CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
W wersjach SAP NetWeaver (Visual Composer 7.0 RT) 7.30, 7.31, 7.40, 7.50, brak ograniczeń pozwala uwierzytelnionemu atakującemu jako użytkownikowi niebędącemu administratorem na przesłanie złośliwego pliku przez sieć i wywołanie jego przetwarzania. To może prowadzić do uruchomienia poleceń systemu operacyjnego z uprawnieniami procesu Java Server.
Wersje SAP Web Dispatcher (7.49, 7.53, 7.77, 7.81 oraz różne wersje KRNL i KERNEL) pozwalają nieautoryzowanemu atakującemu na przesłanie złośliwie skonstruowanego żądania do serwera front-end. Może to prowadzić do pomylenia granic między złośliwymi a legalnymi wiadomościami przez serwer back-end, co skutkuje wykonaniem złośliwego ładunku.
In Kooboo CMS 2.1.1.0, it is possible to upload a remote shell (e.g., aspx) to the server and then call upon it to receive a reverse shell from the victim server. The files are uploaded to /Content/Template/root/reverse-shell.aspx and can be simply triggered by browsing that URL.
Kooboo CMS 2.1.1.0 is vulnerable to insecure file upload. The server does not verify file extensions, allowing an attacker to upload files with .aspx extension.
An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.
A permissions issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.4. A malicious application may be able to bypass Privacy preferences. Apple is aware of a report that this issue may have been actively exploited.
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 12.5.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
A memory corruption issue was addressed with improved state management. This issue is fixed in watchOS 7.4.1, iOS 14.5.1 and iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, macOS Big Sur 11.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
An integer overflow was addressed with improved input validation. This issue is fixed in iOS 14.5.1 and iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, Safari 14.1.1, macOS Big Sur 11.3.1. Processing maliciously crafted web content may lead to arbitrary code execution.
A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.1, iOS 12.5.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3, Security Update 2021-002 Catalina. A malicious application may bypass Gatekeeper checks.
A use-after-free vulnerability in WebKit, fixed in iOS 12.5.4, may lead to arbitrary code execution when processing malicious web content. Apple is aware of active exploitation.
A memory corruption vulnerability in WebKit, fixed in iOS 12.5.4, may allow arbitrary code execution when processing malicious web content. Apple is aware of active exploitation.
Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection. By sending a crafted HTTP request, a remote attacker may disclose sensitive information or request external resources from a vulnerable instance.
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.
In NTFS-3G versions prior to 2021.8.22, a stack buffer overflow occurs when correcting differences between the MFT and MFTMirror. This can lead to code execution or privilege escalation when running with setuid-root.
In NTFS-3G versions prior to 2021.8.22, supplying a specially crafted NTFS inode pathname in an NTFS image can cause a heap buffer overflow, resulting in memory disclosure, denial of service, and even code execution.
In NTFS-3G versions prior to 2021.8.22, a heap buffer overflow vulnerability exists when reading specially crafted NTFS attributes in the ntfs_attr_pread_i function. This can lead to arbitrary memory write or denial of service.
In NTFS-3G versions prior to 2021.8.22, a specially crafted Unicode string in an NTFS image can cause a heap buffer overflow, allowing arbitrary code execution.
In NTFS-3G versions prior to 2021.8.22, a heap buffer overflow vulnerability exists in the ntfs_attr_setup_flag function when processing a specially crafted NTFS attribute from the MFT. This can lead to arbitrary code execution and privilege escalation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS