Loading story…
A critical deserialization vulnerability (CVE-2025-6544) in H2O-3 versions <= 3.46.0.8 enables remote attackers to read arbitrary files and execute code. The flaw is due to improper handling of JDBC connection parameters, which can be exploited by bypassing input validation using double URL encoding. All users of affected versions are at risk and should update to version 3.46.0.9 or later.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
National and regional defenders including the Canadian Centre for Cyber Security and CERT-EU published advisories warning about the critical SolarWinds Web Help Desk vulnerability. These notices amplified remediation guidance following SolarWinds' hotfix release.
The Zero Day Initiative published advisory ZDI-25-906 covering the AjaxProxy deserialization of untrusted data vulnerability in SolarWinds Web Help Desk. The advisory publicly documented the technical class of the bug and its remote code execution impact.
On or before September 23, 2025, SolarWinds released Web Help Desk 12.8.7 Hotfix 1 to address CVE-2025-26399, a critical 9.8-severity remote code execution vulnerability affecting version 12.8.7 and earlier. The company said there was no evidence of active exploitation in the wild and urged customers to upgrade.
An anonymous researcher working with Trend Micro's Zero Day Initiative reported CVE-2025-26399, an unauthenticated AjaxProxy deserialization flaw in SolarWinds Web Help Desk. SolarWinds said the issue bypasses the prior fix for CVE-2024-28988, which itself bypassed CVE-2024-28986.
Shortly after disclosure, CISA added CVE-2024-28986 to its Known Exploited Vulnerabilities catalog, indicating confirmed exploitation of the earlier Web Help Desk flaw. Public details of that exploitation were not disclosed in the referenced coverage.
SolarWinds originally patched the Web Help Desk remote code execution flaw CVE-2024-28986 in August 2024. Later reporting says this bug was subsequently exploited and became the basis for later patch-bypass issues.
13 references tracked. Mallory keeps watching after this page renders.
thecyberexpress.com
Open sourcecert.europa.eu
Open sourcesecurityaffairs.com
Open sourcescworld.com
Open sourcezerodayinitiative.com
Open sourcebleepingcomputer.com
Open sourcecisecurity.org
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Metabase disclosed **CVE-2026-59827**, a critical unsafe deserialization vulnerability that can lead to remote code execution on the Metabase server when instances use an H2 database connection, including the default sample database. The flaw allows an authenticated user with permission to run native H2 queries to return query result columns of type `OTHER`, causing Metabase to deserialize arbitrary Java objects. The issue carries a **CVSS 9.9** rating and affects versions `1.58.0` through before `1.58.15`, `1.59.0` through before `1.59.12`, `1.60.0` through before `1.60.6.3`, and `1.61.0` through before `1.61.1.4`. A related Metabase code change in the H2 database driver shows the remediation path: the application now checks JDBC result metadata and rejects columns typed as `JAVA_OBJECT` instead of attempting to parse them. That defensive change blocks unsafe handling of serialized Java objects in H2 query results and aligns with the vendor fixes released in versions `1.58.15`, `1.59.12`, `1.60.6.3`, and `1.61.1.4`.
Jul 10, 2026
A critical remote code execution vulnerability, identified as CVE-2025-37164 and assigned a maximum CVSS score of 10.0, has been discovered in HPE OneView. The flaw allows unauthenticated attackers to execute arbitrary code remotely, potentially granting them total control over data center infrastructure managed by affected HPE OneView deployments. The vulnerability is remotely exploitable and does not require authentication, significantly increasing the risk to organizations using this management platform. Security advisories highlight the severity of the issue, noting that exploitation could lead to full compromise of data center environments. While specific affected versions have not yet been detailed, organizations are urged to monitor official HPE communications and apply mitigations or patches as soon as they become available to prevent unauthorized access and potential disruption of critical infrastructure.
Jun 29, 2026
A critical remote code execution vulnerability, tracked as CVE-2025-61913, has been identified in Flowise, a drag-and-drop user interface for building customized large language model flows. The flaw exists in versions prior to 3.0.8 and is caused by insufficient restrictions in the WriteFileTool and ReadFileTool components, which fail to properly validate file path access. This oversight allows authenticated attackers to read and write arbitrary files to any location on the file system, significantly increasing the risk of remote code execution. The vulnerability has been assigned a CVSS score of 10.0, indicating its maximum severity and potential for exploitation. According to security advisories, the issue can be exploited remotely, making it a high-priority concern for organizations using affected versions of Flowise. The vulnerability was publicly disclosed on October 8, 2025, and a security update was released in version 3.0.8 to address the issue. Attackers leveraging this flaw could gain unauthorized access to sensitive files, modify system configurations, or deploy malicious payloads, potentially leading to full system compromise. The vulnerability affects all installations of Flowise prior to the patched version, though the exact list of affected products and vendors has not been fully enumerated. Security researchers emphasize the critical nature of the flaw due to the ease of exploitation and the broad impact on confidentiality, integrity, and availability. Organizations are strongly advised to upgrade to Flowise version 3.0.8 or later to mitigate the risk. The vulnerability was reported through GitHub security advisories, highlighting the importance of monitoring open-source project disclosures. No evidence of active exploitation in the wild has been reported as of the disclosure date, but the public availability of technical details increases the urgency for remediation. The flaw underscores the risks associated with insufficient input validation in file handling components of web applications. Security teams should review their deployment of Flowise and apply the necessary patches without delay. In addition to patching, organizations should audit access logs for signs of suspicious file operations that could indicate attempted exploitation. The incident serves as a reminder of the critical need for secure coding practices and regular vulnerability assessments in software development.
Jun 29, 2026