Loading story…
A high-severity path traversal vulnerability (CVE-2025-10203) has been identified in Digilent WaveForms versions 3.24.3 and earlier. Exploitation requires a user to open a specially crafted .DWF3WORK file, potentially allowing attackers to execute arbitrary code. Digilent has released version 3.24.4 to address this issue and users are advised to update immediately and avoid opening untrusted files.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
2 references tracked. Mallory keeps watching after this page renders.
zerodayinitiative.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Dassault Systèmes disclosed **CVE-2026-10094**, a critical path traversal flaw in **SOLIDWORKS Visualize** that affects versions shipped with **SOLIDWORKS Desktop Release 2024 through Release 2026**. The vulnerability is rated **CVSS 9.8** and is described as **remotely exploitable**, with successful attacks allowing an attacker to write arbitrary files on the server. The vendor advisory and vulnerability tracking data indicate the issue could let remote attackers abuse file path handling to place files outside intended directories, creating a serious risk for systems running affected releases. Organizations using SOLIDWORKS Visualize should update to the latest vendor-fixed version, apply available patches, restrict file system permissions, and validate file path inputs where possible.
Jun 29, 2026
WaveStore Server software was found to contain several high-severity vulnerabilities related to improper path validation in scripts accessible via the WaveView client. Attackers with high privileges could exploit these flaws to execute arbitrary operating system commands or read and delete files on the server. Specifically, CVE-2025-65074 allows OS command injection through path traversal in the `showerr` script, while CVE-2025-65076 enables arbitrary file read and deletion via the `ilog` script, which runs with root privileges. All vulnerabilities affect versions prior to 6.44.44, and have been addressed in that release. CERT Polska coordinated the disclosure of these vulnerabilities, which stem from the WaveView client’s ability to execute a restricted set of predefined commands and scripts on the connected server. The vulnerabilities are classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), and pose significant risks if exploited, including full compromise of server confidentiality and integrity. Organizations using WaveStore Server are strongly advised to update to version 6.44.44 or later to mitigate these threats.
Jun 29, 2026
A critical path traversal vulnerability (CVE-2024-48510) has been identified in Rockwell Automation's AADvance-Trusted SIS Workstation, specifically affecting versions 2.00.00 to 2.00.04. The flaw, rooted in the DotNetZip library (v1.16.0 and earlier), could allow a remote attacker to execute arbitrary code if a victim opens a malicious file, potentially compromising safety instrumented system (SIS) applications used in critical manufacturing sectors. The vulnerability is rated high severity, with a CVSS v4 score of 8.6, and exploitation requires user interaction but is considered low complexity and remotely exploitable. Rockwell Automation discovered the issue during internal testing and reported it to CISA, emphasizing their commitment to transparency and product security. The company has released a security advisory confirming the vulnerability, noting that it has been corrected and that no known exploitation has occurred in the wild. Organizations using affected SIS Workstation versions are urged to apply available mitigations to prevent potential remote code execution attacks targeting critical infrastructure environments worldwide.
Jun 29, 2026