https://github.com/advisoryops/advisoryopsTop-scored healthcare cybersecurity and device-safety advisoriesTue, 27 Oct 2026 12:11:05 +0000en-ushttps://nvd.nist.gov/vuln/detail/CVE-2026-42271https://nvd.nist.gov/vuln/detail/CVE-2026-42271Mon, 08 Jun 2026 00:00:00 +0000LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied comP0https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239ahttps://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239aCisco IOS and IOS XE software has a critical vulnerability in the Smart Install feature that could allow an attacker to remotely crash the device or run harmful code. A patch is available, so it is essential to update your software immediately to protect your network from potential attacks. Please prioritize this action to prevent any service disruptions.P0https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239ahttps://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239aCisco IOS XE Software has a critical vulnerability in its web interface that could allow an authenticated attacker to execute commands with root access. A patch is available to fix this issue. It is recommended to update your software immediately to prevent potential unauthorized access.P0https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239ahttps://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239aCisco IOS XE Software has a critical vulnerability that allows attackers to gain unauthorized access and escalate their privileges. A patch is available, so it's important to update your systems immediately to protect against potential exploitation. Ensure that your devices are checked and updated to prevent unauthorized access.P0https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071ahttps://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071aFortinet FortiClientEMS versions 7.2.0 to 7.2.2 and 7.0.1 to 7.0.10 have a critical security vulnerability that could allow an attacker to execute unauthorized commands. A patch is available, so it is essential to update to the latest version immediately to protect your systems. Please prioritize this update to ensure the safety of our network.P0https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071ahttps://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071aConnectWise ScreenConnect versions 23.9.7 and earlier have a critical vulnerability that could allow attackers to bypass authentication and access sensitive information or systems. A patch is available to resolve this issue. It is recommended to update to the latest version as soon as possible to protect your systems.P0https://nvd.nist.gov/vuln/detail/CVE-2026-9082https://nvd.nist.gov/vuln/detail/CVE-2026-9082Fri, 22 May 2026 00:00:00 +0000Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API. | Drupal CoreP0https://www.cisa.gov/news-events/analysis-reports/ar25-261ahttps://www.cisa.gov/news-events/analysis-reports/ar25-261aIvanti Endpoint Manager Mobile has a critical authentication bypass vulnerability that allows unauthorized access to protected resources through its API. A patch is available to fix this issue. It's essential to update your software immediately to prevent potential attacks.P0https://www.cisa.gov/news-events/analysis-reports/ar25-261ahttps://www.cisa.gov/news-events/analysis-reports/ar25-261aIvanti Endpoint Manager Mobile versions 12.5.0.0 and earlier have a critical vulnerability that allows authenticated attackers to execute arbitrary code through specially crafted requests. A patch is available to fix this issue. It is essential to update your systems to avoid potential exploitation.P0https://nvd.nist.gov/vuln/detail/CVE-2025-57819https://nvd.nist.gov/vuln/detail/CVE-2025-57819Fri, 29 Aug 2025 00:00:00 +0000Sangoma's FreePBX has a critical vulnerability that allows unauthorized access to its administrator interface, potentially leading to remote control of the system. Patches are available for versions 15.0.66, 16.0.89, and 17.0.3. It is urgent to update your FreePBX to the latest version to protect against this security risk.P0https://nvd.nist.gov/vuln/detail/CVE-2025-6554https://nvd.nist.gov/vuln/detail/CVE-2025-6554Google Chrome versions before 138.0.7204.96 have a high-severity vulnerability that lets attackers read or write data remotely through a specially crafted webpage. A patch is available for this issue. It's important to upgrade to the latest version of Chrome to protect against this risk.P0https://nvd.nist.gov/vuln/detail/CVE-2013-3893https://nvd.nist.gov/vuln/detail/CVE-2013-3893Tue, 12 Aug 2025 00:00:00 +0000Microsoft Internet Explorer versions 6 through 11 have a critical vulnerability that could allow attackers to run harmful code on your system through malicious JavaScript. A patch is available, so it's essential to update your Internet Explorer immediately to protect your network. This will help prevent potential security risks from remote attackers.P0https://nvd.nist.gov/vuln/detail/CVE-2013-3918https://nvd.nist.gov/vuln/detail/CVE-2013-3918Mon, 06 Oct 2025 00:00:00 +0000Microsoft Windows contains an out-of-bounds write vulnerability in the InformationCardSigninHelper Class ActiveX control, icardie.dll. An attacker could exploit the vulnerability by constructing a specially crafted webpage. When a user views the webpage, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). UserP0https://nvd.nist.gov/vuln/detail/CVE-2010-3962https://nvd.nist.gov/vuln/detail/CVE-2010-3962Mon, 06 Oct 2025 00:00:00 +0000Microsoft Internet Explorer versions 6, 7, and 8 have a critical vulnerability that allows remote attackers to run unauthorized code through specific web content features. There is no patch available for this issue, so it is important to avoid using these outdated versions of Internet Explorer. Ensure that users switch to a more secure browser to protect hospital systems.P0https://nvd.nist.gov/vuln/detail/CVE-2021-23758https://nvd.nist.gov/vuln/detail/CVE-2021-23758Wed, 26 Aug 2026 00:00:00 +0000Ajax.NET Professional (AjaxPro) contains a deserialization of untrusted data vulnerability that could allow for remote code execution via arbitrary .NET classes. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. | Ajax.NET Professional Ajax.NET ProfessionalP0https://nvd.nist.gov/vuln/detail/CVE-2023-22894https://nvd.nist.gov/vuln/detail/CVE-2023-22894Thu, 08 Oct 2026 00:00:00 +0000This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.P0https://nvd.nist.gov/vuln/detail/CVE-2023-22894https://nvd.nist.gov/vuln/detail/CVE-2023-22894Thu, 08 Oct 2026 00:00:00 +0000Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution. | Strapi StrapiP0https://nvd.nist.gov/vuln/detail/CVE-2026-60137https://nvd.nist.gov/vuln/detail/CVE-2026-60137Tue, 21 Jul 2026 00:00:00 +0000WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations. | WordPress CoreP0https://nvd.nist.gov/vuln/detail/CVE-2026-60137https://nvd.nist.gov/vuln/detail/CVE-2026-60137Tue, 21 Jul 2026 00:00:00 +0000WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.P0https://nvd.nist.gov/vuln/detail/CVE-2026-9586https://nvd.nist.gov/vuln/detail/CVE-2026-9586Wed, 02 Sep 2026 00:00:00 +0000Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution. | Sangoma SwitchvoxP0https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-266ahttps://www.cisa.gov/news-events/cybersecurity-advisories/aa25-266aA critical vulnerability exists in the Linux kernel that can allow local users to gain unauthorized access to system privileges. This weakness has been exploited in the past and does have a patch available. It is highly recommended that you update your Linux systems to the latest version to protect against potential attacks.P0https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-266ahttps://www.cisa.gov/news-events/cybersecurity-advisories/aa25-266aGeoServer has a critical vulnerability that allows unauthenticated users to execute arbitrary code, affecting all versions before 2.22.6, 2.23.6, 2.24.4, and 2.25.2. Patches are available for these versions, and it's recommended to upgrade immediately or, as a temporary measure, remove the gt-complex module, which may affect functionality. Ensure all instances of GeoServer are secured to prevent potential exploitation.P0https://nvd.nist.gov/vuln/detail/CVE-2025-20352https://nvd.nist.gov/vuln/detail/CVE-2025-20352Mon, 29 Sep 2025 00:00:00 +0000Cisco IOS and IOS XE software have a critical vulnerability in their Simple Network Management Protocol that could allow low-privileged attackers to cause a service outage, or high-privileged attackers to gain complete control of the device. A patch is available to fix this issue. It is crucial to apply the patch immediately to protect your systems from potential attacks.P0https://nvd.nist.gov/vuln/detail/CVE-2025-7775https://nvd.nist.gov/vuln/detail/CVE-2025-7775Tue, 26 Aug 2025 00:00:00 +0000Citrix has identified a critical memory overflow vulnerability in the NetScaler ADC and NetScaler Gateway products, which can allow hackers to execute remote code or cause service interruptions. A patch is available, and it's crucial to apply it immediately to protect your systems. Ensure that all configurations, especially involving IPv6, are reviewed as part of this update.P0https://nvd.nist.gov/vuln/detail/CVE-2007-0671https://nvd.nist.gov/vuln/detail/CVE-2007-0671Tue, 12 Aug 2025 00:00:00 +0000Microsoft Excel has a critical vulnerability that allows remote attackers to run harmful code. A patch is currently unavailable, so it’s essential to limit the use of affected versions of Excel in your environment. Regularly review your systems to ensure that they are not exposed to this risk.P0https://nvd.nist.gov/vuln/detail/CVE-2017-1000353https://nvd.nist.gov/vuln/detail/CVE-2017-1000353Thu, 02 Oct 2025 00:00:00 +0000Jenkins software versions 2.56 and earlier, as well as 2.46.1 LTS and earlier, have a critical vulnerability that allows attackers to execute code without authentication. A patch is available, so it's important to upgrade to Jenkins version 2.46.2 LTS or newer immediately to secure your systems. Be sure to check your systems for these versions and apply the update as soon as possible.P0https://nvd.nist.gov/vuln/detail/CVE-2024-8069https://nvd.nist.gov/vuln/detail/CVE-2024-8069Mon, 25 Aug 2025 00:00:00 +0000Citrix Session Recording has a critical vulnerability that allows an authenticated user on the same network to execute harmful commands with high-level access. A patch is available to fix this issue. It's essential to apply the patch immediately to safeguard your systems.P0https://nvd.nist.gov/vuln/detail/CVE-2025-20281https://nvd.nist.gov/vuln/detail/CVE-2025-20281Mon, 28 Jul 2025 00:00:00 +0000Cisco has identified a critical vulnerability in their ISE and ISE-PIC products that could allow an unverified attacker to gain full control of the device remotely without needing any login credentials. A patch is available, so it is crucial to update these systems immediately to prevent potential exploitation.P0https://nvd.nist.gov/vuln/detail/CVE-2025-20333https://nvd.nist.gov/vuln/detail/CVE-2025-20333Thu, 25 Sep 2025 00:00:00 +0000Cisco has identified a critical vulnerability in the VPN web server of its Secure Firewall products that could allow an authenticated attacker to execute harmful code on the device. A patch is available, and it is strongly recommended that you apply it immediately to protect your systems from potential breaches. Please ensure all VPN users are updated and informed about this security risk.P0https://nvd.nist.gov/vuln/detail/CVE-2025-20337https://nvd.nist.gov/vuln/detail/CVE-2025-20337Mon, 28 Jul 2025 00:00:00 +0000Cisco has identified a critical vulnerability in their Identity Services Engine (ISE) that allows attackers to run harmful code without needing any credentials. A patch is available, and it's crucial to apply it immediately to protect against potential unauthorized access to your systems.P0https://nvd.nist.gov/vuln/detail/CVE-2025-20333https://nvd.nist.gov/vuln/detail/CVE-2025-20333Thu, 25 Sep 2025 00:00:00 +0000Cisco has identified a critical vulnerability in the VPN web server of Cisco Secure ASA and FTD software that could allow unauthorized access to restricted areas, potentially causing devices to crash. A patch is available, and it is strongly recommended that you upgrade to the latest software version to protect your network. Please prioritize this update to prevent any disruption in service.P0https://nvd.nist.gov/vuln/detail/CVE-2025-24016https://nvd.nist.gov/vuln/detail/CVE-2025-24016Tue, 10 Jun 2025 00:00:00 +0000Wazuh, a threat management tool, has a critical security vulnerability that allows attackers to execute arbitrary code remotely. This affects versions 4.4.0 to 4.9.0, but version 4.9.1 includes a patch to fix the issue. It is essential to upgrade to version 4.9.1 immediately to protect against potential attacks.P0https://nvd.nist.gov/vuln/detail/CVE-2025-32433https://nvd.nist.gov/vuln/detail/CVE-2025-32433Mon, 09 Jun 2025 00:00:00 +0000Erlang/OTP has a critical vulnerability in its SSH server that allows attackers to execute commands without authentication. Patches are available for the most recent versions, so it's essential to update to OTP-27.3.3, OTP-26.2.5.11, or OTP-25.3.2.20 as soon as possible. If you can't patch immediately, consider disabling the SSH server or adjusting firewall rules to limit access.P0https://nvd.nist.gov/vuln/detail/CVE-2025-3935https://nvd.nist.gov/vuln/detail/CVE-2025-3935Mon, 02 Jun 2025 00:00:00 +0000ConnectWise ScreenConnect versions 25.2.3 and earlier have a critical vulnerability that could allow attackers to execute code remotely if specific system keys are compromised. A patch is available in version 2025.4, which disables the vulnerable feature. It's recommended to upgrade to this version immediately to protect against this risk.P0https://nvd.nist.gov/vuln/detail/CVE-2025-49704https://nvd.nist.gov/vuln/detail/CVE-2025-49704Sun, 20 Jul 2025 00:00:00 +0000Microsoft Office SharePoint has a critical vulnerability that allows an authorized attacker to run malicious code over the network. A patch is available to fix this issue. It is recommended to apply the patch immediately to protect hospital systems.P0https://nvd.nist.gov/vuln/detail/CVE-2025-49704https://nvd.nist.gov/vuln/detail/CVE-2025-49704Tue, 22 Jul 2025 00:00:00 +0000Microsoft Office SharePoint has a critical vulnerability that allows unauthorized access, potentially letting attackers spoof identities on the network. A patch is available to fix this issue. We recommend updating SharePoint immediately to enhance security.P0https://nvd.nist.gov/vuln/detail/CVE-2025-5086https://nvd.nist.gov/vuln/detail/CVE-2025-5086Thu, 11 Sep 2025 00:00:00 +0000Dassault Systèmes has identified a serious vulnerability in their DELMIA Apriso software that could allow remote code execution. This is considered a critical risk, and a patch is available. To protect your systems, it is crucial to apply the patch as soon as possible.P0https://nvd.nist.gov/vuln/detail/CVE-2025-53690https://nvd.nist.gov/vuln/detail/CVE-2025-53690Thu, 04 Sep 2025 00:00:00 +0000Sitecore's Experience Manager and Experience Platform have a critical vulnerability that allows code injection through untrusted data. A patch is available, so it's essential to update these systems to mitigate potential security risks. Ensure that all installations are updated to the latest version as soon as possible.P0https://nvd.nist.gov/vuln/detail/CVE-2016-7836https://nvd.nist.gov/vuln/detail/CVE-2016-7836Tue, 14 Oct 2025 00:00:00 +0000SKYSEA Client View software versions 11.221.03 and earlier have a critical vulnerability that allows remote attackers to execute code on the system. A patch is available to fix this issue. It is recommended to update your software immediately to protect your network.P0https://nvd.nist.gov/vuln/detail/CVE-2025-59287https://nvd.nist.gov/vuln/detail/CVE-2025-59287Microsoft Windows Server Update Service has a critical vulnerability that could allow an unauthorized attacker to execute harmful code remotely. A patch is available to fix this issue. It is crucial to apply the patch immediately to protect your network from potential attacks.P0https://nvd.nist.gov/vuln/detail/CVE-2025-24893https://nvd.nist.gov/vuln/detail/CVE-2025-24893Thu, 30 Oct 2025 00:00:00 +0000XWiki has a critical vulnerability that allows unauthorized users to execute harmful commands, affecting the entire system's security. A patch is available in versions 15.10.11, 16.4.1, and 16.5.0RC1. It is recommended to upgrade to these versions immediately to protect your systems.P0https://nvd.nist.gov/vuln/detail/CVE-2025-48703https://nvd.nist.gov/vuln/detail/CVE-2025-48703Tue, 04 Nov 2025 00:00:00 +0000CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command Injection vulnerability that allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known. | CWP Control Web PanelP0https://nvd.nist.gov/vuln/detail/CVE-2025-55182https://nvd.nist.gov/vuln/detail/CVE-2025-55182Meta's React Server Components have a critical vulnerability that allows unauthorized remote code execution in specific versions 19.0.0 to 19.2.0. There is no current patch available to fix this issue. It is recommended to immediately assess your systems for these versions and either upgrade to a secure version or disable the affected components until a remedy is found.P0https://nvd.nist.gov/vuln/detail/CVE-2025-55182https://nvd.nist.gov/vuln/detail/CVE-2025-55182The advisory from Meta indicates that the reported vulnerability in Next.js is a duplicate and does not require further action. No new risks or patches are being introduced from this advisory. Please continue monitoring for other relevant security updates.P0https://nvd.nist.gov/vuln/detail/CVE-2024-37079https://nvd.nist.gov/vuln/detail/CVE-2024-37079Fri, 23 Jan 2026 00:00:00 +0000Broadcom VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. This could allow a malicious actor with network access to vCenter Server to send specially crafted network packets, potentially leading to remote code execution. | Broadcom VMware vCenter ServerP0https://nvd.nist.gov/vuln/detail/CVE-2025-37164https://nvd.nist.gov/vuln/detail/CVE-2025-37164Wed, 07 Jan 2026 00:00:00 +0000Hewlett Packard Enterprise has identified a critical remote code execution vulnerability in HPE OneView, and a patch is available. It's crucial for security teams to quickly apply this update to protect hospital networks from potential attacks.P0https://nvd.nist.gov/vuln/detail/CVE-2025-40551https://nvd.nist.gov/vuln/detail/CVE-2025-40551Tue, 03 Feb 2026 00:00:00 +0000SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication. | SolarWinds Web Help DeskP0https://nvd.nist.gov/vuln/detail/CVE-2025-52691https://nvd.nist.gov/vuln/detail/CVE-2025-52691Mon, 26 Jan 2026 00:00:00 +0000SmarterTools has a critical vulnerability that allows unauthorized users to upload files to the mail server, which could lead to serious security issues, including remote code execution. There is currently no information on whether a patch is available. It is recommended to monitor your mail server closely and implement additional security measures until a fix is released.P0https://nvd.nist.gov/vuln/detail/CVE-2026-1281https://nvd.nist.gov/vuln/detail/CVE-2026-1281Thu, 29 Jan 2026 00:00:00 +0000Ivanti Endpoint Manager Mobile has a critical vulnerability that allows unauthorized users to execute code remotely. A patch is available to fix this issue. It is crucial for you to apply the patch immediately to protect our systems from potential attacks.P0https://nvd.nist.gov/vuln/detail/CVE-2008-0015https://nvd.nist.gov/vuln/detail/CVE-2008-0015Tue, 17 Feb 2026 00:00:00 +0000Microsoft has identified a critical vulnerability in the Active Template Library that affects multiple versions of Windows, allowing remote attackers to execute unauthorized code. A patch is not available for this issue, so it's crucial to limit exposure by disabling the affected ActiveX control if it is not essential for operations. Further steps should be taken to monitor and protect affected systems from potential attacks.P0