CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The vulnerability in Access Manager relies on per-request verification of the originating IP address instead of session tokens or cookies. Once an authentication request from a given IP succeeds, that IP is treated as authenticated with no other session data stored. An attacker can spoof the IP of a logged-in user to gain access to the Access Manager web interface.
The Access Manager uses the open-source CompactWebServer written in C#, which is vulnerable to path traversal. An attacker can access files on the system without authentication, including the SQLite database with badge information and PIN codes. Additionally, certain requests crash the server for about 60 seconds, which can be abused for denial of service.
The Access Manager offers a trace functionality for debugging, implemented as a simple TCP socket. Debug data is permanently broadcasted on this socket without any authentication or encryption. The verbosity level can be set via HTTP(S) endpoint with the service interface password or via SOAP interface with a guessable device identifier.
A local privilege escalation vulnerability has been identified in the Kaba exos 9300 System management application (d9sysdef.exe). It allows specifying an arbitrary executable and the weekday and start time when it should be run with SYSTEM privileges.
The vulnerability in Exos 9300 involves a randomly generated database password for MSSQL, derived from static random values concatenated with the hostname and a random string readable from the registry by any user. This allows an attacker to derive the password and gain authenticated access to the central database as user Exos9300Common.
An RPC service in exos 9300, run by FSMobilePhoneInterface.exe, is reachable on port 4000 and requires no authentication. This allows sending arbitrary status information, e.g., about door contacts, without prior login.
An out-of-bounds write vulnerability in Apache Hadoop HDFS native client. Affects Apache Hadoop from 3.2.0 before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue.
System Portalu Jednolitego Logowania opracowany przez WellChoose zawiera podatność na wstrzykiwanie poleceń systemu operacyjnego, co pozwala uwierzytelnionym zdalnym atakującym na wstrzykiwanie dowolnych poleceń OS i ich wykonanie na serwerze.
System Portalu Jednolitego Logowania opracowany przez WellChoose zawiera podatność na wstrzykiwanie poleceń systemu operacyjnego, co pozwala uwierzytelnionym zdalnym atakującym na wstrzykiwanie dowolnych poleceń OS i ich wykonywanie na serwerze.
W systemie Online Examination System w wersji 1.0 odkryto podatność, która dotyczy nieznanej funkcjonalności pliku /index.php w komponencie strony logowania. Manipulacja argumentem User prowadzi do wstrzyknięcia SQL, co umożliwia zdalne przeprowadzenie ataku.
Wtyczka AhaChat Messenger Marketing dla WordPressa w wersji do 1.1 nie sanitizuje i nie ucieka parametru przed jego wyświetleniem na stronie, co prowadzi do podatności na odzwierciedlone ataki Cross-Site Scripting (XSS). Atak ten może być wykorzystany przeciwko użytkownikom o wysokich uprawnieniach, takim jak administratorzy.
A flaw has been found in Tenda AC23 16.03.07.52. It impacts an unknown function of the file /goform/WifiExtraSet. Manipulation of the argument wpapsk_crypto causes buffer overflow. Remote exploitation is possible, and the exploit has been published and may be used.
W systemie zarządzania bezpieczeństwem operacyjnym i konserwacyjnym Sangfor do wersji 3.0.12 zidentyfikowano podatność. Problem dotyczy nieznanej funkcji w pliku /fort/audit/get_clip_img, co prowadzi do możliwości wstrzyknięcia poleceń poprzez manipulację argumentem frame/dirno.
W jądrze systemu Linux zidentyfikowano podatność związaną z niezgodnością dev_id podczas zwalniania przerwań w funkcji octep_vf_request_irqs(). Błąd ten może prowadzić do sytuacji, w której obsługiwacze przerwań pozostają aktywne, nawet gdy ioq_vector zostanie zwolniony, co może skutkować błędem use-after-free lub awarią systemu.
W jądrze systemu Linux zidentyfikowano podatność, która występuje w kontekście DAMON. Problem polega na tym, że po wywołaniu funkcji damon_call() w nieaktywnym kontekście, obiekt damon_call_control pozostaje powiązany z listą call_controls, co prowadzi do sytuacji use-after-free, gdy obiekt zostanie zwolniony.
A use-after-free vulnerability was found in the Linux kernel's inet6_addr_del() function for IPv6. The bug was introduced by accidentally moving ipv6_del_addr() before reading ifp->flags for temporary addresses, leading to use of freed memory.
In the Linux kernel, the __ip6_tnl_rcv() function for IPv6 tunnels lacked proper handling of VLAN-encapsulated frames, leading to use of uninitialized memory. The issue was reported by syzbot and manifested as a KMSAN bug in the ECN decapsulation logic.
A vulnerability in the Linux kernel has been fixed in the qfq_change_class() function, which could lead to use-after-free (UAF) errors. The issue was related to improper freeing of an existing class in the event of an error.
A vulnerability has been identified in the Linux kernel that leads to NULL pointer dereferences in the nvmet_tcp_build_pdu_iovec function. This issue occurs when command data structures are not properly initialized before processing H2C_DATA PDUs.
A vulnerability has been identified and resolved in the Linux kernel. The issue pertains to the j1939_xtp_rx_rts_session_active() function, which does not deactivate the session upon receiving the second RTS, leading to a reference count leak for j1939_session.