0 spills in 2025 for Enterprise apps
Each square is a day. Tap one to see what spilled. Heat = critical 4, high 3, medium 2, low 1, update half.
Past orders
- exploitedhighpatched Synacor Zimbra Collaboration Suite (ZCS): Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user. Added to CISA KEV on 2026-08-21 (federal deadline 2026-08-24).
- exploitedhighpatched Oracle E-Business Suite Improper Privilege Management Vulnerability Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. Added to CISA KEV on 2026-07-15 (federal deadline 2026-07-18).
- exploitedcriticalpatched Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools. Added to CISA KEV on 2026-06-12 (federal deadline 2026-06-15).
- exploitedhighpatched SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability SolarWinds Serv-U contains an uncontrolled resource consumption vulnerability that allows specially crafted POST requests using the Content-Encoding: deflate header to crash the Serv-U service without authentication. Added to CISA KEV on 2026-06-05 (federal deadline 2026-06-19).
- exploitedhighpatched Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that could allow attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information. Added to CISA KEV on 2026-04-20 (federal deadline 2026-04-23).
- exploitedhighpatched Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability in the Classic UI where attackers could abuse Cascading Style Sheets (CSS) @import directives in email HTML. Added to CISA KEV on 2026-03-18 (federal deadline 2026-04-01).
- exploitedcriticalpatched SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability SolarWinds Web Help Desk contain a deserialization of untrusted data vulnerability in AjaxProxy that could allow an attacker to run commands on the host machine. Added to CISA KEV on 2026-03-09 (federal deadline 2026-03-12).
- exploitedhighpatched RoundCube Webmail Deserialization of Untrusted Data Vulnerability RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php. Can be chained with CVE-2025-68461. Added to CISA KEV on 2026-02-20 (federal deadline 2026-03-13).
- exploitedhighpatched Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery vulnerability if WebEx zimlet installed and zimlet JSP is enabled. Added to CISA KEV on 2026-02-17 (federal deadline 2026-03-10).
- exploitedhighpatched SolarWinds Web Help Desk Security Control Bypass Vulnerability SolarWinds Web Help Desk contains a security control bypass vulnerability that could allow an unauthenticated attacker to gain access to certain restricted functionality. Added to CISA KEV on 2026-02-12 (federal deadline 2026-02-15).
- exploitedcriticalpatched SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a malicious HTTP server which serves the malicious OS command and could lead to command execution.
- exploitedhighpatched SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication. Added to CISA KEV on 2026-02-03 (federal deadline 2026-02-06).
- exploitedcriticalpatched SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability SmarterTools SmarterMail contains an unrestricted upload of file with dangerous type vulnerability that could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution. Can be chained with CVE-2026-23760.
- exploitedhighpatched Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability Synacor Zimbra Collaboration Suite (ZCS) contains a PHP remote file inclusion vulnerability that could allow for remote attackers to craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory.
Follow Enterprise apps
RSS: /feed.xml?stack=erp. JSON: /incidents.json?stack=erp. Or add it to your usual for delivery.