CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Broadcom RAID Controller Web server (nginx) is serving private files without any authentication.
The Broadcom RAID Controller web interface does not enforce SSL cipher ordering by the server, potentially leading to security vulnerabilities.
The Broadcom RAID Controller web interface is vulnerable due to improper permissions on the log file.
The Broadcom RAID Controller web interface has a vulnerability related to an insecure default TLS configuration that supports obsolete and vulnerable TLS protocols.
The Broadcom RAID Controller web interface is vulnerable due to an insecure default HTTP configuration that does not safeguard the SESSIONID cookie with the SameSite attribute.
The Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data, and the keys used for encryption are accessible to any local user on Windows.
The Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data, and the keys used for encryption are accessible to any local user on Linux.
The Broadcom RAID Controller web interface is vulnerable due to an insecure default TLS configuration that supports obsolete SHA1-based ciphersuites.
The Broadcom RAID Controller web interface is vulnerable due to the use of Libcurl, which has known vulnerabilities.
The Broadcom RAID Controller web interface is vulnerable due to insecure defaults lacking HTTP Content-Security-Policy headers.
The Broadcom RAID Controller web interface is vulnerable to improper session management of active sessions on Gateway setup.
COMFAST CF-XR11 version V2.7.2 has a command injection vulnerability detected at function sub_4143F0. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter timestr.
Version 2.7.2 of the COMFAST CF-XR11 device contains a vulnerability that allows an attacker to execute arbitrary code via the ifname and mac parameters in the sub_410074 function in the bin/webmgnt file.
Version 2.7.2 of the COMFAST CF-XR11 device contains a vulnerability that allows an attacker to execute arbitrary code via the destination parameter of the sub_431F64 function in the bin/webmgnt file.
An issue in Wavlink WL_WNJ575A3 v.R75A3_V1410_220513 allows a remote attacker to execute arbitrary code via the username parameter of the set_sys_adm function in adm.cgi.
A vulnerability in the HPE Aruba Networking Virtual Intranet Access (VIA) client could allow malicious users to overwrite arbitrary files as NT AUTHORITY\SYSTEM. A successful exploit could create a Denial-of-Service (DoS) condition affecting the Microsoft Windows operating system boot process.
A vulnerability in the HPE Aruba Networking Virtual Intranet Access (VIA) client could allow local users to elevate privileges. Successful exploitation could allow execution of arbitrary code with NT AUTHORITY\SYSTEM privileges on the operating system.
Insufficient data validation in Systems Extensions in Google Chrome on ChromeOS prior to version 116.0.5845.120 allowed an attacker who convinced a user to install a malicious extension to bypass file restrictions via a crafted HTML page.
Insufficient policy enforcement in Extensions API in Google Chrome prior to version 116.0.5845.96 allowed an attacker who convinced a user to install a malicious extension to bypass an enterprise policy via a crafted HTML page.
Insufficient policy enforcement in Extensions API in Google Chrome prior to version 116.0.5845.96 allowed an attacker who convinced a user to install a malicious extension to bypass an enterprise policy via a crafted HTML page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS