CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Deployments of Apache Solr 5.3.0 through 9.10.0 that rely on Solr's "Rule Based Authorization Plugin" are vulnerable to allowing unauthorized access to certain Solr APIs, due to insufficiently strict input validation in those components. Only deployments that meet all of the following criteria are impacted: use of the RuleBasedAuthorizationPlugin, a config with multiple roles, a permission list using one or more of the predefined permission rules (config-read, config-edit, schema-read, metrics-read, security-read), no "all" permission defined, and a networking setup that allows unfiltered requests to Solr.
Instalator Agentów ServerView dla systemu Windows dostarczany przez Fsas Technologies Inc. może niebezpiecznie ładować biblioteki Dynamic Link. W momencie uruchomienia instalatora może zostać wykonany dowolny kod z uprawnieniami administratora.
EVerest to oprogramowanie do ładowania pojazdów elektrycznych. W wersjach 2025.9.0 i wcześniejszych, atakujący może wyczerpać pamięć systemu operacyjnego, inicjując nieograniczoną liczbę połączeń TCP, co prowadzi do zakończenia działania modułu.
A vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. It is easily exploitable by a high privileged attacker with logon to the infrastructure where VirtualBox executes. Successful attacks can result in takeover of VirtualBox, and may significantly impact additional products (scope change). CVSS 3.1 Base Score is 8.2.
A vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. It is easily exploitable by a high privileged attacker with logon to the infrastructure where VirtualBox executes. Successful attacks can result in unauthorized creation, deletion or modification of data, unauthorized access to data, and partial denial of service. CVSS 3.1 Base Score is 8.1.
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. A high-privileged attacker with local access can take over VirtualBox, and the attack may impact other products (scope change).
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. A high-privileged attacker with local access can take over VirtualBox, and the attack may impact other products (scope change).
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. An unauthenticated attacker with local access can cause a hang or frequently repeatable crash (complete DoS) of VirtualBox. This vulnerability applies to Windows VMs only.
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. A high-privileged attacker with local access can take over VirtualBox, but exploitation is difficult. The attack may impact other products (scope change).
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. A high-privileged attacker with local access can take over VirtualBox, but exploitation is difficult. The attack may impact other products (scope change).
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. An unauthenticated attacker with access to the physical communication segment attached to the hardware where VirtualBox executes can take over VirtualBox. Exploitation is difficult.
Vulnerability in Oracle Business Intelligence Enterprise Edition (Oracle Analytics Cloud component) affects versions 7.6.0.0.0 and 8.2.0.0.0. A low-privileged attacker with local access to the infrastructure can exploit this flaw to unauthorizedly create, delete, or modify data, as well as gain complete access to data.
Podatność w produkcie Oracle FLEXCUBE Investor Servicing, dotycząca systemu zarządzania bezpieczeństwem. Dotknięte wersje to 14.5.0.15.0, 14.7.0.8.0 oraz 14.8.0.1.0. Atakujący z niskimi uprawnieniami, mający dostęp do sieci przez HTTP, może łatwo wykorzystać tę podatność.
Vulnerability in Oracle Hospitality OPERA 5 (Opera Servlet component) allows an unauthenticated attacker with network access via HTTP to easily compromise the system. Successful attacks can result in unauthorized access to critical data or complete access to all OPERA 5 data, as well as unauthorized update, insert, or delete access to some data and partial denial of service.
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. It is difficult to exploit, requires high-privileged local access, but can lead to full takeover of VirtualBox. Attacks may impact additional products (scope change).
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. An attacker with high privileges and local access to the infrastructure can easily exploit this flaw, potentially leading to takeover of Oracle VM VirtualBox. The vulnerability has a scope change, meaning attacks may also impact additional products.
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. A high-privileged attacker with local access can compromise VirtualBox, potentially impacting additional products (scope change).
A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition (component: Security) allows an unauthenticated attacker with network access to cause a complete denial of service (DOS) via a hang or frequently repeatable crash. Affected versions include Java SE 8u471, 11.0.29, 17.0.17, 21.0.9, 25.0.1 and corresponding GraalVM versions.
Vulnerability in Oracle Agile PLM (component: User and User Group) in version 9.3.6. An unauthenticated attacker with network access via HTTP can easily compromise the system. Successful attack leads to unauthorized access to critical data or complete access to all Oracle Agile PLM data.
Vulnerability in the SQLcl component of Oracle Database Server affects versions 23.4.0-23.26.0. It is difficult to exploit but allows an unauthenticated attacker with local access to the infrastructure where SQLcl runs to compromise SQLcl. Successful attacks require human interaction from a person other than the attacker.