CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
BigAnt Server version 5.6.06 is vulnerable to directory traversal attacks, allowing an attacker to read files outside the server's root directory.
BigAnt Server version 5.6.06 was found to have incorrect access control issues. This vulnerability may allow unauthorized users to access resources without proper permissions.
BigAnt Server version 5.6.06 was found to have incorrect access control. This vulnerability may allow unauthorized users to access resources without proper permissions.
A vulnerability in taocms v3.0.2 allows attackers to inject code by arbitrarily editing the .htaccess file. Attackers can modify this file to execute malicious commands on the server.
An issue was discovered in MISP before version 2.4.156 related to the SVG org logo, which does not forbid the use of JavaScript by default.
An issue was discovered in MISP before version 2.4.156, where app/Model/Server.php does not restrict generateServerSettings to the CLI. This could lead to SSRF attacks.
An issue was discovered in MISP before version 2.4.156, allowing a malicious site administrator to store an XSS payload in the custom auth name. This payload would be executed each time the administrator modifies a user.
An issue was discovered in MISP before version 2.4.156 that allows Local File Inclusion via the custom terms file setting in app/View/Users/terms.ctp.
A use-after-free issue in WebKit addressed with improved memory management. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of active exploitation.
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 15.3 and iPadOS 15.3, macOS Big Sur 11.6.3, macOS Monterey 12.2. A malicious application may be able to execute arbitrary code with kernel privileges; Apple is aware of a report that this issue may have been actively exploited.
A use-after-free flaw was found in the Linux kernel's FUSE filesystem in the way a user triggers write(). This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in privilege escalation.
A vulnerability in OpenDocMan 1.4.4 allows an attacker to bypass MIME type checks when uploading files via add.php. This can lead to automatic processing of malicious files within the product's environment or remote code execution.
An SQL Injection vulnerability in Attendance and Payroll System v1.0 allows a remote attacker to bypass authentication via unsanitized login parameters.
A Remote Code Execution (RCE) vulnerability in Sourcecodester Attendance and Payroll System v1.0 allows an unauthenticated remote attacker to upload a malicious PHP file via the photo upload functionality.
Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2).
Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4, 10.x, and 11.x. A remote authenticated user can access internal API functions and upload and execute arbitrary code.
In kbase_jd_user_buf_pin_pages of mali_kbase_mem.c, there is a possible out-of-bounds write due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed.
The BN_mod_sqrt() function contains a bug that can lead to an infinite loop for non-prime moduli. This bug can be triggered by crafting a certificate with invalid explicit curve parameters.
W OpenSSH przed wersją 8.9 odkryto problem związany z uwierzytelnianiem kluczem publicznym przy użyciu przekazywania agenta. Jeśli atakujący zmodyfikował serwer, aby wspierał opcję uwierzytelniania None, użytkownik nie może określić, czy uwierzytelnienie FIDO potwierdza chęć połączenia z serwerem, czy też pozwala temu serwerowi na połączenie z innym serwerem w imieniu użytkownika.
A command injection vulnerability exists in TOTOLINK A3100R up to version V4.1.2cu.5050_B20200504 in the adm/ntm.asp script via the hosTime parameter. It allows a remote attacker to execute arbitrary system commands on the device.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS