CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
W kontrolerach Rockwell Automation MicroLogix 1400 Series B w wersji v21.001 i wcześniejszych, oraz w kontrolerach MicroLogix 1100, funkcja kryptograficzna używana do ochrony hasła jest odkrywalna. Dotyczy to również oprogramowania RSLogix 500 w wersji v12.001 i wcześniejszych.
Elevation of privilege vulnerability in Windows Background Intelligent Transfer Service (BITS) due to improper handling of symbolic links.
In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android, Versions: Android kernel, Android ID: A-147882143, References: M-ALPS04356754.
In binder_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android, Versions: Android kernel, Android ID: A-145988638, References: Upstream kernel.
Zidentyfikowano podatność w rodzinie CPU SIMATIC S7-300 oraz powiązanych urządzeniach, które mogą zostać wywołane przez specjalnie skonstruowane pakiety wysyłane na port 102/tcp (Profinet). W wyniku tego urządzenie może przejść w tryb awarii, co wymaga ponownego uruchomienia systemu.
setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in the SystemCommand parameter.
lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the fileName POST parameter.
Wszystkie wersje sterowników PLC serii CJ firmy Omron są podatne na atak, w którym napastnik może wysłać serię specyficznych pakietów danych w krótkim czasie. To prowadzi do błędu usługi w module Ethernet PLC, co skutkuje odmową dostępu do usługi PLC.
D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.
Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be closed prematurely instead of producing a 400 response.
Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 68.4.1, Thunderbird < 68.4.1, and Firefox < 72.0.1.
Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. An application may be able to execute arbitrary code with kernel privileges.
A vulnerability in the CLI of Cisco FXOS and Cisco UCS Manager Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying OS. The issue is due to insufficient input validation. An attacker could exploit this by including crafted arguments to specific commands. On Cisco UCS 6400 Series Fabric Interconnects, injected commands are executed with root privileges.
An issue was discovered in MISP before version 2.4.121 related to an incorrectly sanitized search string in the Galaxy view in app/View/Galaxies/view.ctp.
An issue was discovered in MISP before version 2.4.121 that did not consider the HTTP PUT method when trying to block a brute-force series of invalid requests.
A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, known as 'Microsoft Exchange Memory Corruption Vulnerability'.
An elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links, known as 'Windows Installer Elevation of Privilege Vulnerability'.
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, known as 'Scripting Engine Memory Corruption Vulnerability'.
A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS