CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in GitLab CE/EE from version 11.9 allows remote code execution due to improper validation of image files passed to a parser.
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing a malicious image.
Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host.
The overlayfs implementation in the Linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.
A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application.
Win32k Elevation of Privilege Vulnerability.
Vulnerability in SonicWall Email Security version 10.0.9.x allows a post-authenticated attacker to upload an arbitrary file to the remote host.
A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.
This issue was addressed by improved management of object lifetimes. The issue is fixed in iOS 12.5.2, iOS 14.4.2, iPadOS 14.4.2, and watchOS 7.3.3, and processing maliciously crafted web content may lead to universal cross-site scripting. Apple is aware of a report that this issue may have been actively exploited.
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution.
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution.
A type confusion issue exists in Apple products (macOS, iOS, iPadOS, watchOS, tvOS, Safari) due to improper state handling. Processing maliciously crafted web content may lead to arbitrary code execution.
A race condition exists in Apple products (macOS, iOS, iPadOS, watchOS, tvOS) due to improper locking. A malicious application may be able to elevate privileges. Apple is aware of reports that this issue may have been actively exploited.
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI normalization, which may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may theoretically allow bypass of URL based access control or remote code execution (RCE).
A Server Side Request Forgery (SSRF) vulnerability in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the API to perform an SSRF attack to steal administrative credentials.
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 and BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2, the iControl REST interface has an unauthenticated remote command execution vulnerability.
An improper boundary check in the DSP driver prior to SMR Mar-2021 Release 1 allows out-of-bounds memory access.
A vulnerability in the DSP driver prior to SMR Mar-2021 Release 1 allows attackers to load arbitrary ELF libraries inside the DSP.
An incorrect implementation handling file descriptors in the dpu driver prior to SMR Mar-2021 Release 1 results in memory corruption leading to kernel panic.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS