Security Advisories
Stay informed about the latest security vulnerabilities discovered by HawkTrace. Our research team continuously monitors and updates this database.
CVE-2025-53772 Microsoft IIS WebDeploy Remote Code Execution
Unsafe deserialization in msdeployagentservice and msdeploy.axd endpoints allows authenticated attackers to perform remote code execution through GZip + Base64 encoded payloads.
CVE-2024-12106 WhatsUp Gold Pre-Auth LDAP Password Theft
Pre-authentication LDAP injection vulnerability in WhatsUpGold authentication mechanism enables credential theft through malicious LDAP server configuration.
Microsoft SQL Server Smart Admin Agent RCE
TaskAgent mechanism in Microsoft.SqlServer.SmartAdmin can be abused to achieve remote code execution through Assembly.LoadFrom and reflection-based instantiation.
CVE-2025-59287 WSUS Remote Code Execution
Unsafe deserialization of AuthorizationCookie objects in WSUS GetCookie() endpoint allows unauthenticated remote code execution with SYSTEM privileges through BinaryFormatter.
CVE-2025-59287 WSUS Unauthenticated RCE
Unauthenticated remote code execution in WSUS through unsafe SoapFormatter deserialization in ReportEventBatch endpoint with specially crafted SOAP payloads.
Responsible Disclosure
HawkTrace follows responsible disclosure practices and works with vendors to ensure timely patches. Found a vulnerability? Contact us at security@hawktrace.com