CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Zidentyfikowano podatność na dereferencję wskaźnika NULL w konwerterze protokołów. Atakujący może wysłać specjalnie przygotowany pakiet, który może zrestartować urządzenie działające na Crimson 3.1 (wersje kompilacji przed 3119.001).
A change introduced in Apache Flink 1.11.0 allows attackers to read any file on the local filesystem of the JobManager through the REST interface. Access is restricted to files accessible by the JobManager process. The issue was fixed in Flink 1.11.3 and 1.12.0.
EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by SQL injection in the User Login Page. An attacker can manipulate input fields to execute unauthorized SQL queries against the database.
FasterXML jackson-databind w wersjach 2.x przed 2.9.10.8 niewłaściwie obsługuje interakcję między gadżetami serializacji a typowaniem, co jest związane z com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (znanym jako osadzony Xalan w org.glassfish.web/javax.servlet.jsp.jstl).
A vulnerability in TerraMaster TOS version 4.2.06 and earlier allows remote authenticated attackers to bypass read-only restrictions and gain full access to any folder on the NAS.
A CSRF vulnerability in EgavilanMedia User Registration & Login System with Admin Panel 1.0 allows an attacker to remotely gain privileges in the User Profile panel. The attacker can update any user's account without their knowledge.
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource.
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource.
Wersje curl od 7.21.0 do 7.73.0 są podatne na niekontrolowaną rekurencję z powodu problemu z przepełnieniem stosu podczas analizy dopasowania dzikich kart w FTP.
curl w wersjach od 7.20.0 do 7.70.0 jest podatny na niewłaściwe ograniczenie nazw plików i innych zasobów, co może prowadzić do nadpisania lokalnego pliku przy użyciu flagi -J.
OpenAsset Digital Asset Management (DAM) through version 12.0.19 does not properly sanitize user input, incorporating it into SQL queries, allowing authenticated blind SQL injection.
OpenAsset Digital Asset Management (DAM) through version 12.0.19 does not properly verify whether a request to the application was intentionally made by the user, allowing cross-site request forgery (CSRF) attacks on all user functions.
OpenAsset Digital Asset Management (DAM) through version 12.0.19 does not correctly determine the originating IP address of HTTP requests, allowing attackers to spoof it using the X-Forwarded-For header, e.g., by supplying localhost address 127.0.0.1, effectively bypassing all IP-based access controls.
A remote code execution vulnerability in Microsoft Exchange. Technical details are not provided in the description.
A vulnerability in the Windows Cloud Files Mini Filter Driver allows for elevation of privilege. An attacker can exploit this flaw to gain higher privileges on the system.
A type confusion issue was addressed with improved state handling. The issue affects multiple Apple operating systems: macOS, watchOS, iOS, and iPadOS. A malicious application may be able to execute arbitrary code with kernel privileges.
A memory corruption issue was addressed with improved input validation. The issue affects multiple Apple operating systems: macOS, watchOS, iOS, and iPadOS. Processing a maliciously crafted font may lead to arbitrary code execution.
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.
In Saibo Cyber Game Accelerator 3.7.9 a local privilege escalation vulnerability exists. Attackers can use a crafted program to elevate user privileges.
W jądrze Linuxa znaleziono lukę w implementacji futex, która pozwala lokalnemu atakującemu na uszkodzenie pamięci systemowej lub eskalację uprawnień podczas tworzenia futex na systemie plików, który ma być odmontowany. Luka ta wpływa na poufność, integralność oraz dostępność systemu.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS