CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
FasterXML jackson-databind w wersjach 2.x przed 2.9.10.5 niewłaściwie obsługuje interakcję między gadżetami serializacji a typowaniem, co jest związane z oadd.org.apache.xalan.lib.sql.JNDIConnectionPool (znanym jako apache/drill).
FasterXML jackson-databind w wersjach 2.x przed 2.9.10.5 niewłaściwie obsługuje interakcję między gadżetami serializacyjnymi a typowaniem, co jest związane z com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (znanym również jako xalan2).
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and oracle.jms.AQjmsXAConnectionFactory (aka weblogic/oracle-aqjms).
Jackson, when configured with default typing, has a deserialization vulnerability that could lead to arbitrary code execution. Spring Batch, using Jackson with global default typing, may allow code execution if an attacker has write access to the JobRepository data store.
An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1237, CVE-2020-1246, CVE-2020-1262, CVE-2020-1264, CVE-2020-1266, CVE-2020-1269, CVE-2020-1273, CVE-2020-1274, CVE-2020-1275, CVE-2020-1276, CVE-2020-1307, CVE-2020-1316.
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13.5, iOS 12.4.7, watchOS 6.2.5. Processing a maliciously crafted mail message may lead to unexpected memory modification or application termination.
A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5.1 and iPadOS 13.5.1, macOS Catalina 10.15.5 Supplemental Update, tvOS 13.4.6, watchOS 6.2.6. An application may be able to execute arbitrary code with kernel privileges.
Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.
Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.
Vulnerability in Firefox for iOS < 25. The token used for native-to-JS bridging was leaking, potentially allowing non-app code to call bridging functions.
Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.
Remote code execution vulnerability in Visual Studio Code when the Python extension loads workspace settings from a notebook file. An attacker could run arbitrary code in the context of the current user, potentially taking control of the system if the user has administrative rights.
An elevation of privilege vulnerability exists when the Windows State Repository Service improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in an elevated context.
Elevation of privilege vulnerability in Windows State Repository Service due to improper handling of objects in memory, allowing an attacker to run arbitrary code in an elevated context.
Elevation of privilege vulnerability in Windows State Repository Service due to improper handling of objects in memory, allowing an attacker to run arbitrary code in an elevated context.
Elevation of privilege vulnerability in Windows State Repository Service due to improper handling of objects in memory, allowing an attacker to run arbitrary code in an elevated context.
Elevation of privilege vulnerability in Windows State Repository Service due to improper handling of objects in memory, allowing an attacker to run arbitrary code in an elevated context.
Elevation of privilege vulnerability in Windows State Repository Service due to improper handling of objects in memory. An attacker could run arbitrary code in an elevated context.
Elevation of privilege vulnerability in Windows State Repository Service due to improper handling of objects in memory. An attacker could run arbitrary code in an elevated context.
Elevation of privilege vulnerability in Windows State Repository Service due to improper handling of objects in memory. An attacker could run arbitrary code in an elevated context.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS