CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A memory corruption vulnerability in WebKit, fixed in iOS 12.5.4, may allow arbitrary code execution when processing malicious web content. Apple is aware of active exploitation.
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.
A Use After Free vulnerability in Adobe Acrobat Reader DC affects versions 2021.001.20150 and earlier, 2020.001.30020 and earlier, and 2017.011.30194 and earlier. An unauthenticated attacker could leverage this to achieve arbitrary code execution in the context of the current user, but requires user interaction to open a malicious file.
Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication.
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance.
A vulnerability in the october/system package of October CMS allows an attacker to request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5.
A deserialization issue in Apple systems, fixed in Security Update 2021-005 Catalina, iOS 12.5.5, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, and watchOS 7.6.2, may allow a sandboxed process to circumvent sandbox restrictions. Apple is aware of active exploitation.
A buffer overflow issue in Apple systems, fixed in iOS 15.2 and iPadOS 15.2, may allow an application to execute arbitrary code with kernel privileges.
Wykryto przepełnienie całkowitoliczbowe, które zostało naprawione dzięki poprawionej walidacji wejścia. Problem ten został rozwiązany w tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2, iPadOS 15.2 oraz watchOS 8.3.
An out-of-bounds write issue in Apple systems, fixed in iOS 14.8.1 and iPadOS 14.8.1, and iOS 15.1 and iPadOS 15.1, may allow a malicious application to execute arbitrary code with kernel privileges.
A memory corruption issue in Apple systems, fixed in iOS 15.0.2 and iPadOS 15.0.2, macOS Monterey 12.0.1, iOS 14.8.1 and iPadOS 14.8.1, tvOS 15.1, watchOS 8.1, and macOS Big Sur 11.6.1, may allow an application to execute arbitrary code with kernel privileges. Apple is aware of active exploitation.
A type confusion issue in Apple systems, fixed in iOS 12.5.5, iOS 14.4 and iPadOS 14.4, macOS Big Sur 11.2, and security updates, may allow a malicious application to execute arbitrary code with kernel privileges. Apple is aware of exploits in the wild.
An integer overflow issue in Apple systems, fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, and watchOS 7.6.2, may lead to arbitrary code execution when processing a maliciously crafted PDF. Apple is aware of active exploitation.
A use-after-free vulnerability in WebKit, fixed by improved memory management. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker with sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
Realtek Jungle SDK versions v2.x through v3.4.14B includes an HTTP web server exposing a management interface (webs or boa) that is affected by multiple stack buffer overflows and arbitrary command execution flaws. The issues occur in functions such as formRebootCheck, formWsc, formWlanMultipleAP, formWlSiteSurvey, formStaticDHCP, and formSysCmd due to unsafe copying of parameters like submit-url, ifname, hostname, peerPin, and sysCmd. Successful exploitation allows remote attackers to achieve arbitrary code execution on the device.
Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affected by multiple memory corruption vulnerabilities and an arbitrary command injection vulnerability that can be exploited by remote unauthenticated attackers.
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1.
Sunhillo SureLine before 8.7.0.1.1 allows Unauthenticated OS Command Injection via shell metacharacters in ipAddr or dnsAddr /cgi/networkDiag.cgi.
An elevation of privilege vulnerability in the Windows Update Medic Service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS