Forwarded from TWCERTCC-200-202605-00000010

【CVE-2026-0300】Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability (CVSS v3.1: 9.8)
【Whether exploited by ransomware: Unknown】 Palo Alto Networks’ PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal service. An unauthenticated attacker can execute arbitrary code with root privileges on PA-Series and VM-Series firewalls by sending specially crafted packets.

【CVE-2026-6973】Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability (CVSS v3.1: 7.2)
【Whether exploited by ransomware: Unknown】 Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vulnerability. A remote authenticated user with administrator privileges can exploit this vulnerability to achieve remote code execution.

【CVE-2026-42208】BerriAI LiteLLM SQL Injection Vulnerability (CVSS v3.1: 9.8)
【Whether exploited by ransomware: Unknown】 BerriAI LiteLLM contains an SQL injection vulnerability. An attacker can exploit this vulnerability to read data from the proxy server’s database and may perform tampering, resulting in unauthorized access to the proxy server and the credentials it manages.

Information Sharing Level: WHITE (The information content is information that may be publicly disclosed)

[Reference]