CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An issue was discovered in AhciBusDxe in InsydeH2O with kernels 5.0 through 5.5. An SMM callout vulnerability allows an attacker to hijack the execution flow of code running in System Management Mode, potentially escalating privileges to SMM.
An issue was discovered in InsydeH2O with kernels 5.1 through 5.3 (up to 2021-11-08). A StorageSecurityCommandDxe SMM memory corruption vulnerability allows an attacker to write fixed or predictable data to SMRAM, potentially escalating privileges to SMM.
An IDOR vulnerability in PrinterLogic Web Stack versions 19.1.1.13 SP9 and below allows an unauthenticated attacker to disclose the plaintext console username and password for a printer.
An IDOR vulnerability in PrinterLogic Web Stack versions 19.1.1.13 SP9 and below allows an unauthenticated attacker to disclose usernames and email addresses of all users.
PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to pre-authentication remote code execution due to insufficient input sanitization.
The vulnerability in PrinterLogic Web Stack versions 19.1.1.13 SP9 and below is due to a hardcoded APP_KEY value. This allows pre-authentication remote code execution.
PrinterLogic Web Stack versions 19.1.1.13 SP9 and below deserialize attacker-controlled data, leading to pre-authentication remote code execution.
A local privilege escalation vulnerability was found in polkit's pkexec utility. pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands.
An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], based on DDNS type, the ddns->domain variable, that has the value of the domain parameter provided through the SetDdns API, is not validated properly. This would lead to an OS command injection. An attacker can send an HTTP request to trigger this vulnerability.
CVE-2021-44793 affects the sc-reports-ui module in Single Connect, which does not perform authorization checks. A remote attacker could exploit this vulnerability to access the device configuration page and export data to an external file.
JPress 4.2.0 is vulnerable to remote code execution (RCE) via the email template editing function in the admin panel. Attackers can inject malicious code into the template, leading to arbitrary command execution on the server.
JPress 4.2.0 is vulnerable to remote code execution via the email template editing function in the admin panel. An attacker can inject malicious code into the template, which gets executed when sending an email.
In jpress 4.2.0, a remote code execution vulnerability exists via the template installation function in _TemplateController#doInstall. Attackers can inject malicious code during template installation.
JPress 4.2.0 is vulnerable to remote code execution (RCE) via the template upload function in the admin panel. An attacker can upload a malicious template and execute arbitrary code on the server.
JPress 4.2.0 is vulnerable to remote code execution via the email template editing function in the admin panel. Attackers can inject malicious code into the template, leading to code execution on the server.
W NPM simple-get przed wersją 4.0.1 występuje niewłaściwe usuwanie wrażliwych informacji przed ich przechowywaniem lub transferem. Może to prowadzić do nieautoryzowanego dostępu do danych.
BIOS Dell zawiera podatność na niewłaściwą walidację danych wejściowych. Złośliwy użytkownik z lokalnym dostępem i odpowiednimi uprawnieniami może wykorzystać tę podatność, używając SMI, aby uzyskać możliwość wykonania dowolnego kodu w SMRAM.
BIOS Dell zawiera podatność na niewłaściwą walidację danych wejściowych. Złośliwy użytkownik z lokalnym dostępem może wykorzystać tę podatność, używając SMI, aby uzyskać możliwość wykonania dowolnego kodu w SMRAM.
JPress v4.2.0 allows users to register an account by default. With the account, users can upload arbitrary files to the server.
W McAfee Agent (MA) dla systemu Windows przed wersją 5.7.5 występuje podatność na wstrzykiwanie poleceń, która pozwala lokalnym użytkownikom na wstrzyknięcie dowolnego kodu powłoki do pliku cleanup.exe. Złośliwy plik clean.exe jest umieszczany w odpowiednim folderze i uruchamiany przez funkcję wdrażania McAfee Agent w System Tree.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS