CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Nagios XI version xi-5.7.5 is affected by OS command injection due to improper sanitization of authenticated user input in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php.
A vulnerability in Nagios XI version xi-5.7.5 allows OS command injection. The issue exists in the switch.inc.php file due to improper sanitization of authenticated user input.
Nagios XI version xi-5.7.5 is affected by OS command injection in the file windowswmi.inc.php due to improper sanitization of authenticated user input. This allows execution of arbitrary commands on the server.
Adminer, an open-source database management tool in a single PHP file, versions 4.0.0 through 4.7.9 contain a server-side request forgery (SSRF) vulnerability. This affects versions bundling all drivers (e.g., adminer.php). The vulnerability is fixed in version 4.7.9.
Adobe Acrobat Reader DC versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier), and 2017.011.30188 (and earlier) are affected by a heap-based buffer overflow vulnerability. An unauthenticated attacker could exploit this to achieve arbitrary code execution in the context of the current user. Exploitation requires user interaction, such as opening a malicious file.
Oclean Mobile Application 2.1.2 communicates with an external website using HTTP, allowing network traffic eavesdropping. The HTTP payload is encrypted using XOR with a hardcoded key, enabling traffic decryption.
McAfee Total Protection (MTP) prior to 16.0.30 contains an arbitrary process execution vulnerability. A local user can gain elevated privileges and execute arbitrary code by bypassing MTP self-defense.
Google Chrome prior to 88.0.4324.150 contains a heap buffer overflow in V8. A remote attacker could potentially exploit heap corruption via a crafted HTML page.
The vulnerability has been reported to affect earlier versions of QTS. If exploited, this improper access control vulnerability could allow attackers to compromise the security of the software by gaining privileges or reading sensitive information. This issue affects QNAP Systems Inc. Helpdesk versions prior to 3.0.3.
W jądrze Linuxa do wersji 5.10.11 odkryto problem związany z używaniem zwolnionego stosu jądra podczas obsługi błędów w PI futexach. Umożliwia to lokalnym użytkownikom wykonanie kodu w jądrze.
In the OpenWire protocol of Apache ActiveMQ Artemis 2.15.0, a vulnerability was found that allowed bypassing policy-based access control when creating advisory messages for the entire session. The production of these messages was not subject to access control in error.
The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid user's password in error, resulting in no check on the password.
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow. This allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
A vulnerability in reset-password.php in ProjectSend before r1295 allows remote attackers to reset a user's password due to incorrect business logic. Errors are not properly considered, specifically an invalid token parameter.
A flaw in jackson-databind before 2.9.10.7 mishandles the interaction between serialization gadgets and typing. The highest threat is to data confidentiality, integrity, and system availability.
Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.
Use after free in Media in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
Adobe Campaign Classic Gold Standard 10 (and earlier), 20.3.1 (and earlier), 20.2.3 (and earlier), 20.1.3 (and earlier), 19.2.3 (and earlier) and 19.1.7 (and earlier) are affected by a server-side request forgery (SSRF) vulnerability. Successful exploitation could allow an attacker to use the Campaign instance to issue unauthorized requests to internal or external resources.
A vulnerability in the Snort detection engine affecting multiple Cisco products could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. The issue is due to incorrect handling of an HTTP range header. An attacker could send crafted HTTP packets to bypass file policy and deliver a malicious payload.
Microsoft Defender contains a remote code execution vulnerability. Details of the vulnerability are not provided in the description.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS