CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple cross-site request forgery (CSRF) vulnerabilities in Hexis HawkEye G 3.0.1.4912 allow remote attackers to hijack the authentication of administrators for various requests, such as adding arbitrary accounts or disabling security features.
Directory traversal vulnerability in the st module before version 0.2.5 for Node.js allows remote attackers to read arbitrary files via an encoded %2e%2e in an unspecified path.
The codem-transcode module before 0.5.0 for Node.js, when ffprobe is enabled, allows remote attackers to execute arbitrary commands via a POST request to /probe.
Multiple cross-site request forgery (CSRF) vulnerabilities in LetoDMS (formerly MyDMS) before version 3.3.8 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors.
The edit.php file in LabWiki version 1.1 and earlier does not properly verify uploaded user files, allowing remote authenticated users to upload arbitrary PHP files via a .gif file in the userfile parameter.
In phpMyFaq before version 2.9.9, there is a CSRF vulnerability in admin/ajax.config.php.
In Apache Derby versions 10.1.2.1, 10.2.2.0, 10.3.1.4, and 10.4.1.3, export processing may allow an attacker to overwrite an existing file.
Zidentyfikowano podatność w kontrolerach automatyki Siemens APOGEE PXC i TALON TC BACnet we wszystkich wersjach poniżej V3.5. Atakujący z dostępem do sieci może obejść uwierzytelnianie i pobrać wrażliwe informacje z urządzenia.
Cisco Small Business SA520 and SA540 devices with firmware 2.1.71 and 2.2.0.7 allow directory traversal via the thispage parameter in scgi-bin/platform.cgi, enabling the reading of arbitrary files.
The certificate import component in IDEMIA MorphoSmart 1300 Series devices allows local users to obtain a command shell, leading to privilege escalation via unspecified vectors. The vendor disputes this claim, stating that there is no command shell in the product or associated SDK.
SQL Injection exists in the E-Sic 1.0 password reset parameter (aka the cpfcnpj parameter to the /reset URI).
In Suricata before version 4.x, it was possible to trigger many redundant checks on the content of crafted network traffic due to a bug in DetectEngineContentInspection. The search engine did not stop when no match was found, leading to exceeding the inspection recursion limit.
Extreme EXOS versions 15.7, 16.x, 21.x, and 22.x allow remote attackers to hijack sessions by determining SessionID values.
Extreme EXOS versions 15.7, 16.x, 21.x, and 22.x allow remote attackers to trigger a buffer overflow leading to a reboot.
An issue was discovered in certain Apple products, including macOS before 10.13 Supplemental Update, related to the 'StorageKit' component. It allows attackers to discover passwords for APFS encrypted volumes by reading Disk Utility hints, as the stored hint value was accidentally set to the password itself.
An issue was discovered in certain Apple products, including Xcode before version 9, related to the 'ld64' component. It allows remote attackers to execute arbitrary code or cause a denial of service via a crafted Mach-O file.
An issue was discovered in certain Apple products, including Xcode before version 9, related to the 'ld64' component. It allows remote attackers to execute arbitrary code or cause a denial of service via a crafted Mach-O file.
An issue was discovered in certain Apple products, including Xcode before version 9, related to the 'ld64' component. It allows remote attackers to execute arbitrary code or cause a denial of service via a crafted Mach-O file.
An issue was discovered in certain Apple products, including Xcode before version 9, related to the 'ld64' component. It allows remote attackers to execute arbitrary code or cause a denial of service via a crafted Mach-O file.
An issue was discovered in certain Apple products, including iOS before version 11, related to the 'MobileBackup' component. It allows remote attackers to obtain sensitive cleartext information by leveraging read access to a backup archive that was supposed to have been encrypted.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS