CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Microsec e-Szigno versions before 3.2.7.12 are vulnerable to XML signature wrapping attacks. Attackers can exploit a crafted e-akta signed document to alter a valid ds:Object element.
phpMyBackupPro version 2.5 and earlier does not properly escape the '.' character in request parameters, allowing remote authenticated users to inject and execute arbitrary PHP scripts.
phpMyBackupPro version 2.5 and earlier does not properly sanitize input strings, allowing remote authenticated users to execute arbitrary PHP code by storing a crafted string in a user configuration file.
phpMyBackupPro before 2.5 does not validate integer input, allowing remote authenticated users to execute arbitrary PHP code by injecting scripts via the path, filename, and period parameters to scheduled.php.
The Undertow module of WildFly 9.x before 9.0.0.CR2 and 10.x before 10.0.0.Alpha1 allows remote attackers to obtain the source code of a JSP page via a '/' at the end of a URL.
A Cross-Site Request Forgery (CSRF) vulnerability exists in Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb, allowing unauthorized requests such as enabling UPnP.
Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, known as Directory Traversal.
Docker Registry before version 2.6.2 in Docker Distribution does not properly restrict the amount of content accepted from a user, allowing remote attackers to cause a denial of service (memory consumption) via the manifest endpoint.
In MetInfo 5.3.17, there is a directory traversal vulnerability. A remote attacker can use '..\' in the filenames parameter of /admin/system/database/filedown.php to delete any .zip file on the server.
An issue was discovered in certain Apple products related to the 'Kernel' component. Affects iOS before 10.3.3, macOS before 10.12.6, tvOS before 10.2.2, and watchOS before 3.2.3.
An issue was discovered in certain Apple products related to the 'libarchive' component. It affects iOS before 10.3.3, macOS before 10.12.6, tvOS before 10.2.2, and watchOS before 3.2.3, allowing remote attackers to execute arbitrary code or cause a denial of service.
An issue was discovered in certain Apple products, including iOS before 10.3.3 and watchOS before 3.2.3, related to the 'Messages' component. It allows remote attackers to cause a denial of service through memory consumption and application crash.
An issue was discovered in certain Apple products affecting iOS before 10.3.3, Safari before 10.1.2, iCloud before 6.2.2 on Windows, iTunes before 12.6.2 on Windows, and tvOS before 10.2.2. The issue involves the 'WebKit' component and allows remote attackers to execute arbitrary code or cause a denial of service via a crafted web site.
An issue was discovered in certain Apple products affecting iOS before 10.3.3, Safari before 10.1.2, iCloud before 6.2.2 on Windows, iTunes before 12.6.2 on Windows, and tvOS before 10.2.2. The issue involves the 'WebKit' component and allows remote attackers to execute arbitrary code or cause a denial of service via a crafted website.
An issue was discovered in certain Apple products affecting iOS before 10.3.3, Safari before 10.1.2, iCloud before 6.2.2 on Windows, iTunes before 12.6.2 on Windows, and tvOS before 10.2.2. The issue involves the 'WebKit' component and allows remote attackers to execute arbitrary code or cause a denial of service via a crafted web site.
An issue was discovered in certain Apple products, including macOS before 10.12.6, related to the 'Bluetooth' component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
An issue was discovered in certain Apple products affecting iTunes before 12.6.2 on Windows. The issue allows attackers to execute arbitrary code in a privileged context via a crafted app.
An issue was discovered in certain Apple products affecting iOS before 10.3.3, Safari before 10.1.2, iCloud before 6.2.2 on Windows, iTunes before 12.6.2 on Windows, and tvOS before 10.2.2. The issue involves the 'WebKit' component and allows remote attackers to execute arbitrary code or cause a denial of service via a crafted website.
An issue was discovered in certain Apple products, including macOS before 10.12.6, related to the 'Bluetooth' component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
An issue was discovered in certain Apple products, including macOS before 10.12.6, related to the 'Bluetooth' component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS