CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Podatność CVE-2022-26826 dotyczy serwera DNS w systemie Windows, umożliwiając zdalne wykonanie kodu przez atakującego. Wykorzystanie tej luki może prowadzić do przejęcia kontroli nad systemem.
Podatność w usłudze Windows Print Spooler umożliwia podniesienie uprawnień. Atakujący może wykorzystać tę lukę, aby uzyskać wyższe uprawnienia w systemie.
A privilege elevation vulnerability in the Windows Common Log File System Driver. It is exploited locally by an authenticated user.
A vulnerability in Microsoft Excel allows for remote code execution. An attacker can exploit this flaw to execute malicious code on the victim's system.
Multiple XSS vulnerabilities were found in Liferay Portal 7.3.5 through 7.4.0 and Liferay DXP 7.3 before service pack 3. An attacker can inject arbitrary script or HTML via form field help text in the Forms module or App Builder module.
JAI-EXT is an open-source project extending the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script via network request can lead to Remote Code Execution as the script is compiled into Java code via Janino and executed. This affects the downstream GeoServer project. Version 1.2.22 contains a patch that disables the ability to inject malicious code into the resulting script.
A vulnerability in VMware Workspace ONE Access, Identity Manager and vRealize Automation due to improper permissions in support scripts. A local attacker can escalate privileges to root.
An issue in EasyIO CPT Graphics v0.8 allows attackers to discover valid users in the application. This vulnerability enables unauthorized user enumeration.
W wyniku niekontrolowanej rekurencji w SAP Web Dispatcher i SAP Internet Communication Manager, aplikacja może ulec awarii, co prowadzi do odmowy usługi, jednak może być automatycznie uruchomiona ponownie.
An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file. The vendor states that files can only be uploaded and published by trusted users, which is intentional.
An arbitrary file upload vulnerability in the file upload module of Skipper v0.9.1 allows attackers to execute arbitrary code via a crafted file.
An arbitrary file upload vulnerability in the file upload component of ButterCMS v1.2.8 allows attackers to execute arbitrary code via a crafted SVG file.
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.
W repozytorium GitHub zerotier/zerotierone przed wersją 1.8.8 występuje nieprawidłowe przypisanie uprawnień do krytycznego zasobu, co może prowadzić do lokalnego eskalowania uprawnień.
A Directory Traversal vulnerability in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0. An attacker can exploit the 'page' parameter in index.php to read arbitrary files on the server.
An undocumented backdoor account in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 allows unauthorized access with full administrative privileges. The vulnerability stems from missing access controls and a hidden account.
SQL Injection vulnerability in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0. An attacker can inject malicious SQL queries via the input_id POST parameter in index.php.
Bolt CMS version 4.2 and earlier is vulnerable to Remote Code Execution. Unsafe theme rendering allows an authenticated attacker to edit the theme and inject server-side template injection, leading to remote code execution.
W repozytorium GitHub gnuboard/gnuboard5 w wersjach do 5.5.5 występuje podatność związana z użyciem słabych algorytmów kryptograficznych. Umożliwia to atakującemu uzyskanie adresu e-mail dowolnego użytkownika oraz wysyłanie wiadomości e-mail z pełną kontrolą nad ich treścią.
libsixel w wersjach przed 1.10 jest podatny na przepełnienie bufora w pliku libsixel/src/quant.c w linii 867. Ta podatność może prowadzić do nieautoryzowanego dostępu do pamięci.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS