CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Podatność typu denial-of-service w komponencie Service Workers w DOM. Została naprawiona w wersjach Firefox 147 i Thunderbird 147.
A use-after-free vulnerability was found in the IPC component of Firefox and Thunderbird. It is fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.
An integer overflow in the Graphics component of Firefox and Thunderbird allows a sandbox escape. The vulnerability is fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.
A sandbox escape vulnerability exists in the Graphics: CanvasWebGL component due to incorrect boundary conditions. This flaw was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.
This vulnerability allows bypassing security mechanisms in the DOM component of Firefox and Thunderbird. The flaw is fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.
A Cross-Site Scripting (XSS) vulnerability was found in the Lemonsoft WordPress add-on due to improper input neutralization during web page generation. This issue affects the add-on version 2025.7.1.
Wersje ManageEngine PAM360 przed 8202, Password Manager Pro przed 13221 oraz Access Manager Plus przed 4401 mają lukę w autoryzacji w funkcji inicjowania zdalnej sesji. Problem ten może prowadzić do nieautoryzowanego dostępu do systemów.
W wersjach Progress Flowmon ADS przed 12.5.4 i 13.0.1 występuje podatność na wstrzykiwanie SQL, która pozwala uwierzytelnionym użytkownikom na wykonywanie niezamierzonych zapytań i poleceń SQL.
A deserialization flaw in TYPO3's mail-file spool allows local users with write access to the spool directory to craft a malicious file that is deserialized during the mailer:spool:send command, enabling arbitrary PHP code execution on the web server. This affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22, and 14.0.0-14.0.1.
In TYPO3 CMS, backend users with access to the recycler module could delete arbitrary data from any database table defined in the TCA, regardless of their permissions to that table. This allowed attackers to purge and destroy critical site data, effectively rendering the website unavailable. This affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22, and 14.0.0-14.0.1.
A vulnerability has been identified in SIMATIC ET 200AL, ET 200MP, ET 200SP devices and various SIPLUS variants, which do not properly handle S7 protocol session disconnect requests. Upon receiving a valid Disconnect Request, the devices enter an improper session state.
A local privilege escalation vulnerability has been identified in TeleControl Server Basic (all versions before V3.1.2.4). This could allow an attacker to run arbitrary code with elevated privileges.
Nieautoryzowany zdalny atakujący może nakłonić użytkownika z wysokimi uprawnieniami do przesłania złośliwego ładunku przez punkt końcowy config-upload, co prowadzi do wstrzyknięcia kodu jako root. To skutkuje całkowitą utratą poufności, dostępności i integralności z powodu niewłaściwej kontroli generowania kodu.
A buffer overflow vulnerability exists in the device Search and Discovery feature of Hikvision NVR/DVR/CVR/IPC models. An attacker on the same LAN can send crafted packets to cause device malfunction.
A buffer overflow vulnerability exists in the device Search and Discovery feature of Hikvision Access Control Products. An attacker on the same local area network (LAN) could cause the device to malfunction by sending specially crafted packets to an unpatched device.
Aplikacja SAP Fiori do uzgadniania sald międzyfirmowych nie przeprowadza niezbędnych kontroli autoryzacji dla uwierzytelnionego użytkownika, co prowadzi do eskalacji uprawnień. Może to poważnie wpłynąć na poufność i integralność aplikacji.
W wyniku podatności na wstrzykiwanie poleceń systemowych w serwerze aplikacji SAP dla ABAP oraz SAP NetWeaver RFCSDK, uwierzytelniony atakujący z dostępem administracyjnym i sąsiednim dostępem do sieci mógłby przesłać specjalnie przygotowane treści na serwer. Jeśli treści te zostaną przetworzone przez aplikację, umożliwiają wykonanie dowolnych poleceń systemowych.
A Missing Authorization Check vulnerability in Application Server ABAP and ABAP Platform allows an authenticated attacker to misuse an RFC function to execute form routines (FORMs) in the ABAP system. Successful exploitation could allow writing or modifying data accessible via FORMs and invoking system functionality, resulting in high impact on integrity and availability, while confidentiality remains unaffected.
SAP HANA database is vulnerable to privilege escalation allowing an attacker with valid credentials of any user to switch to another user potentially gaining administrative access. This could result in a total compromise of the system's confidentiality, integrity, and availability.
OpenCode, an open source AI coding agent, prior to version 1.0.216 automatically starts an unauthenticated HTTP server that allows any local process (or any website via permissive CORS) to execute arbitrary shell commands with the user's privileges. This vulnerability is fixed in version 1.0.216.