CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Nieprawidłowa implementacja algorytmu uwierzytelniania w Ivanti vTM, z wyjątkiem wersji 22.2R1 lub 22.7R2, umożliwia zdalnemu, nieautoryzowanemu atakującemu ominięcie uwierzytelnienia panelu administracyjnego.
A security feature bypass vulnerability exists in Windows Mark of the Web. It could allow execution of untrusted files without warnings.
A vulnerability in the Windows Ancillary Function Driver for WinSock allows for elevation of privilege on Windows systems. The NVD description does not provide technical details or required user interaction.
A vulnerability in Microsoft Project allows for remote code execution. The NVD description does not provide technical details or attack vectors.
A vulnerability in the Scripting Engine involves memory corruption. The NVD description does not provide technical details or attack vectors.
A vulnerability in the Windows Power Dependency Coordinator allows for elevation of privilege on Windows systems. The NVD description does not provide technical details or required user interaction.
A vulnerability in the Windows Kernel allows for elevation of privilege. The NVD description does not provide technical details or required user interaction.
A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could allow an authenticated attacker with administrative privilege to conduct an argument injection attack, due to insufficient parameter sanitization during the boot process.
A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface in Zimbra Collaboration (ZCS) 9.0 and 10.0. An attacker can send an email with a crafted calendar header containing an XSS payload, which executes in the victim's session.
ThreatSonar Anti-Ransomware od TeamT5 nieprawidłowo weryfikuje zawartość przesyłanych plików. Zdalni atakujący z uprawnieniami administratora na platformie produktu mogą przesyłać złośliwe pliki, które mogą być wykorzystane do wykonania dowolnych poleceń systemowych na serwerze.
W podatności CVE-2024-7399 w serwerze Samsung MagicINFO 9 w wersjach przed 21.1050 występuje niewłaściwe ograniczenie ścieżki do zastrzeżonego katalogu, co pozwala atakującym na zapis dowolnych plików z uprawnieniami systemowymi.
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.
Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).
Remote command execution due to use of default passwords in Acronis Cyber Infrastructure. Affects versions before builds 5.0.1-61, 5.1.1-71, 5.2.1-69, 5.3.1-53, and 5.4.4-132.
Podatność w produkcie Oracle WebLogic Server w ramach Oracle Fusion Middleware (komponent: Core) dotyczy wersji 12.2.1.4.0 oraz 14.1.1.0.0. Łatwo eksploatowalna podatność pozwala nieautoryzowanemu atakującemu z dostępem do sieci na kompromitację Oracle WebLogic Server.
Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access. Configuration secrets, credentials, and other data imported into Expedition are at risk.
ServiceNow has addressed an input validation vulnerability in Washington DC, Vancouver, and earlier Now Platform releases. This could enable an unauthenticated user to remotely execute code within the context of the Now Platform.
ServiceNow has addressed an input validation vulnerability in Vancouver and Washington DC Now Platform releases. This could enable an unauthenticated user to remotely execute code within the context of the Now Platform.
A vulnerability in the Windows MSHTML Platform allows for spoofing. The NVD description does not provide technical details or attack vectors.
A vulnerability in Microsoft SharePoint allows for remote code execution. The NVD description does not provide technical details or attack vectors.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS