CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In rConfig 3.9.6, insecure permissions for the chmod command exist. After installation, the apache user can execute chmod as root without a password, allowing a low-privilege attacker to gain root access to the server.
SQL Injection vulnerability in rConfig 3.9.6 allows an authenticated attacker to inject malicious SQL code. If the MySQL server does not have --secure-file-priv set and is on the same host as rConfig, the attacker can upload a webshell and gain remote access.
Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Lack of boundary checking of a buffer in set_skb_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read and it results in arbitrary code execution by dereference of invalid function pointer.
A vulnerability in Afian FileRun 2021.03.26 allows remote code execution by administrators via the Check Path value for the magick binary.
A vulnerability in Afian FileRun 2021.03.26 allows remote code execution by administrators via the Check Path value for the ffmpeg binary.
prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the Linux kernel before 5.14.12 allows unprivileged users to trigger an eBPF multiplication integer overflow with a resultant out-of-bounds write.
A vulnerability in SMM branch registers a SWSMI handler that does not sufficiently validate the allocated buffer pointer (QWORD values for CommBuffer), allowing an attacker to corrupt SMRAM memory and potentially execute arbitrary code.
Wersje curl od 7.20.0 do 7.78.0 mają lukę, która pozwala na ominięcie wymogu użycia TLS podczas komunikacji z serwerami IMAP, POP3 lub FTP. Jeśli serwer zwróci odpowiednio skonstruowaną, ale poprawną odpowiedź, curl może kontynuować operacje bez szyfrowania, mimo że użytkownik tego nie oczekiwał.
A vulnerability in sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process if the configuration specifies running the command as a different user.
An information disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version: 2.01MT. An attacker can obtain a user name and password by forging a post request to the /getcfg.php page.
The ncurses library up to version v6.2-1 contains a heap-based buffer overflow vulnerability in the _nc_captoinfo function in captoinfo.c.
A segmentation fault in the redis-server component of Redis 5.0.7 leads to a denial of service (DOS). The vendor cannot reproduce this issue in a released version, such as 5.0.7.
All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.
Libsixel w wersji 1.8.3 zawiera przepełnienie bufora na stercie w funkcji sixel_encode_highcolor w pliku tosixel.c. Ta podatność może prowadzić do nieautoryzowanego dostępu do pamięci.
Libsixel w wersji 1.8.2 zawiera przepełnienie bufora na stercie w funkcji dither_func_fs w pliku tosixel.c. Ta podatność może prowadzić do nieautoryzowanego dostępu do pamięci.
Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could result in multiple out-of-bounds write instances. An attacker could leverage this vulnerability to execute code in the context of the current process.
W podatności CVE-2021-31843 w McAfee Endpoint Security (ENS) dla systemu Windows przed aktualizacją z września 2021 roku występuje niewłaściwe zarządzanie uprawnieniami. Umożliwia to lokalnym użytkownikom dostęp do plików, do których normalnie nie powinni mieć dostępu, poprzez manipulację linkami junction w celu przekierowania operacji folderów McAfee do niezamierzonej lokalizacji.
In Jfinal CMS 5.1.0, improper access control allows attackers to read sensitive information by directly requesting the file /classes/conf/db.properties&config=filemanager.config.js.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS