CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
MISP version 2.4.136 has an XSS vulnerability via galaxy cluster element values to app/View/GalaxyElements/ajax/index.ctp. Reference types could contain javascript: URLs.
MISP version 2.4.136 has a Stored XSS vulnerability in the galaxy cluster view that can be exploited via a cluster name in app/View/GalaxyClusters/view.ctp.
The default setting of MISP 2.4.136 did not require providing the previous password when changing a password, which may lead to unauthorized changes.
A Bleichenbacher vulnerability in the PKCS #1 v1.5 padding implementation for RSA in Microchip Libraries for Applications (versions up to 2018-11-26) allows an attacker to decrypt encrypted ciphertext by making successive queries to the server, resulting in remote information disclosure.
Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.
Use after free in Media in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59, and 7.0.0 to 7.0.106 are susceptible to JSP source code disclosure in some configurations when serving resources from a network location on the NTFS file system. The root cause is the unexpected behavior of the JRE API File.getCanonicalPath(), caused by inconsistent behavior of the Windows API (FindFirstFileW).
Adobe Campaign Classic Gold Standard 10 (and earlier), 20.3.1 (and earlier), 20.2.3 (and earlier), 20.1.3 (and earlier), 19.2.3 (and earlier) and 19.1.7 (and earlier) are affected by a server-side request forgery (SSRF) vulnerability. Successful exploitation could allow an attacker to use the Campaign instance to issue unauthorized requests to internal or external resources.
A vulnerability in the Snort application detection engine of multiple Cisco products could allow an unauthenticated, remote attacker to bypass configured policies. The issue is due to a flaw in the detection algorithm. An attacker could send crafted packets through an affected system, potentially bypassing policies and delivering a malicious payload.
A vulnerability with TCP Fast Open (TFO) when used with the Snort detection engine in multiple Cisco products could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. The issue is due to incorrect detection of the HTTP payload if it is contained at least partially within the TFO connection handshake. An attacker could send crafted TFO packets with an HTTP payload through an affected device, potentially bypassing the policy and delivering a malicious payload.
A vulnerability in the Snort detection engine affecting multiple Cisco products could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. The issue is due to incorrect handling of an HTTP range header. An attacker could send crafted HTTP packets to bypass file policy and deliver a malicious payload.
Microsoft Defender contains a remote code execution vulnerability. Details of the vulnerability are not provided in the description.
Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.
A buffer overflow vulnerability has been discovered in K7AntiVirus Premium 15.1.0.53 by K7Computing Pvt Ltd, affecting the K7TSMngr.exe process. This vulnerability allows a local attacker to execute arbitrary code on the system.
The vulnerability in K7Computing Pvt Ltd K7AntiVirus Premium 15.01.00.53 is caused by incorrect access control. It allows a local attacker to gain elevated privileges on the system.
A buffer overflow vulnerability has been discovered in K7Antivirus Premium 15.1.0.53 by K7Computing Pvt Ltd, specifically in the K7TSMngr.exe component. This vulnerability allows a local attacker to execute arbitrary code.
A buffer overflow vulnerability has been discovered in K7AntiVirus Premium 15.01.00.53 by K7Computing, specifically in the K7TSMngr.exe process. This flaw allows a local attacker to execute arbitrary code.
The vulnerability in K7Computing Pvt Ltd K7AntiVirus Premium 15.1.0.53 is caused by incorrect access control in the K7TSMngr.exe component. It allows a local attacker to escalate privileges on the system.
The vulnerability in K7Antivirus Premium 15.1.0.53 is caused by incorrect access control in the K7Sentry.sys driver. It allows a local attacker to execute a process with elevated privileges.
A blind SQL injection vulnerability based on time exists in zzcms version 201910, exploitable through cookie manipulation. An attacker can inject malicious SQL queries via cookie parameters, leading to unauthorized database access.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS