CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings.
ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to a permissions validation issue that allowed low-privileged users to execute administrator-configured MBean actions on monitors outside their assigned scope.
ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delete service monitors outside their assigned scope.
ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to obtain an administrator’s API key and use it to perform administrator-level actions.
ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to run unauthorized SQL commands, potentially gaining administrator access and remote code execution.
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute unauthorized payment actions due to missing authorization checks.
A Security Policy Bypass vulnerability exists in Forcepoint Security Engine (NGFW). Affects versions from 7.1.0 through 7.1.13, from 7.3.0 through 7.3.1, 7.3.3, from 7.4.0 through 7.4.1, and 7.5.0.
A missing/improper authentication vulnerability in the WatchGuard AuthPoint Gateway's LDAP Sync first-factor authentication allows a remote attacker to bypass single-factor password verification under non-default operating conditions. Additional authentication factors still apply.
A race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. Affects versions from 2.0.0 through 2.0.15 and from 1.3.0 through 1.3.8.
A buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. Affects versions from 2.0.0 through 2.0.15 and from 1.3.0 through 1.3.8.
A Data Exposure vulnerability in the Firewall Analyzer syslog collector affects Zoho ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below.
An XML Injection vulnerability in the Rule Tracking Compare Policies feature affects Zoho ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below.
A Command Injection vulnerability in the Diagnose Settings feature affects Zoho ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below.
An Authentication Bypass vulnerability affects Zoho ManageEngine OpManager versions 12.8.710 and below with the Application Manager Plugin enabled.
Improper handling of length parameter inconsistency in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. Affects versions from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121; also known affected: 8.5.0-8.5.100 and 7.0.56-7.0.109.
A Broken Access Control vulnerability in Zoho ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below allows an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls outside their assigned scope.
A vulnerability in ZohoCorp ManageEngine OpManager and Firewall Analyzer (versions 12.8.710 and below) allows an authenticated low-privilege user to create alert notifications for firewalls outside their assigned scope. This is a broken access control issue.
A vulnerability in ZohoCorp ManageEngine OpManager and Firewall Analyzer (versions 12.8.710 and below) allows an authenticated low-privilege user to gain Administrator privileges through Report Profile import. This is a privilege escalation issue.
A vulnerability in Apache Tomcat causes lost timeouts for asynchronous WebSocket writes, leading to denial of service (DoS). The issue affects many Tomcat versions, including 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M1 through 9.0.121.
A vulnerability in Apache Tomcat related to incomplete cleanup can cause a malformed request to potentially (depending on timing) cause one request from another user to fail. Affects versions 11.0.19-11.0.25, 10.1.53-10.1.59, and 9.0.116-9.0.121.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS