CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall devices, as exploited in the wild in April 2020. This affected devices configured with either the administration (HTTPS) service or the User Portal exposed on the WAN zone. A successful attack may have caused remote code execution that exfiltrated usernames and hashed passwords for local device admins, portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords).
Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1. Targeted attacks in the wild abusing this flaw are known.
Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1. Targeted attacks in the wild abusing this flaw are known.
A CWE-74 vulnerability exists in EcoStruxure Machine Expert – Basic and SoMachine Basic programming software, which involves improper neutralization of special elements in output used by downstream components. This vulnerability could lead to DLL substitution, allowing the transfer of malicious code to the controller.
A CWE-319 vulnerability exists that allows sensitive information to be transmitted in cleartext between the software and Modicon M218, M241, M251, and M258 controllers.
An issue was discovered in Sonatype Nexus Repository Manager in versions 3.21.1 and 3.22.0. It is possible for a user with appropriate privileges to create, modify, and execute scripting tasks without use of the UI or API. NOTE: in 3.22.0, scripting is disabled by default (making this not exploitable).
A vulnerability in the web server for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileges or cause a reload of an affected IP phone, resulting in a denial of service (DoS) condition. The vulnerability is due to a lack of proper input validation of HTTP requests.
An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'.
A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript format. For all systems except Windows 10, an attacker who successfully exploited the vulnerability could execute code remotely.
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'.
A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript format. For all systems except Windows 10, an attacker who successfully exploited the vulnerability could execute code remotely.
W aplikacji Zdalny pulpit dla systemu Mac występuje podatność na podniesienie uprawnień, która pozwala atakującemu na załadowanie niepodpisanych binarnych plików. Jest to znane jako 'Podatność na podniesienie uprawnień w aplikacji Microsoft Remote Desktop dla systemu Mac'.
Vulnerability in PeopleSoft Enterprise CS Campus Community product (component: Self-Service) version 9.2. Allows a low privileged attacker with network access via HTTP to gain unauthorized read access to a subset of data, potentially impacting additional products.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8.
W Arm Mbed TLS przed wersją 2.16.6 oraz 2.7.x przed wersją 2.7.15 odkryto problem, który pozwala atakującemu na odzyskanie długoterminowego klucza prywatnego ECDSA. Atak opiera się na pomiarach bocznych, które umożliwiają rekonstrukcję współrzędnych projektowych oraz wykorzystanie ataków do uzyskania klucza prywatnego.
Wtyczka Snap Creek Duplicator przed wersją 1.3.28 dla WordPressa (oraz Duplicator Pro przed wersją 3.8.7.1) umożliwia atak typu Directory Traversal poprzez wykorzystanie sekwencji ../ w parametrze pliku dla funkcji duplicator_download lub duplicator_init.
W funkcji snd_ctl_elem_add w jądrze Linuxa do wersji 5.6.3 występuje problem związany z linią count=info->owner, co wpływa na mnożenie private_size*count, prowadząc do nieokreślonych 'interesujących efektów ubocznych'. Inżynierowie jądra kwestionują tę podatność, twierdząc, że może być istotna tylko w przypadku dodania nowych wywołań, które nie są świadome niewłaściwego użycia pola info->owner.
Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls.
Amcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777. An authenticated remote attacker can abuse this issue to crash the device and possibly execute arbitrary code.
FasterXML jackson-databind w wersjach 2.x przed 2.9.10.4 niewłaściwie obsługuje interakcję między gadżetami serializacyjnymi a typowaniem, co jest związane z org.springframework.aop.config.MethodLocatingFactoryBean (znanym również jako spring-aop).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS