CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in the CLI of Cisco Catalyst SD-WAN devices (Controller, Manager, Validator) allows an authenticated local attacker with netadmin privileges to execute arbitrary commands as root by uploading a crafted file. The issue is due to insufficient input validation. Cisco has observed limited exploitation resulting in configuration changes on edge devices.
SolarWinds Serv-U is susceptible to specially crafted POST requests with Content-Encoding: deflate that crash the Serv-U service without authentication.
An OS Command Injection vulnerability in the API of Progress ADC products allows an unauthenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.
A vulnerability in Cisco Unified Communications Manager and Unified CM SME allows an unauthenticated remote attacker to perform SSRF attacks. The attacker can write files to the OS, potentially leading to root privilege escalation. WebDialer service must be enabled (disabled by default).
In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This leads to local escalation of privilege with no additional execution privileges needed and no user interaction.
Critical vulnerability in Oracle Payments (Oracle E-Business Suite) versions 12.2.3-12.2.15. An unauthenticated attacker with network access via HTTP can fully compromise the system without any privileges.
Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie.
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code remotely over a network.
Command Injection vulnerability in UniFi OS devices. Improper input validation allows an attacker with network access to execute arbitrary system commands.
Path Traversal vulnerability in UniFi OS devices. An attacker with network access can read system files and potentially gain access to a user account.
Improper Access Control vulnerability in UniFi OS devices. An attacker with network access can make unauthorized changes to the system.
A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents. The attack requires access to the server and prior administrative credentials.
Privilege escalation vulnerability in LiteSpeed User-End cPanel Plugin before version 2.4.5. An attacker can gain root privileges. The vulnerability is being actively exploited in the wild.
SQL Injection vulnerability in Drupal core. Improper neutralization of special elements in SQL commands allows an attacker to execute arbitrary SQL statements.
Microsoft Defender Denial of Service Vulnerability.
Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally.
Microsoft Exchange Server has an improper neutralization of input during web page generation, leading to a cross-site scripting vulnerability. This flaw allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-20182 identifies an issue with the authentication mechanism in Cisco Catalyst SD-WAN Controller, Manager, and Validator that allows an unauthenticated attacker to bypass authentication and gain administrative privileges. An attacker could exploit this vulnerability by sending crafted requests to the system.
CVE-2026-0257 describes authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software, allowing an attacker to bypass security restrictions and establish an unauthorized VPN connection.
W dniu 11 maja 2026 roku opublikowano 84 złośliwe wersje w 42 pakietach @tanstack/* w rejestrze npm. Atakujący wykorzystał trzy znane klasy podatności, aby opublikować złośliwe oprogramowanie kradnące dane uwierzytelniające pod zaufaną tożsamością.