Vulnerability Assurance / Intelligence
Analysis of CVE-2025-64328, an OS command injection vulnerability in the Sangoma FreePBX Endpoint Manager that allows authenticated users to gain remote system access as an asterisk user.
Read analysis →Analysis of a known exploited Server-Side Request Forgery vulnerability in GitLab Community and Enterprise Editions affecting the CI Lint API.
Read analysis →A code injection vulnerability in Ivanti Endpoint Manager Mobile (EPMM) allows for unauthenticated remote code execution. Defenders must prioritize vendor mitigations and conduct compromise assessments on internet-facing instances.
Read analysis →An authentication bypass vulnerability in multiple Fortinet products allows attackers with a FortiCloud account to access devices registered to other accounts when SSO is enabled.
Read analysis →Analysis of CVE-2026-21509, a security feature bypass vulnerability in Microsoft Office affecting multiple versions, including those nearing or at end-of-life.
Read analysis →A critical argument injection vulnerability in GNU InetUtils telnetd allows remote authentication bypass via the USER environment variable. This analysis details exposure paths and verification of remediation.
Read analysis →An authentication bypass in the SmarterMail password reset API allows unauthenticated attackers to reset administrator passwords, leading to full system compromise. This vulnerability is currently leveraged by ransomware campaigns.
Read analysis →Analysis of CVE-2025-52691 in SmarterTools SmarterMail, a vulnerability allowing unauthenticated arbitrary file upload and potential remote code execution currently utilized in ransomware campaigns.
Read analysis →An integer overflow in the Linux Kernel's create_elf_tables() function may allow local unprivileged users to escalate privileges via SUID binaries. This analysis focuses on identifying affected assets and verifying vendor-specific remediation.
Read analysis →Understand exposure, prioritize the response, and define evidence for the outcome.