CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An information disclosure vulnerability in Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0, affects the parameter "Addr" in cmd site. It allows sending requests to other systems, potentially revealing the real IP of the web server or increasing the attack surface.
NATS nats-server w wersjach przed 2.7.2 ma nieprawidłową kontrolę dostępu. Każdy uwierzytelniony użytkownik może uzyskać uprawnienia konta systemowego, wykorzystując funkcję 'dynamicznie przydzielanych kont sandboxowych'.
XMPie uStore version 12.3.7244.0 allows administrators to generate reports based on raw SQL queries. Since the application ships with default administrative credentials, an attacker may authenticate into the application and exfiltrate sensitive information from the database.
In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through uncontrolled resource consumption of memory.
A Cross-Site Request Forgery (CSRF) vulnerability exists on the web server that could lead to sensitive data leakage or unauthorized actions on the server while the user is logged in.
An issue was discovered in NvmExpressDxe in InsydeH2O with kernels 5.1 through 5.5. An SMM memory corruption vulnerability allows an attacker to write fixed or predictable data to SMRAM, potentially escalating privileges to SMM.
A vulnerability in AhciBusDxe in InsydeH2O with kernel 5.1-5.5 involves SMM memory corruption, allowing an attacker to write fixed or predictable data to SMRAM, potentially leading to privilege escalation to SMM.
An issue was discovered in HddPassword in InsydeH2O with kernels 5.1 through 5.5. An SMM memory corruption vulnerability allows an attacker to write fixed or predictable data to SMRAM, potentially escalating privileges to SMM.
A vulnerability in UsbCoreDxe in InsydeH2O (kernel 5.5 to 5.0) allows an attacker to hijack execution flow of code running in System Management Mode via an SMM callout. Exploitation could lead to privilege escalation to SMM.
A vulnerability in InsydeH2O with Kernel 5.0-5.5 involves SMM memory corruption in FvbServicesRuntimeDxe, allowing an attacker to write fixed or predictable data to SMRAM, potentially leading to privilege escalation to SMM.
A vulnerability in StorageSecurityCommandDxe in InsydeH2O with Kernel 5.1-5.3 involves an SMM callout that allows an attacker to hijack execution flow of code running in System Management Mode, potentially leading to privilege escalation to SMM.
A vulnerability in InsydeH2O Kernel allows an attacker to hijack execution flow of code running in System Management Mode via an Int15ServiceSmm SMM callout. Exploiting this issue could lead to escalating privileges to SMM.
A vulnerability in AhciBusDxe in InsydeH2O with kernel 5.0-5.5 allows an attacker to access System Management Mode and execute arbitrary code, due to inclusion of functionality from an untrusted control sphere.
A vulnerability in NvmExpressDxe in InsydeH2O with kernel 5.0-5.5 allows an attacker to access System Management Mode and execute arbitrary code, due to inclusion of functionality from an untrusted control sphere.
An issue was discovered in NvmExpressDxe in InsydeH2O for kernels 5.0 through 5.5. An untrusted pointer dereference causes SMM memory corruption, allowing an attacker to write fixed or predictable data to SMRAM, potentially escalating privileges to SMM.
An issue was discovered in SdHostDriver in InsydeH2O for kernels 5.0 through 5.5. An SMM callout allows an attacker to access System Management Mode and execute arbitrary code, due to a numeric range comparison without a minimum check.
An issue was discovered in AhciBusDxe in InsydeH2O for kernels 5.0 through 5.5. An untrusted pointer dereference causes SMM memory corruption, allowing an attacker to write fixed or predictable data to SMRAM, potentially escalating privileges to SMM.
A vulnerability in InsydeH2O Kernel 5.0-5.5 affecting FwBlockServiceSmm. Software SMI services using Communicate() do not validate buffer addresses, allowing use of SMRAM, MMIO, or OS kernel addresses.
A vulnerability in InsydeH2O Kernel 5.x affecting HddPassword. Software SMI services using Communicate() do not validate buffer addresses, allowing use of SMRAM, MMIO, or OS kernel addresses.
A vulnerability exists in the SWSMI handler of InsydeH2O UEFI firmware that dereferences the gRT pointer to call a GetVariable service located outside SMRAM. This can result in code execution in SMM, escalating privileges from ring 0 to ring -2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS