CISA has updated its Known Exploited Vulnerabilities (KEV) Catalog to include four new flaws found in Microsoft, VMware, and Apple products that are currently being targeted by attackers.

Multiple security flaws have been discovered in CISA's Malcolm network traffic analysis tool. These vulnerabilities could allow unauthorized users to execute arbitrary code, bypass access controls, or disrupt services. Users are urged to update to the latest versions.

Microsoft has corrected documentation regarding an elevation of privilege vulnerability found in the Azure Connected Machine Agent. This issue allows a local user to potentially gain higher privileges on affected systems.

A security flaw in Siemens Simcenter Nastran and Femap software could allow an attacker to execute malicious code if a user opens a specially crafted file. Users are urged to update to version 2606 or later to fix this issue.

A critical security flaw has been identified in the Windows iSCSI Target service that could allow an attacker to run malicious code on a server without authorization.

A critical security flaw in Microsoft's IKE service allows attackers to remotely run malicious code on affected systems by exploiting a memory management error.

A security flaw in VMware vCenter software allows attackers to potentially run unauthorized commands on a system if they have network access.

A security vulnerability in Microsoft SharePoint allows attackers to bypass authentication measures over the network, potentially granting unauthorized access to the system.

A security vulnerability in Apple macOS allows unauthorized users on the same network to access the Screen Sharing feature without providing valid login credentials.

A security vulnerability in Microsoft Copilot could allow an unauthorized attacker to access sensitive information over a network by injecting malicious commands.

A security flaw in the Ray development tool could allow unauthorized attackers to execute malicious code on your computer through web browsers like Firefox and Safari.

A security vulnerability in the Windows Server network driver has been identified that could potentially allow an attacker to execute malicious code remotely. Microsoft has issued an update for this issue.

Apple has issued significant security updates for its operating systems, addressing 108 vulnerabilities. Users are encouraged to update their devices immediately to protect against potential exploits.

A security vulnerability in Microsoft Office's graphics component could allow an attacker to remotely execute malicious code on your computer if you open a specially crafted file.

Microsoft has released updated information regarding a security vulnerability that could allow an attacker to gain higher-level permissions on a computer system. This type of vulnerability is known as an elevation of privilege.