Vulnerability intelligence

CVE-2025-8088 is a path traversal vulnerability affecting the Windows version of WinRAR. It allows attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild. It was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET. The vulnerability was exploited in phishing attacks to deliver RomCom malware. The attackers can trick the program into saving a file in a different location than the user intended, such as the computer's Startup folder. This allows the attackers to execute their own code. WinRAR patched the vulnerability in version 7.13.

CVE-2025-43529 is a use-after-free vulnerability in WebKit that can be exploited by processing maliciously crafted web content. Google's Threat Analysis Group discovered this flaw. Apple has released security updates for iOS, iPadOS, macOS, tvOS, watchOS, visionOS, and Safari to address this vulnerability, as it may have been exploited in targeted attacks against specific individuals using versions of iOS before iOS 26. Devices impacted include iPhone 11 and later, iPad Pro 12.9-inch (3rd generation and later), iPad Pro 11-inch (1st generation and later), iPad Air (3rd generation and later), iPad (8th generation and later), and iPad mini (5th generation and later).

CVE-2026-20700 is a memory corruption vulnerability found within Apple's `dyld` component, which is the Dynamic Link Editor responsible for loading dynamic libraries into memory and bridging application code with system frameworks. This flaw could enable an attacker with memory write capabilities to execute arbitrary code on affected devices. Apple addressed this issue through improved state management in updates for watchOS 26.3, tvOS 26.3, macOS Tahoe 26.3, visionOS 26.3, iOS 26.3, and iPadOS 26.3. Reports indicate that this vulnerability may have been exploited in "extremely sophisticated attacks" targeting specific individuals on versions of iOS preceding iOS 26. Google's Threat Analysis Group is credited with discovering and reporting the vulnerability.

The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.

CVE-2025-61624 is a path traversal vulnerability (CWE-22) affecting the command line interpreter (CLI) of several Fortinet products, including FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. The flaw stems from improper input validation, specifically involving unsanitized `system.auto-script` object names. This allows an authenticated attacker with administrative privileges and read-write permissions to escape restricted directories and write or delete arbitrary files on the underlying filesystem by executing crafted CLI commands. In real-world attacks, threat actors have exploited this vulnerability as a privilege-escalation vector to transition from restricted administrative access to root-level control over the underlying operating system. This exploit has been used in the wild to deploy PEERSTITCH, a stealthy, memory-resident ARM64 malware designed to evade traditional file-based detection. Fortinet addressed the vulnerability in April 2026, releasing patches for affected versions of FortiOS and other impacted products.

CVE-2026-21589 is a path traversal and arbitrary file access vulnerability that affects multiple self-hosted Atlassian Data Center and Server products, including Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. The flaw allows remote, unauthenticated attackers to access specific files within the web application's root directory. To successfully exploit the vulnerability, an attacker must know the exact name and path of the target file, as the flaw does not allow directory listing or file enumeration. The vulnerability impacts all versions of the affected products prior to their designated fixed releases. While Atlassian's cloud-based services are secure and require no action, organizations utilizing self-hosted deployments are advised to upgrade to the patched versions. For systems that cannot be immediately updated, recommended mitigations include taking internet-facing instances offline, deploying web application firewall (WAF) rules, or configuring URL rewriting rules to block directory traversal attempts containing double-dot (`../`) sequences.