CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A type confusion issue exists in Apple products (macOS, iOS, iPadOS, watchOS, tvOS, Safari) due to improper state handling. Processing maliciously crafted web content may lead to arbitrary code execution.
A race condition exists in Apple products (macOS, iOS, iPadOS, watchOS, tvOS) due to improper locking. A malicious application may be able to elevate privileges. Apple is aware of reports that this issue may have been actively exploited.
In wpa_supplicant and hostapd 2.9, forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c.
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI normalization, which may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may theoretically allow bypass of URL based access control or remote code execution (RCE).
An arbitrary file write vulnerability in vRealize Operations Manager API prior to 8.4 allows an authenticated malicious actor with network access to write files to arbitrary locations on the underlying Photon OS.
A Server Side Request Forgery (SSRF) vulnerability in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the API to perform an SSRF attack to steal administrative credentials.
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 and BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2, the iControl REST interface has an unauthenticated remote command execution vulnerability.
The /password.html page of the Acexy Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) web management interface exposes the administrator password in plaintext. The page can be intercepted over HTTP.
The Acexy Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) web management allows changing the administrator password via a crafted HTTP GET request without prior authentication, only requiring knowledge of the default username (admin).
An improper boundary check in the DSP driver prior to SMR Mar-2021 Release 1 allows out-of-bounds memory access.
A vulnerability in the DSP driver prior to SMR Mar-2021 Release 1 allows attackers to load arbitrary ELF libraries inside the DSP.
An incorrect implementation handling file descriptors in the dpu driver prior to SMR Mar-2021 Release 1 results in memory corruption leading to kernel panic.
An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel information to userspace.
An information leakage vulnerability exists in Micro Focus Access Manager due to advanced configuration. It affects all versions prior to 5.0.
MicroLogix 1400 w wersji 21.6 i niższej może pozwolić zdalnemu, nieautoryzowanemu atakującemu na wysłanie specjalnie skonstruowanego pakietu Modbus, co umożliwia atakującemu pobranie lub modyfikację losowych wartości w rejestrze. W przypadku udanego wykorzystania tej podatności może dojść do przepełnienia bufora, co prowadzi do stanu odmowy usługi.
Podatność na eskalację uprawnień w McAfee Data Loss Prevention (DLP) dla systemu Windows przed wersją 11.6.100 pozwala lokalnemu, nisko uprzywilejowanemu atakującemu na załadowanie wybranych przez siebie bibliotek DLL poprzez wykorzystanie junctions. Wymaga to stworzenia i usunięcia junctions przez atakującego oraz wysłania konkretnego polecenia IOTL w odpowiednim czasie.
SeedDMS 5.1.x is affected by a cross-site request forgery (CSRF) vulnerability in out.EditFolder.php. An attacker can exploit this flaw to perform unauthorized actions on behalf of an authenticated user.
SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditDocument.php. An attacker can exploit this vulnerability to perform unauthorized actions on behalf of a victim.
Fluxbb 1.5.11 is vulnerable to a denial of service (DoS) attack by sending an extremely long password via the login form. The password hashing process exhausts CPU and memory resources on the server.
Serwer NATS w wersjach 2.x przed 2.2.0 oraz biblioteka JWT przed 2.0.1 mają niewłaściwe zarządzanie kontrolą dostępu z powodu błędnego przetwarzania powiązań tokenów importu.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS