CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An information disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version: 2.01MT. An attacker can obtain a user name and password by forging a post request to the /getcfg.php page.
Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attacker to remotely compromise the storage zones controller.
Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed.
The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file.
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.
W Kubernetes odkryto problem bezpieczeństwa, który może umożliwić użytkownikom wysyłanie ruchu sieciowego do lokalizacji, do których normalnie nie mieliby dostępu, poprzez atak 'confused deputy'.
W Kubernetes odkryto problem bezpieczeństwa, który pozwala aktorom kontrolującym odpowiedzi na żądania MutatingWebhookConfiguration lub ValidatingWebhookConfiguration na przekierowanie żądań kube-apiserver do prywatnych sieci apiservera. Użytkownik, który ma dostęp do logów kube-apiserver przy poziomie logowania ustawionym na 10, może zobaczyć przekierowane odpowiedzi i nagłówki w logach.
The ncurses library up to version v6.2-1 contains a heap-based buffer overflow vulnerability in the _nc_captoinfo function in captoinfo.c.
A segmentation fault in the redis-server component of Redis 5.0.7 leads to a denial of service (DOS). The vendor cannot reproduce this issue in a released version, such as 5.0.7.
All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.
Libsixel w wersji 1.8.3 zawiera przepełnienie bufora na stercie w funkcji sixel_encode_highcolor w pliku tosixel.c. Ta podatność może prowadzić do nieautoryzowanego dostępu do pamięci.
Libsixel w wersji 1.8.2 zawiera przepełnienie bufora na stercie w funkcji dither_func_fs w pliku tosixel.c. Ta podatność może prowadzić do nieautoryzowanego dostępu do pamięci.
Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could result in multiple out-of-bounds write instances. An attacker could leverage this vulnerability to execute code in the context of the current process.
In MISP before version 2.4.148, the file app/Lib/Export/OpendataExport.php mishandles the parameter data used in a shell_exec call.
W podatności CVE-2021-31843 w McAfee Endpoint Security (ENS) dla systemu Windows przed aktualizacją z września 2021 roku występuje niewłaściwe zarządzanie uprawnieniami. Umożliwia to lokalnym użytkownikom dostęp do plików, do których normalnie nie powinni mieć dostępu, poprzez manipulację linkami junction w celu przekierowania operacji folderów McAfee do niezamierzonej lokalizacji.
A vulnerability in Apache HTTP Server allows a remote attacker to redirect requests via mod_proxy to an origin server of their choice using a crafted URI path. Affects versions 2.4.48 and earlier.
In Jfinal CMS 5.1.0, improper access control allows attackers to read sensitive information by directly requesting the file /classes/conf/db.properties&config=filemanager.config.js.
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
Information disclosure vulnerability in Microsoft Accessibility Insights for Android. Could allow an attacker to access sensitive data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS