), Jupyter server - introhttps://cyberfeed.cesnet.cz/reports/118?lang=enhttps://cyberfeed.cesnet.cz/reports/117?lang=enOTRS AG is fixing a vulnerability in OTRS in versions 2024.4.3 and 7.0.50. The vulnerability also affects ((OTRS)) Community Edition, which is now developed by a new company, and information about a fix is not yet known. Vulnerabilities: OTRS - path traversal (CVE-2024-23793, CVSS 6.3), OTRS - introhttps://cyberfeed.cesnet.cz/reports/117?lang=enhttps://cyberfeed.cesnet.cz/reports/116?lang=enVeeam is fixing 5 vulnerabilities in Veeam Backup & Replication (specifically Veeam Backup Enterprise Manager (VBEM)) and Veeam Agent for Windows (VAW). The vulnerabilities are fixed in Veeam Backup & Replication in version 12.1.2 (build 12.1.2.172) and in Veeam Agent for Windows in version 6.1.2 (build 6.1.2.134). Vulnerabilities: VBEM - authentication bypass (CVE-2024-29849, CVSS 9.8), VBEM - account takeover (CVE-2024-29850, CVSS 8.8), VBEM - NTLM hash leak (CVE-2024-29851, CVSS 7.2), VBEM - information leak (CVE-2024-29852, CVSS 2.7), VAW - privilege escalation (CVE-2024-29853, CVSS 7.8), Veeam - introhttps://cyberfeed.cesnet.cz/reports/116?lang=enhttps://cyberfeed.cesnet.cz/reports/115?lang=enPexip is fixing a vulnerability in Pexip Infinity in version 34.1. Vulnerabilities: Pexip Infinity - incomplete access control (CVE-2024-33850, CVSS 7.6), Pexip Infinity - introhttps://cyberfeed.cesnet.cz/reports/115?lang=enhttps://cyberfeed.cesnet.cz/reports/114?lang=enGNOME is fixing a vulnerability in version 0.76.3 of GNOME VTE, which is used mainly by GNOME Terminal. Vulnerabilities: GNOME VTE - DoS (CVE-2024-37535, CVSS 4.4), GNOME VTE - introhttps://cyberfeed.cesnet.cz/reports/114?lang=enhttps://cyberfeed.cesnet.cz/reports/113?lang=enElastic is fixing 3 vulnerabilities in Elasticsearch and Kibana in version 8.14.0. Vulnerabilities: Elasticsearch - data leak (CVE-2024-23445, CVSS 6.5), Elasticsearch - DoS (CVE-2024-37280, CVSS 4.9), Kibana - DoS (CVE-2024-37279, CVSS 4.3), Elastic - introhttps://cyberfeed.cesnet.cz/reports/113?lang=enhttps://cyberfeed.cesnet.cz/reports/112?lang=enPHP is fixing 3 critical vulnerabilities in versions 8.3.8, 8.2.20 and 8.1.29; among operating systems, only Slackware has fixed them so far. Vulnerabilities: PHP - (CVE-2024-4577, CVSS 9.8), PHP - (CVE-2024-5585, CVSS 8.8), PHP - (CVE-2024-5458, CVSS 5.3), PHP - introhttps://cyberfeed.cesnet.cz/reports/112?lang=enhttps://cyberfeed.cesnet.cz/reports/111?lang=enRoundcube is fixing 3 vulnerabilities in Webmail in versions 1.5.7 and 1.6.7. The vulnerabilities are tracked only by Debian, and only those concerning XSS attacks, which it fixes for the trixie and sid releases in version 1.6.7+dfsg-1. Ubuntu does not yet track the vulnerabilities. Vulnerabilities: Roundcube Webmail - XSS (CVE-2024-37384, CVSS 6.1), Roundcube Webmail - command injection (CVE-2024-37385, CVSS 9.8), Roundcube Webmail - introhttps://cyberfeed.cesnet.cz/reports/111?lang=enhttps://cyberfeed.cesnet.cz/reports/110?lang=enCisco is fixing 2 vulnerabilities in Cisco Finesse in version 12.6(2) ES03. The vulnerabilities also affect products directly associated with Cisco Finesse (Packaged Contact Center Enterprise, Unified Contact Center Enterprise, Unified Contact Center Express and Unified Intelligence Center). Vulnerabilities: Cisco Finesse - SSRF (CVE-2024-20404, CVSS 7.2), Cisco Finesse - XSS (CVE-2024-20405, CVSS 4.8), Cisco Finesse - introhttps://cyberfeed.cesnet.cz/reports/110?lang=enhttps://cyberfeed.cesnet.cz/reports/109?lang=enZyxel is fixing 5 vulnerabilities in NAS326 and NAS542. The vulnerabilities are fixed in version V5.21(AAZF.17)C0 for NAS326 and version V5.21(ABAG.14)C0 for NAS542. Vulnerabilities: Zyxel NAS326, NAS542 - command injection (CVSS 9.8), Zyxel NAS326, NAS542 - code execution (CVE-2024-29974, CVSS 9.8), Zyxel NAS326, NAS542 - command execution (CVE-2024-29975, CVSS 6.7), Zyxel NAS326, NAS542 - code execution (CVE-2024-29976, CVSS 6.5), Zyxel - introhttps://cyberfeed.cesnet.cz/reports/109?lang=enhttps://cyberfeed.cesnet.cz/reports/108?lang=enFortinet is fixing 9 vulnerabilities in various products. Products and their fixed versions: FortiWebManager - 7.2.1, 7.0.5, 6.3.1, 6.2.5 FortiAuthenticator - 6.6.1, 6.5.4 FortiWeb - 7.4.3, 7.2.8 FortiPortal - 6.0.15 FortiSOAR - 7.3.1 Vulnerabilities: FortiWebManager - unauthorized actions (CVSS 8.8), FortiAuthenticator - redirect to arbitrary website (CVE-2024-23664, CVSS 6.1), FortiWeb - unauthorized ADOM operations (CVE-2024-23665, CVSS 5.9), FortiPortal - information leak (CVE-2023-48789, CVSS 4.3), FortiSOAR - passwords leak (CVE-2024-31493, CVSS 6.5), FortiWeb - password leak (CVE-2024-23107, CVSS 5.5), Fortinet - introhttps://cyberfeed.cesnet.cz/reports/108?lang=enhttps://cyberfeed.cesnet.cz/reports/107?lang=ena high-severity vulnerability was discovered in a GitHub library. The vulnerability was fixed in versions 5.30.1 and 5.29.3. A fix was also released for Apptainer in version 1.3.2. Vulnerabilities: github/containers/image library - intro, github/containers/image library - (CVE-2024-3727, CVSS 8.3)https://cyberfeed.cesnet.cz/reports/107?lang=enhttps://cyberfeed.cesnet.cz/reports/106?lang=enCheck Point has released a hotfix for a critical and already actively exploited vulnerability. The company recommends updating immediately. Affected products and their fixes: Quantum Security Gateway and CloudGuard Network Security: R81.20, R81.10, R81, R80.40 Quantum Maestro and Quantum Scalable Chassis: R81.20, R81.10, R80.40, R80.30SP, R80.20SP Quantum Spark Gateways: R81.10.x, R80.20.x, R77.20.x Vulnerabilities: Check Point - intro, Check Point - information disclosure (CVE-2024-24919, CVSS 8.6)https://cyberfeed.cesnet.cz/reports/106?lang=enhttps://cyberfeed.cesnet.cz/reports/105?lang=enF5 is fixing 4 vulnerabilities in NGINX. The vulnerability was fixed in versions 1.27.0 and 1.26.1 for NGINX Open Source and in versions R32 and R31P2 for NGINX Plus. Vulnerabilities: F5 NGINX - memory leak (CVE-2024-34161, CVSS 5.3), F5 NGINX - DoS (CVE-2024-32760, CVSS 6.5), F5 NGINX - DoS (CVE-2024-35200, CVSS 5.3), F5 NGINX - intro, F5 NGINX - DoS (CVE-2024-31079, CVSS 4.8)https://cyberfeed.cesnet.cz/reports/105?lang=enhttps://cyberfeed.cesnet.cz/reports/104?lang=enSonatype is fixing vulnerability CVE-2024-4956 in Nexus Repository 3 in version 3.68.1. Vulnerabilities: Sonatype Nexus Repository - Path traversal (CVE-2024-4956, CVSS 7.5), Sonatype Nexus Repository - introhttps://cyberfeed.cesnet.cz/reports/104?lang=enhttps://cyberfeed.cesnet.cz/reports/103?lang=enGitHub Enterprise Server fixes a critical vulnerability allowing authentication bypass. The fix was released in versions 3.9.15, 3.10.12, 3.11.10 and 3.12.4. Vulnerabilities: GitHub Enterprise Server - intro, GitHub Enterprise Server - (CVE-2024-4985, CVSS 10.0)https://cyberfeed.cesnet.cz/reports/103?lang=enhttps://cyberfeed.cesnet.cz/reports/102?lang=enNozomi Networks reports 11 vulnerabilities found in GE HealthCare products, namely in Common Service Desktop and EchoPAC Software Only. Common Service Desktop is an administrative web application preinstalled on several GE HealthCare devices, including ultrasound devices. EchoPAC Software Only is software used to display and analyze outputs from GE HealthCare devices. GE HealthCare does not plan to release fixes for these vulnerabilities, so it is strongly recommended to restrict network access to individual vulnerable instances to trusted IP addresses only and also to restrict physical access to trusted persons only. Successful exploitation of the vulnerabilities could lead to theft or corruption of patient data, or to the unavailability of healthcare systems. Most serious vulnerabilities: Vulnerabilities: GE HealthCare EchoPAC - hardcoded credentials (CVE-2024-27107, CVSS 9.6), GE HealthCare EchoPAC - unnecessary privileges (CVE-2024-27109, CVSS 7.6), GE HealthCare Common Service Desktop - command injection (CVE-2024-1628, CVSS 8.4), GE HealthCare Common Service Desktop - path traversal (CVE-2024-1630, CVSS 7.7), GE HealthCare - introhttps://cyberfeed.cesnet.cz/reports/102?lang=enhttps://cyberfeed.cesnet.cz/reports/101?lang=enSolarWinds Access Rights Manager 2023.2.4 fixes 2 vulnerabilities. Vulnerabilities: SolarWinds Access Rights Manager - intro, SolarWinds ARM - RCE (CVE-2024-28075, CVSS 9.0), SolarWinds ARM - Authentication Bypass (CVE-2024-23473, CVSS 8.6)https://cyberfeed.cesnet.cz/reports/101?lang=enhttps://cyberfeed.cesnet.cz/reports/100?lang=enCisco Multiplatform Firmware version 12.0.4SR1 and PhoneOS version 2.3.1.0101 fix high-severity vulnerabilities affecting IP Phone 6800, 7800, 8800 and Video Phone 8875 products. Vulnerabilities: Cisco IP Phone 6800, 7800, 8800 - intro, Cisco IP Phone 6800, 7800, 8800 - DoS (CVE-2024-20376, CVSS 7.5), Cisco IP Phone 6800, 7800, 8800 - Information disclosure (CVE-2024-20378, CVSS 7.5), Cisco IP Phone 6800, 7800, 8800 - Unauthorized Access (CVE-2024-20357, CVSS 5.3)https://cyberfeed.cesnet.cz/reports/100?lang=enhttps://cyberfeed.cesnet.cz/reports/99?lang=enAruba is fixing 10 vulnerabilities in ArubaOS, which affect the products Mobility Conductor, Mobility Controllers, WLAN Gateways and SD-WAN Gateways. The fix is available in versions 10.6.0.0, 10.5.1.1, 10.4.1.1, 8.11.2.2 and 8.10.0.11. Vulnerabilities: ArubaOS - buffer overflow (CVSS 9.8), ArubaOS - DoS (CVSS 5.9), ArubaOS -DoS (CVSS 5.3), ArubaOS - introhttps://cyberfeed.cesnet.cz/reports/99?lang=enhttps://cyberfeed.cesnet.cz/reports/98?lang=enCrushFTP is fixing critical vulnerability CVE-2024-4040 in versions 10.7.1 and 11.1.0. Vulnerabilities: CrushFTP - improper input validation (CVE-2024-4040, CVSS 9.8), CrushFTP - introhttps://cyberfeed.cesnet.cz/reports/98?lang=enhttps://cyberfeed.cesnet.cz/reports/97?lang=enAiohttp version 3.9.4 fixes a high-severity denial-of-service vulnerability. Version 3.9.5 has already been released as well. Vulnerabilities: Aiohttp - intro, Aiohttp - DoS (CVE-2024-30251, CVSS 7.5)https://cyberfeed.cesnet.cz/reports/97?lang=enhttps://cyberfeed.cesnet.cz/reports/96?lang=enGitLab Community Edition (CE) and Enterprise Edition (EE) versions 16.11.1, 16.10.4 and 16.9.6 fix 5 vulnerabilities. Vulnerabilities: GitLab Community Edition and Enterprise Edition - intro, GitLab - improper authentication (CVE-2024-4024, CVSS 7.3), GitLab - DoS (CVE-2024-2434, CVSS 8.5), GitLab - ReDoS (CVE-2024-2829, CVSS 7.5), GitLab (CVE-2024-4006, CVSS 4.3), GitLab (CVE-2024-1347, CVSS 4.3)https://cyberfeed.cesnet.cz/reports/96?lang=enhttps://cyberfeed.cesnet.cz/reports/95?lang=enCisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Software fix 3 vulnerabilities. Fixed versions can be obtained at, where on the first page you need to enter the product type and version. On the next page, select all impact assessments and all security advisories. On the last page, select the highest of the displayed fixed versions and update the affected device to it. Vulnerabilities: Cisco ASA and Firepower - intro, Cisco ASA and Firepower - DoS (CVE-2024-20353, CVSS 8.6), Cisco ASA and Firepower - local code execution (CVE-2024-20359, CVSS 6.0), Cisco ASA and Firepower - local command execution (CVE-2024-20358, CVSS 6.0)https://cyberfeed.cesnet.cz/reports/95?lang=enhttps://cyberfeed.cesnet.cz/reports/94?lang=enQNAP is fixing 2 critical and 1 high-severity vulnerability in QNAP OS (QTS, QuTS hero, QuTScloud) and myQNAPcloud. The fixed versions listed below also fix vulnerabilities CVE-2024-21899, CVE-2024-21900 and CVE-2024-21901, about which we have already informed you. Products and their fixed versions: QTS - 5.1.3.2578 build 20231110, 4.5.4.2627 build 20231225 QuTS hero - h5.1.3.2578 build 20231110, h4.5.4.2626 build 20231225 QuTScloud - c5.1.5.2651 myQNAPcloud - 2.4.51 Vulnerabilities: QNAP OS - OS command injection (CVE-2024-27124, CVSS 7.5), myQNAPcloud Link - missing authentication (CVE-2024-32764, CVSS 9.9), QNAP OS - OS command injection (CVE-2024-32766, CVSS 10.0), QNAP - introhttps://cyberfeed.cesnet.cz/reports/94?lang=enhttps://cyberfeed.cesnet.cz/reports/93?lang=enLibreswan VPN 4.15 fixes a medium-severity vulnerability. If an update cannot be performed, a patch has been released. Vulnerabilities: Libreswan - intro, Libreswan - DoS (CVE-2024-3652, CVSS 6.5)https://cyberfeed.cesnet.cz/reports/93?lang=enhttps://cyberfeed.cesnet.cz/reports/92?lang=enCitrix uberAgent 7.1.2 fixes a serious vulnerability. If an immediate update cannot be performed, the company recommends disabling all CitrixADC metrics by removing specific timer properties and changing the WmiProvider setting from PowerShell to WMIC. Vulnerabilities: Citrix uberAgent - intro, Citrix uberAgent - privilege escalation (CVE-2024-3902, CVSS 7.3)https://cyberfeed.cesnet.cz/reports/92?lang=enhttps://cyberfeed.cesnet.cz/reports/91?lang=enGitHub Enterprise Server 3.12.2 fixes 4 vulnerabilities. Vulnerabilities: GitHub Enterprise Server - intro, GitHub Enterprise Server - (CVE-2024-3646, CVSS 8.0), GitHub Enterprise Server - (CVE-2024-3684, CVSS 8.0), GitHub Enterprise Server - (CVE-2024-3470, CVSS 5.9), GitHub Enterprise Server - (CVE-2024-2440, CVSS 5.5)https://cyberfeed.cesnet.cz/reports/91?lang=enhttps://cyberfeed.cesnet.cz/reports/89?lang=enCisco fixes 1 vulnerability, which affects only version 1.3.0, in version 1.3.1. Vulnerabilities: ClamAV - DoS (CVE-2024-20380, CVSS 7.5), ClamAV - Introhttps://cyberfeed.cesnet.cz/reports/89?lang=enhttps://cyberfeed.cesnet.cz/reports/88?lang=enCisco fixes 3 vulnerabilities in the IOS, IOS XE and Integrated Management Controller (IMC) products. The fixed versions for all types of affected IMC hardware can be found at. The remaining fixed versions can be obtained at, where you must enter the type and version of your product on the first page. On the next page, you must select all impact ratings and all security advisories. On the last page, you must select the highest of the displayed fixed versions and update your affected device to it. Vulnerabilities: Cisco IMC - command injection (CVE-2024-20356, CVSS 8.7), Cisco IMC - command injection (CVE-2024-20295, CVSS 8.8), Cisco IOS + IOS XE - security bypass (CVE-2024-20373, CVSS 5.3), Cisco - introhttps://cyberfeed.cesnet.cz/reports/88?lang=enhttps://cyberfeed.cesnet.cz/reports/87?lang=enIvanti Avalanche version 6.4.3 fixes 27 vulnerabilities, two of them critical. The other 25 vulnerabilities have medium to high severity and may lead to denial of service, unauthorized command execution as SYSTEM and disclosure of sensitive information. Vulnerabilities: Ivanti Avalanche - intro, Ivanti Avalanche (CVE-2024-29204, CVSS 9.8), Ivanti Avalanche (CVE-2024-24996, CVSS 9.8)https://cyberfeed.cesnet.cz/reports/87?lang=enhttps://cyberfeed.cesnet.cz/reports/86?lang=enAtlassian fixes 1 vulnerability in the Confluence Data Center product in version 8.5.8. Vulnerabilities: Atlassian Confluence Data Center - system call injection (CVE-2024-21676, CVSS 8.8), Atlassian Confluence Data Center - introhttps://cyberfeed.cesnet.cz/reports/86?lang=enhttps://cyberfeed.cesnet.cz/reports/85?lang=enSolarWinds Serv-U version 15.4.2 fixes a high-severity vulnerability. Vulnerabilities: SolarWinds Serv-U - RCE (CVE-2024-28073, CVSS 8.4), SolarWinds Serv-U - introhttps://cyberfeed.cesnet.cz/reports/85?lang=enhttps://cyberfeed.cesnet.cz/reports/84?lang=enThe PuTTY SSH client version 0.81 fixes a serious vulnerability in the signing with ECDSA keys using the NIST P-521 elliptic curve. This vulnerability was also fixed in FileZilla 3.67.0, WinSCP 6.3.3 and TortoiseGit 2.15.0.1. Users should consider all NIST P-521 keys used with PuTTY to be compromised and should immediately remove them from authorized entries and other platforms. Vulnerabilities: PuTTY (CVE-2024-31497, CVSS 5.9), PuTTY 0.81https://cyberfeed.cesnet.cz/reports/84?lang=enhttps://cyberfeed.cesnet.cz/reports/83?lang=enLinux fixes 1 vulnerability in the Netfilter component of the Kernel. The vulnerability affects Kernel versions 5.14 to 6.6.14. The fix is contained in a commit, which can be found at. Individual releases and their fixed versions: Debian: bullseye - 5.10.209-2 bookworm - 6.1.76-1 bookworm (security) - 6.1.85-1 trixie - 6.6.15-12 sid - 6.7.9.2 Ubuntu: bionic - 4.15.0-223.235 focal - 5.4.0-174.193 jammy - 5.15.0-101.111 mantic - 6.5.0-26.26 xenial - 4.4.0-252.286 Vulnerabilities: Linux Kernel Netfilter - privilege escalation (CVE-2024-1086, CVSS 7.8), Linux Kernel Netfilter - introhttps://cyberfeed.cesnet.cz/reports/83?lang=enhttps://cyberfeed.cesnet.cz/reports/82?lang=enPalo Alto Networks fixes 1 critical vulnerability in the PAN-OS product. The vulnerability affects only versions 10.2.x, 11.0.x, 11.1.x and the fix is available in versions 10.2.9-h1, 11.0.4-h1, 11.1.2-h3. The organization is aware of active exploitation of the vulnerability. Vulnerabilities: PAN-OS - command injection (CVE-2024-3400, CVSS 9.8), PAN-OS - introhttps://cyberfeed.cesnet.cz/reports/82?lang=enhttps://cyberfeed.cesnet.cz/reports/81?lang=enSolarWinds Access Rights Manager 2023.2.3 fixes 5 vulnerabilities. Vulnerabilities: SolarWinds Access Rights Manager - intro, SolarWinds ARM - RCE (CVE-2023-40057, CVSS 9.0), SolarWinds ARM - RCE (CVE-2024-23476, CVE-2024-23479, CVSS 9.6), SolarWinds ARM - RCE (CVE-2024-23477, CVSS 7.9), SolarWinds ARM - RCE (CVE-2024-23478, CVSS 8.0)https://cyberfeed.cesnet.cz/reports/81?lang=enhttps://cyberfeed.cesnet.cz/reports/80?lang=enMinIO fixes 1 vulnerability in release 2024-01-31T20-20-33Z. Vulnerabilities: minIO - privilege escalation (CVE-2024-24747, CVSS 8.8), minIO - introhttps://cyberfeed.cesnet.cz/reports/80?lang=enhttps://cyberfeed.cesnet.cz/reports/79?lang=enGitLab Community Edition (CE) and Enterprise Edition (EE) versions 16.10.2, 16.9.4 and 16.8.6 fix 4 vulnerabilities. Vulnerabilities: GitLab Community Edition and Enterprise Edition - intro, GitLab - XSS (CVE-2024-3092, CVSS 8.7), GitLab - XSS (CVE-2024-2279, CVSS 8.7), GitLab - DoS (CVE-2023-6489, CVSS 4.3), GitLab - DoS (CVE-2023-6678, CVSS 4.3)https://cyberfeed.cesnet.cz/reports/79?lang=enhttps://cyberfeed.cesnet.cz/reports/78?lang=enXWiki fixes 12 vulnerabilities, 10 of which are critical, in versions 14.10.20, 15.5.4 and 15.10-rc-1. A procedure for verifying whether your instance is vulnerable can be found in the link next to each vulnerability. Vulnerabilities: XWiki - unathorized access (CVE-2024-31985 , CVSS 5.4), XWiki - RCE (CVE-2024-31984 , CVSS 9.9), XWiki - RCE (CVE-2024-31983, CVSS 9.9), XWiki - RCE (CVE-2024-31982, CVSS 10.0), XWiki - privilege escalation (CVE-2024-31981, CVSS 9.9), XWiki - RCE (CVE-2024-31465, CVSS 9.9), XWiki - information leak (CVE-2024-31464, CVSS 6.8), XWiki - RCE (CVE-2024-31997, CVSS 9.9), XWiki - RCE (CVE-2024-31996, CVSS 10.0), XWiki - RCE (CVE-2024-31988, CVSS 9.6), XWiki - RCE (CVE-2024-31987, CVSS 9.9), XWiki - RCE (CVE-2024-31986, CVSS 9.0), XWiki - introhttps://cyberfeed.cesnet.cz/reports/78?lang=enhttps://cyberfeed.cesnet.cz/reports/77?lang=enNode.js versions 18.20.2, 20.12.2 and 21.7.3 fix a high-severity vulnerability. Vulnerabilities: Node.js - RCE (CVE-2024-27980, CVSS 8.1), Node.js - introhttps://cyberfeed.cesnet.cz/reports/77?lang=enhttps://cyberfeed.cesnet.cz/reports/76?lang=enIvanti fixes 4 vulnerabilities in the Ivanti Connect Secure and Policy Secure products. The fixed versions for Ivanti Connect Secure are 22.1R6.2, 22.2R4.2, 22.3R1.2, 22.4R1.2, 22.4R2.4, 22.5R1.3, 22.5R2.4, 22.6R2.3, 9.1R14.6, 9.1R15.4, 9.1R16.4, 9.1R17.4, 9.1R18.5 and for Policy Secure the versions are 22.4R1.2, 22.5R1.3, 22.6R1.2, 9.1R16.4, 9.1R17.4, 9.1R18.5. Vulnerabilities: Ivanti Connect Secure and Policy Secure - heap overflow (CVE-2024-21894, CVSS 8.2), Ivanti Connect Secure and Policy Secure - null pointer dereference (CVE-2024-22052, CVSS 7.5), Ivanti Connect Secure and Policy Secure - heap overflow (CVE-2024-22053, CVSS 8.2), Ivanti Connect Secure and Policy Secure - XXE (CVE-2024-22023, CVSS 5.3), Ivanti Connect Secure and Policy Secure - introhttps://cyberfeed.cesnet.cz/reports/76?lang=enhttps://cyberfeed.cesnet.cz/reports/75?lang=enCockpit fixes 1 vulnerability in versions 314, 311.2, 310.4 and 287.1. Vulnerabilities: Cockpit - command injection (CVE-2024-2947, CVSS 7.3), Cockpit - introhttps://cyberfeed.cesnet.cz/reports/75?lang=enhttps://cyberfeed.cesnet.cz/reports/74?lang=enVulnerabilities: VMware - RCE (CVE-2024-22246, CVSS 7.4), VMware - missing authentication (CVE-2024-22247, CVSS 4.8), VMware - open redirect (CVE-2024-22248, CVSS 7.1), VMware - introhttps://cyberfeed.cesnet.cz/reports/74?lang=enhttps://cyberfeed.cesnet.cz/reports/73?lang=enOn 04.04.2024, Apache HTTP server version 2.4.59 was released, which fixes two moderate-severity and one low-severity vulnerability. Vulnerabilities: Apache HTTP server - CVE-2024-27316 (memory exhaustion, DoS, CVSS 5.9), Apache HTTP server 2.4.59, Apache HTTP server - CVE-2024-24795 (HTTP desync, CVSS 3.3), Apache HTTP server - CVE-2023-38709 (HTTP response splitting, CVSS 4.3)https://cyberfeed.cesnet.cz/reports/73?lang=enhttps://cyberfeed.cesnet.cz/reports/72?lang=enVulnerabilities: PostgreSQL JDBC driver - SQL injection (CVE-2024-1597, CVSS 10.0), PostgreSQL - introhttps://cyberfeed.cesnet.cz/reports/72?lang=enhttps://cyberfeed.cesnet.cz/reports/71?lang=enVulnerabilities: Cisco IOS XE - privileges escalation (CVE-2024-20278, CVSS 6.5), Cisco IOS and IOS XE - DoS (CVE-2024-20312, CVSS 7.4), Cisco IOS and IOS XE - DoS (CVSS 8.6), Cisco IOS XE - unauthorized access (CVSS 5.8), Cisco IOS and IOS XE - DoS (CVSS 7.4), Cisco IOS XE - RCE (CVE-2024-20306, CVSS 6.0), Cisco Access Point - security check bypass (CVE-2024-20265, CVSS 5.9), Cisco Access Point - DoS (CVE-2024-20354, CVSS 4.7), CIsco Catalyst Center - unauthorized modification (CVE-2024-20333, CVSS 4.3), Cisco - introhttps://cyberfeed.cesnet.cz/reports/71?lang=enhttps://cyberfeed.cesnet.cz/reports/70?lang=enCurl version 8.7.0 fixes 4 vulnerabilities. Vulnerabilities: cURL (CVE-2024-2004, CVSS 3.5), cURL (CVE-2024-2379, CVSS 6.3), cURL (CVE-2024-2398, CVSS 8.6), cURL (CVE-2024-2466, CVSS 6.5)https://cyberfeed.cesnet.cz/reports/70?lang=enhttps://cyberfeed.cesnet.cz/reports/69?lang=enVulnerabilities: xz/liblzma - backdoor in the official packages, xz/liblzma - CVE-2024-3094 (backdoor, CVSS 10.0)https://cyberfeed.cesnet.cz/reports/69?lang=enhttps://cyberfeed.cesnet.cz/reports/68?lang=enVulnerabilities: Splunk Enterprise - intro, Splunk Enterprise - SPL command execution (CVE-2024-29946, CVSS 8.1), Splunk Enterprise - authentication token exposure (CVE-2024-29945, CVSS 7.2)https://cyberfeed.cesnet.cz/reports/68?lang=enhttps://cyberfeed.cesnet.cz/reports/67?lang=enVulnerabilities: Elasticsearch - DoS (CVE-2024-23450, CVSS 4.9), Elasticsearch - improper authorization (CVE-2024-23451, CVSS 4.4), Elasticsearch - introhttps://cyberfeed.cesnet.cz/reports/67?lang=enhttps://cyberfeed.cesnet.cz/reports/66?lang=enVulnerabilities: GitLab - intro, GitLab - DoS (CVE-2024-2818, CVSS 4.3), GitLab - stored XSS (CVE-2023-6371, CVSS 8.7)https://cyberfeed.cesnet.cz/reports/66?lang=enhttps://cyberfeed.cesnet.cz/reports/65?lang=enVulnerabilities: Emacs (CVE-2024-30205, CVSS 7.1), Emacs (CVE-2024-30204, CVSS 2.8), Emacs (CVE-2024-30203, CVSS 5.5), Emacs (CVE-2024-30202, CVSS 7.8), Emacs - introhttps://cyberfeed.cesnet.cz/reports/65?lang=enhttps://cyberfeed.cesnet.cz/reports/63?lang=enVulnerabilities: ArubaOS-Switch - intro, ArubaOS-Switch - DoS (CVE-2024-26303, CVSS 4.9)https://cyberfeed.cesnet.cz/reports/63?lang=enhttps://cyberfeed.cesnet.cz/reports/61?lang=enVulnerabilities: Firefox 115.9.1 ESR and 124.0.1, Firefox - CVE-2024-29943 (OOB read/write, CVSS 4.8), Firefox - CVE-2024-29944 (RCE, CVSS 8.1)https://cyberfeed.cesnet.cz/reports/61?lang=enhttps://cyberfeed.cesnet.cz/reports/60?lang=enVulnerabilities: GnuTLS - CVE-2024-28834 (Minerva, ECDSA timing side-channel, CVSS 7.4), GnuTLS - CVE-2024-28835 (crash on chain > 16, CVSS 5.0), GnuTLS 3.8.4https://cyberfeed.cesnet.cz/reports/60?lang=enhttps://cyberfeed.cesnet.cz/reports/59?lang=enGitHub Enterprise Server version 3.12.1 fixes 4 vulnerabilities. Vulnerabilities: GitHub - RCE (CVE-2024-2469, CVSS 8.0), GitHub - (CVE-2024-2443, CVSS 9.1), GitHub - (CVE-2024-2440, CVSS 5.9), GitHub - CSRF (CVE-2024-2748, CVSS 4.3)https://cyberfeed.cesnet.cz/reports/59?lang=enhttps://cyberfeed.cesnet.cz/reports/55?lang=enVulnerabilities: Ivanti Standalone Sentry - intro, Ivanti Standalone Sentry - RCE (CVE-2023-41724, CVSS 9.6)https://cyberfeed.cesnet.cz/reports/55?lang=enhttps://cyberfeed.cesnet.cz/reports/52?lang=enVulnerabilities: LabVIEW - RCE (CVE-2024-23608, CVE-2024-23610, CVE-2024-23611, CVSS 7.8), LabVIEW - RCE (CVE-2024-23609, CVE-2024-23612, CVSS 7.8), LabVIEW - introhttps://cyberfeed.cesnet.cz/reports/52?lang=enhttps://cyberfeed.cesnet.cz/reports/51?lang=enVulnerabilities: Mattermost - intro, Mattermost - account takeover (CVE-2024-2450, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/51?lang=enhttps://cyberfeed.cesnet.cz/reports/49?lang=enVMware fixes 2 high-severity vulnerabilities in Spring Security and Spring Framework. Products and their fixes: Spring Security - 6.2.3, 6.1.8, 6.0.10, 5.8.11, 5.7.12 Spring Framework - 6.1.5, 6.0.18, 5.3.33 Vulnerabilities: VMware Spring Security - Broken Access Control (CVE-2024-22257, CVSS 8.2), VMware Spring Framework - SSRF (CVE-2024-22259, CVSS 8.1)https://cyberfeed.cesnet.cz/reports/49?lang=enhttps://cyberfeed.cesnet.cz/reports/48?lang=enAIOHTTP, an HTTP client/server for asyncio (Python library), fixes 1 vulnerability in version 3.9.2. Vulnerabilities: AIOHTTP - path traversal (CVE-2024-23334, CVSS 5.9)https://cyberfeed.cesnet.cz/reports/48?lang=enhttps://cyberfeed.cesnet.cz/reports/47?lang=enKubernetes versions 1.28.4, 1.27.8, 1.26.11 and 1.25.16 fix 1 vulnerability. Vulnerabilities: Kubernetes - RCE (CVE-2023-5528, CVSS 7.2)https://cyberfeed.cesnet.cz/reports/47?lang=enhttps://cyberfeed.cesnet.cz/reports/46?lang=enCheckmk Windows agent versions 2.1.0p40, 2.2.0p23, 2.3.0b1 and 2.4.0b1 fix a high-severity vulnerability. Vulnerabilities: Checkmk Agent - privilege escalation (CVE-2024-0670, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/46?lang=enhttps://cyberfeed.cesnet.cz/reports/45?lang=enMongoDB fixes a high-severity vulnerability affecting the MongoDB server in versions 7.1.0-rc4, 7.0.6, 6.0.14, 5.0.25 and 4.4.29. Vulnerabilities: MongoDB - validation bypass (CVE-2024-1351, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/45?lang=enhttps://cyberfeed.cesnet.cz/reports/44?lang=enCISA recommends updating Industrial Control Systems Network Protocol Parsers (ICSNPP) - Ethercat Zeek Plugin, which was fixed in commit 3bca34c (from 30.10.2023) and later. Vulnerabilities: Ethercat Zeek Plugin - out-of-bounds read (CVE-2023-7242, CVSS 8.2), Ethercat Zeek Plugin - out-of-bounds write (CVE-2023-7243, CVSS 9.8), Ethercat Zeek Plugin - out-of-bounds write (CVE-2023-7244, CVSS 9.8)https://cyberfeed.cesnet.cz/reports/44?lang=enhttps://cyberfeed.cesnet.cz/reports/42?lang=enCISA recommends updating Industrial Control Systems Network Protocol Parsers (ICSNPP) - Ethercat Zeek Plugin to version 3bca34c or later. Vulnerabilities: Ethercat Zeek Plugin - out-of-bounds read (CVE-2023-7242, CVSS 8.2), Ethercat Zeek Plugin - out-of-bounds write (CVE-2023-7243, CVSS 9.8), Ethercat Zeek Plugin - out-of-bounds write (CVE-2023-7244, CVSS 9.8)https://cyberfeed.cesnet.cz/reports/42?lang=enhttps://cyberfeed.cesnet.cz/reports/41?lang=enSquid version 6.8 fixes 1 vulnerability in the Squid Web Cache product. Vulnerabilities: Squid Cache - DoS (CVE-2024-25111, CVSS 8.6)https://cyberfeed.cesnet.cz/reports/41?lang=enhttps://cyberfeed.cesnet.cz/reports/40?lang=enGitLab versions 16.9.2, 16.8.4, 16.7.7 fix 2 vulnerabilities in the GitLab Community Edition (CE) and Enterprise Edition (EE) products. Vulnerabilities: GitLab - authorization bypass (CVE-2024-0199, CVSS 7.7), GitLab - privilege escalation (CVE-2024-1299, CVSS 6.5)https://cyberfeed.cesnet.cz/reports/40?lang=enhttps://cyberfeed.cesnet.cz/reports/39?lang=enVMware fixes several vulnerabilities in ESXi, Workstation, Fusion and Cloud Foundation. Products and their fixes: VMware ESXi - ESXi80U2sb-23305545, ESXi80U1d-23299997, ESXi70U3p-23307199 VMware Workstation - 17.5.1 VMware Fusion - 13.5.1 VMware Cloud Foundation - KB88287 Vulnerabilities: VMware ESXi, Workstation, and Fusion - use-after-free (CVE-2024-22252, CVSS 9.3), VMware ESXi, Workstation, and Fusion - use-after-free (CVE-2024-22253, CVSS 9.3), VMware ESXi - Out-of-bounds write (CVE-2024-22254, CVSS 7.9), VMware ESXi, Workstation, and Fusion - information disclosure (CVE-2024-22255, CVSS 7.1), VMware Workstation, and Fusion - out-of-bounds read (CVE-2024-22251, CVSS 5.9)https://cyberfeed.cesnet.cz/reports/39?lang=enhttps://cyberfeed.cesnet.cz/reports/36?lang=enAruba versions 10.5.1.0, 10.4.1.0, 8.11.2.1 and 8.10.0.10 fix 7 vulnerabilities in the ArubaOS product (Mobility Controller, Mobility Conductor and Gateway). Vulnerabilities: ArubaOS - command injection (CVSS 7.2), ArubaOS - file deletion (CVE-2024-25614, CVSS 5.5), ArubaOS - DoS (CVE-2024-25615, CVSS 5.3), ArubaOS - information disclosure (CVE-2024-25616, CVSS 3.7)https://cyberfeed.cesnet.cz/reports/36?lang=enhttps://cyberfeed.cesnet.cz/reports/35?lang=enCisco NX-OS has received vulnerability fixes through Software Maintenance Updates (SMU) for versions 9.3(12), 10.2(6) and 10.3(4a). Vulnerabilities: Cisco NX-OS - DoS (CVE-2024-20267, CVSS 8.6), Cisco NX-OS - DoS (CVE-2024-20321, CVSS 8.6), Cisco NX-OS and FXOS - DoS (CVE-2024-20294, CVSS 6.6), Cisco NX-OS (CVE-2024-20291, CVSS 5.8)https://cyberfeed.cesnet.cz/reports/35?lang=enhttps://cyberfeed.cesnet.cz/reports/34?lang=enSolarWinds Security Event Manager version 2023.4.1 fixes a high-severity vulnerability. Vulnerabilities: SolarWinds SEM - RCE (CVE-2024-0692, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/34?lang=enhttps://cyberfeed.cesnet.cz/reports/33?lang=enAdobe FrameMaker Publishing Server version 2022.2 fixes a critical vulnerability. Vulnerabilities: Adobe FrameMaker Publishing Server - security feature bypass (CVE-2024-20738, CVSS 9.8)https://cyberfeed.cesnet.cz/reports/33?lang=enhttps://cyberfeed.cesnet.cz/reports/32?lang=enVMware fixes a high-severity vulnerability in Spring Framework with versions 6.1.4, 6.0.17 and 5.3.32. Vulnerabilities: Spring Framework - SSRF (CVE-2024-22243, CVSS 8.1)https://cyberfeed.cesnet.cz/reports/32?lang=enhttps://cyberfeed.cesnet.cz/reports/31?lang=enAtlassian fixes 2 vulnerabilities in Confluence Data Center and Assets Discovery. Affected products and their fixed versions: Confluence Data Center - 8.8.0, 8.7.2, 8.5.5 , 7.19.18 Assets Discovery - 6.2.1 Vulnerabilities: Atlassian Confluence Data Center - stored XSS (CVE-2024-21678, CVSS 8.5), Atlassian Assets Discovery - Injection (CVE-2024-21682, CVSS 7.2)https://cyberfeed.cesnet.cz/reports/31?lang=enhttps://cyberfeed.cesnet.cz/reports/30?lang=enGitLab versions 16.9.1, 16.8.3 and 16.7.6 fix 8 vulnerabilities in the GitLab Community Edition (CE) and Enterprise Edition (EE) products. Vulnerabilities: GitLab - XSS (CVE-2024-1451 , CVSS 8.7), GitLab - privilege escalation (CVE-2023-6477, CVSS 6.7), GitLab - restriction bypass (CVE-2023-4895, CVSS 4.3), GitLab - unauthorized access (CVE-2023-3509, CVSS 3.7), GitLab - rules bypass (CVE-2024-0410, CVSS 3.0), GitLab - DoS (CVE-2023-6736, CVSS 6.5), GitLab - LDAP bypass (CVE-2024-1525, CVSS 5.3), GitLab - improper authorization (CVE-2024-0861, CVSS 4.3)https://cyberfeed.cesnet.cz/reports/30?lang=enhttps://cyberfeed.cesnet.cz/reports/29?lang=enFortinet fixes 3 vulnerabilities in FortiNAC, FortiManager, FortiAnalyzer, FortiAnalyzer-BigData and FortiClientEMS. Affected products and their fixed versions: FortiNAC - 9.4.4, 7.2.3 FortiAnalyzer - 7.4.2, 7.2.4 FortiAnalyzer-BigData - 7.2.6 FortiManager - 7.4.2, 7.2.4 FortiClientEMS - 7.2.3, 7.0.11 Vulnerabilities: FortiNAC - XSS (CVE-2023-26206, CVSS 6.1), Forti* - information exposure (CVE-2023-44253, CVSS 5.0), FortiClientEMS - improper privilege mngmnt (CVE-2023-45581, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/29?lang=enhttps://cyberfeed.cesnet.cz/reports/28?lang=enIvanti fixes 2 high-severity vulnerabilities found in Ivanti Connect Secure, Ivanti Policy Secure and Ivanti Neurons for ZTA. Fixes for Ivanti Connect Secure were released in versions 9.1R14.4, 9.1R17.2, 9.1R18.3, 22.4R2.2 and 22.5R1.1, and for ZTA in version 22.6R1.3. Further fixes are expected to be released gradually. Vulnerabilities: Ivanti - privilege escalation (CVE-2024-21888, CVSS 7.2), Ivanti - Server-side request forgery (CVE-2024-21893, CVSS 8.2)https://cyberfeed.cesnet.cz/reports/28?lang=enhttps://cyberfeed.cesnet.cz/reports/27?lang=enMastodon versions 3.5.17, 4.0.13, 4.1.13 and 4.2.5 fix 1 vulnerability. Vulnerabilities: Mastodon - account takeover (CVE-2024-23832, CVSS 9.4)https://cyberfeed.cesnet.cz/reports/27?lang=enhttps://cyberfeed.cesnet.cz/reports/26?lang=enQualys draws attention to 4 vulnerabilities in the glibc (GNU C) library, 3 of which have been assigned CVE identifiers and concern the __vsyslog_internal() function, which is called by the syslog() and vsyslog() functions. The last vulnerability concerns the qsort() function. The vulnerability has so far been fixed only by Debian, in the bookworm release with version 2.36-9+deb12u4. The buster and bullseye releases are not vulnerable. Vulnerabilities: glibc - privilege escalation (CVE-2023-6246, CVSS 7.8), glibc - integer overflow (CVE-2023-6780, CVSS 5.3), glibc - buffer overflow (CVE-2023-6779, CVSS 7.5), glibc - buffer overflowhttps://cyberfeed.cesnet.cz/reports/26?lang=enhttps://cyberfeed.cesnet.cz/reports/25?lang=enGitHub versions 3.8.13, 3.9.8, 3.10.5 and 3.11.3 fix 2 vulnerabilities in the GitHub Enterprise Server product. Vulnerabilities: GitHub Enterprise Server - RCE (CVE-2024-0200, CVSS 7.2), GitHub Enterprise Server - privilege escalation (CVE-2024-0507, CVSS 8.8)https://cyberfeed.cesnet.cz/reports/25?lang=enhttps://cyberfeed.cesnet.cz/reports/22?lang=enSplunk versions 7.1.2, 7.2.0 and 7.3.0 fix 2 vulnerabilities in the Splunk Enterprise Security product. Test Vulnerabilities: Splunk Enterprise Security - DoS (CVE-2024-22164, CVSS 4.3), Splunk Enterprise Security - DoS (CVE-2024-22165, CVSS 6.5)https://cyberfeed.cesnet.cz/reports/22?lang=enhttps://cyberfeed.cesnet.cz/reports/20?lang=enSquid version 6.5 fixes 3 high-severity vulnerabilities that require no authentication and allow a DoS attack. Vulnerabilities: Squid - DoS (CVE-2023-49285, CVSS 8.6), Squid - DoS (CVE-2023-49286, CVSS 8.6), Squid - DoS (CVE-2023-49288, CVSS 8.6)https://cyberfeed.cesnet.cz/reports/20?lang=enhttps://cyberfeed.cesnet.cz/reports/17?lang=enApache fixes a critical vulnerability in the ActiveMQ product. Vulnerabilities: CVE-2023-46604 - ActiveMQ RCE (CVSS 10.0)https://cyberfeed.cesnet.cz/reports/17?lang=en