0 spills in 2025 for Enterprise apps
Each square is a day. Tap one to see what spilled. Heat = critical 4, high 3, medium 2, low 1, update half.
Past orders
- highpatchedexploited Synacor Zimbra Collaboration Suite (ZCS): Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user. Added to CISA KEV on 2026-08-21 (federal deadline 2026-08-24).
- highpatchedexploited Oracle E-Business Suite Improper Privilege Management Vulnerability Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. Added to CISA KEV on 2026-07-15 (federal deadline 2026-07-18).
- criticalpatchedexploited Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools. Added to CISA KEV on 2026-06-12 (federal deadline 2026-06-15).
- highpatchedexploited SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability SolarWinds Serv-U contains an uncontrolled resource consumption vulnerability that allows specially crafted POST requests using the Content-Encoding: deflate header to crash the Serv-U service without authentication. Added to CISA KEV on 2026-06-05 (federal deadline 2026-06-19).
- highpatchedexploited Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that could allow attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information. Added to CISA KEV on 2026-04-20 (federal deadline 2026-04-23).
- highpatchedexploited Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability in the Classic UI where attackers could abuse Cascading Style Sheets (CSS) @import directives in email HTML. Added to CISA KEV on 2026-03-18 (federal deadline 2026-04-01).
- criticalpatchedexploited SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability SolarWinds Web Help Desk contain a deserialization of untrusted data vulnerability in AjaxProxy that could allow an attacker to run commands on the host machine. Added to CISA KEV on 2026-03-09 (federal deadline 2026-03-12).
- highpatchedexploited RoundCube Webmail Deserialization of Untrusted Data Vulnerability RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php. Can be chained with CVE-2025-68461. Added to CISA KEV on 2026-02-20 (federal deadline 2026-03-13).
- highpatchedexploited Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery vulnerability if WebEx zimlet installed and zimlet JSP is enabled. Added to CISA KEV on 2026-02-17 (federal deadline 2026-03-10).
- highpatchedexploited SolarWinds Web Help Desk Security Control Bypass Vulnerability SolarWinds Web Help Desk contains a security control bypass vulnerability that could allow an unauthenticated attacker to gain access to certain restricted functionality. Added to CISA KEV on 2026-02-12 (federal deadline 2026-02-15).
- criticalpatchedexploited SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a malicious HTTP server which serves the malicious OS command and could lead to command execution. Added to CISA KEV on 2026-02-05 (federal deadline 2026-02-26).
- highpatchedexploited SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication. Added to CISA KEV on 2026-02-03 (federal deadline 2026-02-06).
- criticalpatchedexploited SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability SmarterTools SmarterMail contains an unrestricted upload of file with dangerous type vulnerability that could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution. Can be chained with CVE-2026-23760. Added to CISA KEV on 2026-01-26 (federal deadline 2026-02-16).
- highpatchedexploited Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability Synacor Zimbra Collaboration Suite (ZCS) contains a PHP remote file inclusion vulnerability that could allow for remote attackers to craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory. Added to CISA KEV on 2026-01-22 (federal deadline 2026-02-12).
Follow Enterprise apps
RSS: /feed.xml?stack=erp. JSON: /incidents.json?stack=erp. Or add it to your usual for delivery.