CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.03)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory.
A vulnerability in the Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, known as SAP Security Note 2256846.
Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries.
Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect availability via vectors related to JAXP.
Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66, and Java SE Embedded 8u65 allows remote authenticated users to affect confidentiality via vectors related to JMX.
Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect integrity via unknown vectors related to Networking.
Funkcja resend_bytes w pliku roaming_common.c w kliencie OpenSSH w wersjach 5.x, 6.x i 7.x przed 7.1p2 umożliwia zdalnym serwerom uzyskanie wrażliwych informacji z pamięci procesu poprzez żądanie przesłania całego bufora, co może prowadzić do odczytu prywatnego klucza.
Multiple Microsoft Office products (including Office 2007, 2010, 2013, 2016, Excel, PowerPoint, Visio, Word, and Visual Basic 6.0 Runtime) allow remote attackers to bypass the ASLR protection mechanism via unspecified vectors.
Microsoft SharePoint Server 2013 SP1 and SharePoint Foundation 2013 SP1 allow remote authenticated users to bypass intended Access Control Policy restrictions and conduct cross-site scripting (XSS) attacks by modifying a webpart, aka "Microsoft SharePoint Security Feature Bypass," a different vulnerability than CVE-2015-6117.
Microsoft SharePoint Server 2013 SP1 and SharePoint Foundation 2013 SP1 allow remote authenticated users to bypass intended Access Control Policy restrictions and conduct cross-site scripting (XSS) attacks by modifying a webpart. This is known as "Microsoft SharePoint Security Feature Bypass" and is different from CVE-2016-0011.
Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof servers by triggering a collision.
Przepełnienie bufora oparte na stercie w ARM mbed TLS (wcześniej PolarSSL) w wersjach 1.3.x przed 1.3.14 oraz 2.x przed 2.1.2 pozwala zdalnym serwerom SSL na spowodowanie odmowy usługi (awaria klienta) oraz potencjalne wykonanie dowolnego kodu poprzez długą nazwę biletu sesji w rozszerzeniu biletu sesji, które nie jest prawidłowo obsługiwane podczas tworzenia wiadomości ClientHello w celu wznowienia sesji.
Wykryto przepełnienie bufora w stercie w PolarSSL 1.x przed wersją 1.2.17 oraz ARM mbed TLS (wcześniej PolarSSL) 1.3.x przed wersją 1.3.14 i 2.x przed wersją 2.1.2. Atakujący może wykorzystać długi hostname w rozszerzeniu SNI, co prowadzi do awarii klienta i potencjalnego wykonania dowolnego kodu.
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect availability via vectors related to JAXP. This is a different vulnerability than CVE-2015-4803 and CVE-2015-4893.
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via vectors related to RMI.
An unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to Deployment.
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect availability via vectors related to JAXP. This is a different vulnerability than CVE-2015-4803 and CVE-2015-4911.
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect availability via vectors related to CORBA.
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect integrity via unknown vectors related to Security.
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via vectors related to JAXP.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS