Loading story…
INCIBE-CERT published alerts for two separate software weaknesses affecting Zervit portable HTTP/Web server and CivetWeb. The Zervit issue involves incorrect input validation, a class of flaw that can allow attackers to supply crafted input that is not properly sanitized or checked by the application, potentially leading to unintended behavior or further compromise depending on deployment and exposure.
A second alert covers an unquoted search path vulnerability in CivetWeb, a weakness commonly associated with insecure handling of executable paths on Windows systems and the risk of unintended program execution if an attacker can place malicious files in searched directories. The notices indicate that defenders using either product should review vendor guidance from INCIBE-CERT, identify affected installations, and prioritize patching or other mitigations where these components are exposed in production environments.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
INCIBE-CERT published an advisory about an unquoted search path vulnerability in CivetWeb. The reference does not provide further incident, exploitation, or remediation timeline details.
INCIBE-CERT published an advisory بشأن an incorrect input validation vulnerability affecting Zervit's portable HTTP/Web server. No additional technical details or earlier disclosure date are provided in the reference.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA added four vulnerabilities to its **Known Exploited Vulnerabilities (KEV) Catalog** based on evidence of active exploitation: **CVE-2025-31125** (Vite/Vitejs improper access control), **CVE-2025-34026** (Versa Concerto improper authentication), **CVE-2025-54313** (*eslint-config-prettier* embedded malicious code), and **CVE-2025-68645** (Synacor **Zimbra Collaboration Suite** PHP remote file inclusion). Under **Binding Operational Directive (BOD) 22-01**, U.S. Federal Civilian Executive Branch agencies must remediate KEV-listed issues by CISA’s specified due dates; CISA also urged all organizations to prioritize patching these KEV entries as part of routine vulnerability management. Reporting on the update highlighted technical risk details for several of the newly listed items, including an authentication bypass in **Versa Concerto** (reported as affecting versions 12.1.2 through 12.2.0) tied to a Traefik reverse-proxy misconfiguration that could expose administrative endpoints (including an internal Actuator endpoint with access to heap dumps and trace logs). It also described the supply-chain impact of the **eslint-config-prettier** malicious code issue, where installing affected versions can execute an `install.js` that launches Windows malware, and noted the **Zimbra** webmail flaw enabling unauthenticated file inclusion from the web root in affected 10.0/10.1 versions. Separately, CISA also published an ICS advisory for **EVMAPA** EV-charging infrastructure vulnerabilities, but that advisory is not part of the KEV-additions event.
Jun 29, 2026
A series of critical and high-severity vulnerabilities have been disclosed affecting a wide range of software products, including workflow automation tools, web applications, network devices, and desktop software. Notable issues include remote code execution (RCE) flaws in *n8n*, *Lilac-Reloaded for Nagios*, *FileZilla Client*, and *AVideo*, as well as privilege escalation vulnerabilities in products like *Versa SASE Client*, *AspEmail*, and *ActFax*. Several vulnerabilities allow unauthenticated attackers to upload arbitrary files, bypass authentication, or exploit weak session management, potentially leading to full system compromise or unauthorized access to sensitive data. Many of these vulnerabilities have public exploits available, increasing the risk of active exploitation in the wild. Vendors have released patches for several of the affected products, and administrators are strongly advised to update to the latest versions or apply recommended mitigations. The vulnerabilities span a variety of attack vectors, including buffer overflows, improper input validation, insecure file upload mechanisms, and misconfigured authentication endpoints. Organizations should prioritize patching systems exposed to the internet and review access controls to limit the impact of potential exploitation. Immediate attention is warranted for products with critical CVSS scores and those with known public exploits.
Jun 29, 2026
German CERT advisories identified **code execution vulnerabilities** in `vim`, the widely used text editor, in two separate notices. The advisories, `2026-0782` and `2026-0886`, both describe flaws that could allow an attacker to execute code, indicating ongoing security issues affecting the application. The notices provide limited public detail, but the repeated classification of the issue as code execution highlights potential risk for systems where `vim` is installed or used to process untrusted content. Organizations using `vim` should review the associated advisories, determine affected versions in their environments, and prioritize vendor patches or other mitigations as they become available.
Jun 29, 2026