CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Apache::Session versions through 1.94 for Perl re-create deleted sessions. Sessions stored in Apache::Session::Store::File and Apache::Session::Store::DB_File can be revived, potentially exposing data that was meant to be deleted.
Netgate pfSense CE version 2.8.0 allows code execution via the XMLRPC API using pfsense.exec_php. The supplier disputes this vulnerability as the API call is only available to admins who are intentionally allowed to execute PHP code.
Netgate pfSense CE version 2.7.2 allows code execution by using the module installer with a backup file containing a serialized PHP object with the post_reboot_commands property.
RayVentory Scan Engine through version 12.6 Update 8 allows attackers to gain privileges if they control the value of the PATH environment variable. This vulnerability is disputed as the ability to control the environment is a site-specific misconfiguration.
1C-Bitrix version 25.100.500 allows Remote Code Execution because an actor with SOURCE/WRITE permissions for the Translate Module can upload and execute code by sending a PHP file and a .htaccess file.
Certain GL.iNet devices with 4.x firmware allow authentication bypass, resulting in administrative control of the device. This affects version 4.3.7 on models GL-MT3000, GL-AR300M, GL-B1300, GL-AX1800, GL-AR750S, GL-MT2500, GL-AXT1800, GL-X3000, and GL-SFT1200.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index(), SettingsController.php's update(), and PollDevice.php's initRrdDirectory().
Electerm, a terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client, is vulnerable to arbitrary local code execution in versions from 3.0.6 to before 3.8.15. Exploiting this vulnerability requires clicking a crafted electerm://... link or opening a crafted shortcut/command.
Electerm is a terminal client that in versions 3.8.15 and prior does not validate protocols for URLs clicked in the terminal. Attackers can exploit this to execute arbitrary code or access local files on the victim's machine if the victim clicks a displayed link.
In LiteLLM versions from 1.81.16 to before 1.83.7, a database query used during proxy API key checks is vulnerable to SQL injection due to mixing caller-supplied key value into the query text. An unauthenticated attacker can send a crafted Authorization header to any LLM API route, leading to reading and potentially modifying data in the proxy's database.
In the electerm client prior to version 3.3.8, a command injection vulnerability exists that allows an attacker to append malicious version strings into an exec command without validation. This issue has been patched in version 3.3.8.
In the electerm client prior to version 3.3.8, a command injection vulnerability allows an attacker to inject malicious code into the exec command. This issue has been patched in version 3.3.8.
In Argo CD versions 3.2.0 to 3.2.10 and 3.3.0 to 3.3.8, there is a missing authorization and data-masking gap in the ServerSideDiff endpoint. This allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism.
A server-side request forgery (SSRF) vulnerability was identified in the GitHub Enterprise Server notebook viewer that allowed an attacker to access internal services by exploiting URL parser confusion between the validation layer and the HTTP request library.
Azure DevOps has a vulnerability that allows an unauthorized attacker to disclose sensitive information over a network.
Improper neutralization of special elements used in a command ('command injection') in Azure Cloud Shell allows an unauthorized attacker to perform spoofing over a network.
Nieprawidłowa kontrola dostępu w Azure Managed Instance dla Apache Cassandra umożliwia autoryzowanemu atakującemu wykonanie kodu przez sieć.
Improper authorization in Microsoft Teams allows an authorized attacker to disclose information over a network.
Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network.
FreeScout prior to version 1.8.217 has a vulnerability in the /user-setup/{hash} endpoint that accepts a 60-character random invite_hash to set a new user's password. The lack of expiration check allows for unauthorized account takeover long after the invite was issued.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS