CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In MISP before version 2.4.124, the file app/Model/feed.php allows administrators to choose arbitrary files for ingestion. This does not leak the full contents of a file but can leak strings that match certain patterns, such as passwords from database.php or GPG key passphrases from config.php.
Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).
FasterXML jackson-databind w wersjach 2.x przed 2.9.10.4 niewłaściwie obsługuje interakcję między gadżetami serializacji a typowaniem, co jest związane z org.apache.openjpa.ee.WASRegistryManagedRuntime (znanym również jako openjpa).
Wersje 2.x biblioteki FasterXML jackson-databind przed 2.9.10.4 niewłaściwie obsługują interakcję między gadżetami serializacyjnymi a typowaniem, co jest związane z org.apache.commons.proxy.provider.remoting.RmiProvider.
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms).
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy).
Urządzenia TP-Link Archer C50 V3 przed wersją Build 200318 Rel. 62209 są podatne na atak typu denial of service (DoS) poprzez specjalnie skonstruowany nagłówek HTTP zawierający nieoczekiwane pole Referer. Atakujący może zdalnie wywołać ten problem.
A CWE-754 vulnerability exists in the Quantum Ethernet Network module 140NOE771x1 and in Quantum and Premium processors with integrated Ethernet, which could lead to a Denial of Service (DoS) when sending a specially crafted command over Modbus.
The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use this vulnerability to execute shell commands as root on versions before 1.0.19.20 or inject HTML in password recovery emails in versions before 1.0.20.17.
Deserialization of untrusted data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).
Das U-Boot through 2020.01 allows attackers to bypass verified boot restrictions and subsequently boot arbitrary images by providing a crafted FIT image to a system configured to boot the default configuration.
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).
Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary data to an arbitrary path on affected installations and bypass ROOT login. Authentication is not required to exploit this vulnerability.
Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a content validation escape vulnerability which could allow an attacker to manipulate certain agent client components. An attempted attack requires user authentication.
A migration tool component in Trend Micro Apex One (2019) and OfficeScan XG contains a vulnerability that could allow remote attackers to execute arbitrary code on affected installations (RCE). An attempted attack requires user authentication.
VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0) contain a privilege escalation vulnerability due to improper use of setuid binaries. Successful exploitation may allow attackers with normal user privileges to escalate to root on the system where Fusion, VMRC or Horizon Client is installed.
W pliku configurationwatcher.go w Traefik 2.x przed wersją 2.1.4 oraz TraefikEE 2.0.0 występuje problem z niewłaściwym usuwaniem zawartości certyfikatów z dostawców przed zapisaniem ich w logach.
Unraid w wersji 6.8.0 umożliwia obejście uwierzytelniania, co może prowadzić do nieautoryzowanego dostępu do systemu.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS