CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Przepełnienie bufora w AIDA64 Engineer w wersji 6.00.5100 firmy FinalWire Ltd umożliwia atakującym wykonanie dowolnego kodu poprzez stworzenie specjalnie przygotowanego wejścia, które nadpisuje obsługę SEH.
Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA_9_12_380 and later.
Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later.
Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call. The fixed version is FTA_9_12_416 and later.
Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html. The fixed version is FTA_9_12_380 and later.
Podatność CVE-2021-23840 dotyczy funkcji EVP_CipherUpdate, EVP_EncryptUpdate i EVP_DecryptUpdate w OpenSSL, które mogą powodować przepełnienie argumentu długości wyjścia, gdy długość wejścia jest bliska maksymalnej dozwolonej długości dla liczby całkowitej na danej platformie. W takich przypadkach funkcja zwraca wartość 1 (co oznacza sukces), ale wartość długości wyjścia jest ujemna, co może prowadzić do nieprawidłowego działania aplikacji lub ich awarii.
The systeminformation library for Node.js before version 5.3.1 contains a command injection vulnerability. The issue was fixed in version 5.3.1.
SQL injection vulnerability in PNPSCADA 2.200816204020 exists in the 'interf' parameter in /browse.jsp. It allows an attacker to inject malicious SQL code.
Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS) in /usr/local/nagiosxi/html/admin/sshterm.php due to improper input sanitization. A crafted URL can steal admin session cookies or be chained with other bugs for one-click RCE.
Nagios XI version xi-5.7.5 is affected by OS command injection due to improper sanitization of authenticated user input in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php.
A vulnerability in Nagios XI version xi-5.7.5 allows OS command injection. The issue exists in the switch.inc.php file due to improper sanitization of authenticated user input.
Nagios XI version xi-5.7.5 is affected by OS command injection in the file windowswmi.inc.php due to improper sanitization of authenticated user input. This allows execution of arbitrary commands on the server.
Adminer, an open-source database management tool in a single PHP file, versions 4.0.0 through 4.7.9 contain a server-side request forgery (SSRF) vulnerability. This affects versions bundling all drivers (e.g., adminer.php). The vulnerability is fixed in version 4.7.9.
Adobe Acrobat Reader DC versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier), and 2017.011.30188 (and earlier) are affected by a heap-based buffer overflow vulnerability. An unauthenticated attacker could exploit this to achieve arbitrary code execution in the context of the current user. Exploitation requires user interaction, such as opening a malicious file.
Oclean Mobile Application 2.1.2 communicates with an external website using HTTP, allowing network traffic eavesdropping. The HTTP payload is encrypted using XOR with a hardcoded key, enabling traffic decryption.
McAfee Total Protection (MTP) prior to 16.0.30 contains an arbitrary process execution vulnerability. A local user can gain elevated privileges and execute arbitrary code by bypassing MTP self-defense.
Zidentyfikowano podatność w panelach HMI Comfort SIMATIC (w tym warianty SIPLUS) oraz w różnych modelach SINAMICS, które mają włączoną usługę telnet. Urządzenia te nie wymagają uwierzytelnienia dla tej usługi, co może umożliwić zdalnemu atakującemu uzyskanie pełnego dostępu do urządzenia.
Google Chrome prior to 88.0.4324.150 contains a heap buffer overflow in V8. A remote attacker could potentially exploit heap corruption via a crafted HTML page.
CASAP Automated Enrollment System 1.0 is vulnerable to cross-site scripting (XSS) in users.php. An attacker can steal a user's session cookie and redirect them to a malicious website.
Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. The vulnerability could be exploited to allow Remote Code Execution on the OBR server.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS