Advisory

Severity CRITICAL Threat Category Vulnerability – Remote Code Execution (unauthenticated) Affected Platforms PHP 8.2.x before 8.2.35, 8.3.x before 8.3.36, 8.4.x

Severity CRITICAL Threat Category Vulnerability – Remote Code Execution Affected Platforms Drupal core Field UI module: 8.9.0 to before 10.6.19,

Severity CRITICAL Threat Category Vulnerability – Authorization Bypass / Code Injection (CWE-94) Affected Platforms WordPress sites running the Avada (Fusion)

Severity CRITICAL Threat Category Vulnerability – OS Command Injection / Remote Code Execution (CWE-78) Affected Platforms Langflow (langflow-ai) self-hosted AI

Severity HIGH Threat Category Vulnerability – Stored Cross-Site Scripting (CWE-79) Affected Platforms WordPress sites running the WPS Limit Login plugin

Severity CRITICAL Threat Category Vulnerability – Authentication Bypass (CWE-304) Affected Platforms Proxmox Virtual Environment 7.0 – 7.4 and 8.0 with

Severity CRITICAL  Threat Category Vulnerability – Authentication Bypass/ Account Takeover Affected Platforms Keycloak 26.4.x (before 26.4.15), 26.6.x (before 26.6.6), 26.7.x

Severity CRITICAL Threat Category Vulnerability (SQL Injection, Potential Remote Code Execution) Affected Platforms GeoServer Application versions < 2.27.6, < 2.28.5,

Severity CRITICAL Threat Category Vulnerability (Remote Unauthenticated Code Execution) Affected Platforms Veeam ONE (versions 13.0.2.6723 and earlier Version 13 builds)

Critical “wp2shell” REST API Route Confusion and SQL Injection Vulnerabilities in WordPress Core Severity CRITICAL (CVSS 10.0) Threat Category Vulnerability