CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Remote code execution vulnerability in Microsoft Exchange Server. An attacker can exploit this flaw to execute arbitrary code on the server.
Remote code execution vulnerability in Microsoft Exchange Server. Allows an attacker to execute arbitrary code on the server.
An issue was discovered in app/Model/SharingGroupServer.php in MISP 2.4.139, where the implementation of Sharing Groups sometimes provided view access to unintended actors via the 'all org' flag.
A vulnerability exists in the SHA authentication scheme in Veritas Backup Exec before 21.2. An attacker can gain unauthorized access and execute arbitrary commands with system privileges.
A vulnerability exists in the SHA authentication scheme in Veritas Backup Exec before 21.2, which had not been disabled. An attacker could remotely exploit this scheme to gain unauthorized access to an Agent and execute privileged commands.
A vulnerability exists in the SHA authentication scheme in Veritas Backup Exec before 21.2. An attacker can gain unauthorized access and, using crafted input parameters, access an arbitrary file on the system with System privileges.
The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.
When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.
SerComm AG Combo VD625 devices running AGSOT_2.1.0 are vulnerable to CRLF injection in the download function via the Content-Disposition header. This allows an attacker to inject arbitrary HTTP headers.
Podatność CVE-2021-24105 pozwala atakującemu na wprowadzenie złośliwego pakietu do repozytoriów menedżerów pakietów, co może prowadzić do zdalnego wykonania kodu. Dotyczy to wielu menedżerów pakietów w różnych językach programowania, takich jak Python/pip, .NET/NuGet, Java/Maven oraz JavaScript/npm.
A vulnerability in the Win32k component of Windows allows elevation of privilege. An attacker could exploit it to gain higher privileges on the system.
The mongodb-client-encryption module version 1.2.0 for Node.js does not correctly validate the KMS server's certificate. In combination with a privileged network position MITM attack, it could allow interception of traffic between the Node.js driver and the KMS service, rendering field level encryption ineffective.
OpenSLP używany w ESXi (7.0 przed ESXi70U1c-17325551, 6.7 przed ESXi670-202102401-SG, 6.5 przed ESXi650-202102101-SG) ma podatność na przepełnienie sterty. Złośliwy aktor znajdujący się w tej samej sieci co ESXi, mający dostęp do portu 427, może wywołać problem przepełnienia sterty w usłudze OpenSLP, co może prowadzić do zdalnego wykonania kodu.
The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure.
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
A buffer overflow vulnerability exists in Yz1 versions 0.30 and 0.32, used in IZArc 4.4, ZipGenius 6.3.2.3116, and Explzh (extension) 8.14, related to filename handling. An attacker can execute arbitrary code by crafting a malicious archive file.
Yeastar NeoGate TG400 devices running firmware version 91.3.0.3 are affected by a directory traversal vulnerability. An authenticated user can decrypt the firmware and read sensitive information, such as passwords or decryption keys.
W urządzeniach PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 oraz PM800 występuje podatność CWE-319 związana z przesyłaniem wrażliwych informacji w postaci niezaszyfrowanej. Może to prowadzić do ujawnienia danych logowania użytkowników, gdy złośliwy aktor przechwyci ruch sieciowy HTTP między użytkownikiem a urządzeniem.
W urządzeniach PowerLogic ION7400, ION7650, ION7700/73xx, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 oraz PM800 występuje podatność CWE-319, polegająca na przesyłaniu wrażliwych informacji w postaci niezaszyfrowanej. Może to prowadzić do ujawnienia danych logowania użytkowników, gdy złośliwy aktor przechwyci ruch sieciowy Telnet między użytkownikiem a urządzeniem.
W urządzeniach PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 oraz PM800 występuje podatność typu CWE-352: Cross-Site Request Forgery. Może to spowodować, że użytkownik wykona niezamierzoną akcję na docelowym urządzeniu podczas korzystania z interfejsu webowego HTTP.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS