CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Występuje podatność na zdalne wykonanie kodu, gdy kodek Windows Media Audio niewłaściwie obsługuje obiekty. Atakujący, który skutecznie wykorzysta tę podatność, może przejąć kontrolę nad dotkniętym systemem.
Występuje podatność na podniesienie uprawnień, gdy usługa Windows Print Spooler niewłaściwie pozwala na dowolne zapisywanie w systemie plików. Atakujący, który skutecznie wykorzysta tę podatność, może uruchomić dowolny kod z podwyższonymi uprawnieniami systemowymi.
W Microsoft Dynamics 365 dla Finansów i Operacji (wersja lokalna) 10.0.11 występuje podatność umożliwiająca zdalne wykonanie kodu. Atakujący, który skutecznie wykorzysta tę podatność, może uzyskać zdalne wykonanie kodu poprzez wykonanie skryptu po stronie serwera na serwerze ofiary.
Istnieje podatność na zdalne wykonanie kodu, która występuje, gdy Microsoft .NET Framework przetwarza dane wejściowe. Atakujący, który skutecznie wykorzysta tę podatność, może przejąć kontrolę nad podatnym systemem.
W Visual Studio Code występuje podatność na zdalne wykonanie kodu, która pojawia się podczas przetwarzania zmiennych środowiskowych po otwarciu projektu. Atakujący, który skutecznie wykorzysta tę podatność, może uruchomić dowolny kod w kontekście bieżącego użytkownika.
A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. The vulnerability is due to insufficient validation of resources loaded by the application. An attacker could send a crafted IPC message to the AnyConnect process, leading to arbitrary code execution with SYSTEM privileges.
A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server.
FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items. An attacker can manipulate database queries.
vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. This issue exists because of an incomplete fix for CVE-2019-16759.
A rogue webpage could override the injected WKUserScript used by the download feature, this exploit could result in the user downloading an unintended file. This vulnerability affects Firefox for iOS < 28.
A rogue webpage could override the injected WKUserScript used by the logins autofill, potentially leaking a password for the current domain. Affects Firefox for iOS < 28.
Sonatype Nexus Repository Manager OSS/Pro version before 3.25.1 allows Remote Code Execution.
Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (Issue 2 of 2). This enables injection of malicious script into the user interface.
Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (issue 1 of 2). This enables injection of malicious script into the user interface.
A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to craft a URI to perform arbitrary code execution via the admin web interface.
An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if they changed the case of their username.
A vulnerability in the web services interface of Cisco ASA and FTD Software allows an unauthenticated, remote attacker to perform directory traversal attacks and read sensitive files. The issue is due to lack of proper input validation of URLs in HTTP requests. A successful exploit allows viewing arbitrary files within the web services file system when WebVPN or AnyConnect features are enabled.
In Apache ActiveMQ Artemis versions 2.5.0 to 2.13.0, there is an XSS vulnerability that can be exploited through a specially crafted MQTT packet containing an XSS payload in the client-id or topic name. The XSS payload is injected into the admin console's browser.
An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.
Vulnerability in Oracle WebLogic Server (component: Core) affects versions 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0. Easily exploitable by unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server, resulting in takeover. CVSS 3.1 Base Score 9.8.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS