A critical vulnerability in Palo Alto Networks PAN-OS firewalls allows unauthenticated attackers to execute arbitrary code with root privileges. This issue is confirmed to be actively exploited in the wild. Admins should prioritize patching PA-Series and VM-Series appliances or restricting Authentication Portal access to trusted internal IP addresses immediately.

A privilege escalation vulnerability in the Linux kernel crypto subsystem is being actively exploited in the wild. This affects most major Linux distributions including Ubuntu, RHEL, and Amazon Linux, and requires an immediate kernel update to mitigate risk.

A critical authentication bypass vulnerability has been identified in cPanel, WHM, and WP Squared. Unauthenticated remote attackers can gain full access to the control panel. This vulnerability is confirmed to be under active exploitation in the wild and requires immediate patching.

Microsoft Windows Shell contains a protection mechanism failure being actively exploited in the wild. This vulnerability allows an attacker to perform spoofing over a network, and users should ensure their Windows systems are fully patched to the latest security update.

ConnectWise ScreenConnect is vulnerable to a path traversal flaw that can lead to remote code execution. This vulnerability is currently being exploited in the wild, and users are urged to update to version 23.9.8 or later immediately.

D-Link DIR-823X routers contain a command injection vulnerability in the /goform/set_prohibiting endpoint. This vulnerability is currently being exploited in the wild according to CISA, and users are advised to discontinue use of these potentially end-of-life devices or update immediately.

SimpleHelp remote support software (v5.5.7 and earlier) is being actively exploited via a Zip Slip vulnerability. Authenticated admin users can upload crafted zip files to achieve remote code execution on the server. CISA has confirmed active exploitation in the wild, making this a priority for any organization self-hosting SimpleHelp for remote support.

SimpleHelp remote support software contains a critical vulnerability allowing low-privileged technicians to escalate privileges to server administrator via malicious API key creation. This flaw is currently being exploited in the wild according to CISA, and users should update to a patched version immediately.

Samsung MagicINFO 9 Server is being actively exploited in the wild. A path traversal vulnerability allows attackers to write arbitrary files as system authority, which can be used to achieve remote code execution and full system compromise.

Marimo, a reactive Python notebook, has a critical pre-authentication remote code execution (RCE) vulnerability in its terminal WebSocket endpoint. Attackers can gain full shell access and execute arbitrary system commands without credentials. This vulnerability is being actively exploited in the wild, and users should update to version 0.23.0 immediately.