CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A deserialization issue in Apple systems, fixed in Security Update 2021-005 Catalina, iOS 12.5.5, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, and watchOS 7.6.2, may allow a sandboxed process to circumvent sandbox restrictions. Apple is aware of active exploitation.
A buffer overflow issue in Apple systems, fixed in iOS 15.2 and iPadOS 15.2, may allow an application to execute arbitrary code with kernel privileges.
Wykryto przepełnienie całkowitoliczbowe, które zostało naprawione dzięki poprawionej walidacji wejścia. Problem ten został rozwiązany w tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2, iPadOS 15.2 oraz watchOS 8.3.
An out-of-bounds write issue in Apple systems, fixed in iOS 14.8.1 and iPadOS 14.8.1, and iOS 15.1 and iPadOS 15.1, may allow a malicious application to execute arbitrary code with kernel privileges.
A memory corruption issue in Apple systems, fixed in iOS 15.0.2 and iPadOS 15.0.2, macOS Monterey 12.0.1, iOS 14.8.1 and iPadOS 14.8.1, tvOS 15.1, watchOS 8.1, and macOS Big Sur 11.6.1, may allow an application to execute arbitrary code with kernel privileges. Apple is aware of active exploitation.
A type confusion issue in Apple systems, fixed in iOS 12.5.5, iOS 14.4 and iPadOS 14.4, macOS Big Sur 11.2, and security updates, may allow a malicious application to execute arbitrary code with kernel privileges. Apple is aware of exploits in the wild.
An integer overflow issue in Apple systems, fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, and watchOS 7.6.2, may lead to arbitrary code execution when processing a maliciously crafted PDF. Apple is aware of active exploitation.
A use-after-free vulnerability in WebKit, fixed by improved memory management. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
W OpenSSL, struktura ASN1_STRING, która przechowuje dane ciągu ASN.1, może nie być poprawnie zakończona znakiem NUL. Aplikacje mogą tworzyć poprawne struktury ASN1_STRING, które nie kończą się tym znakiem, co prowadzi do potencjalnych problemów z bezpieczeństwem w funkcjach drukujących dane ASN.1.
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker with sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
MISP version 2.4.148, in certain configurations, allows SQL injection via the $conditions['org'] value in the app/Model/Log.php file.
Realtek Jungle SDK versions v2.x through v3.4.14B includes an HTTP web server exposing a management interface (webs or boa) that is affected by multiple stack buffer overflows and arbitrary command execution flaws. The issues occur in functions such as formRebootCheck, formWsc, formWlanMultipleAP, formWlSiteSurvey, formStaticDHCP, and formSysCmd due to unsafe copying of parameters like submit-url, ifname, hostname, peerPin, and sysCmd. Successful exploitation allows remote attackers to achieve arbitrary code execution on the device.
Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affected by multiple memory corruption vulnerabilities and an arbitrary command injection vulnerability that can be exploited by remote unauthenticated attackers.
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1.
Sunhillo SureLine before 8.7.0.1.1 allows Unauthenticated OS Command Injection via shell metacharacters in ipAddr or dnsAddr /cgi/networkDiag.cgi.
A vulnerability in Nagios XI before version 5.8.5 allows local privilege escalation. This is due to the xi-sys.cfg file being imported from the var directory by scripts running with elevated privileges.
A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker could run arbitrary code with SYSTEM privileges, install programs, view/change/delete data, or create new accounts with full user rights.
Cross-site scripting (XSS) vulnerability in Microsoft Dynamics 365 (on-premises). Allows injection of malicious script into the application.
Vulnerability in Microsoft Azure Active Directory Connect allows authentication bypass. An attacker can gain unauthorized access to the system.
An elevation of privilege vulnerability in the Windows Update Medic Service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS