CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unraid w wersjach do 6.8.0 umożliwia zdalne wykonanie kodu. Ta podatność może być wykorzystana przez atakującego do uruchomienia nieautoryzowanego kodu na systemie.
W kontrolerach Rockwell Automation MicroLogix 1400 Series B w wersji v21.001 i wcześniejszych, oraz w kontrolerach MicroLogix 1100 i oprogramowaniu RSLogix 500 w wersji v12.001 i wcześniejszych, klucz kryptograficzny używany do ochrony hasła konta jest zakodowany na stałe w pliku binarnym RSLogix 500. Atakujący może zidentyfikować klucze kryptograficzne i wykorzystać je do dalszych ataków kryptograficznych.
Podatność CVE-2020-6988 dotyczy kontrolerów Rockwell Automation MicroLogix 1400 oraz MicroLogix 1100, a także oprogramowania RSLogix 500. Zdalny, nieautoryzowany atakujący może wysłać żądanie do kontrolera, co pozwala na uzyskanie wartości używanych haseł do autoryzacji użytkownika po stronie klienta.
W kontrolerach Rockwell Automation MicroLogix 1400 Series B w wersji v21.001 i wcześniejszych, oraz w kontrolerach MicroLogix 1100, funkcja kryptograficzna używana do ochrony hasła jest odkrywalna. Dotyczy to również oprogramowania RSLogix 500 w wersji v12.001 i wcześniejszych.
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.
Elevation of privilege vulnerability in Windows Background Intelligent Transfer Service (BITS) due to improper handling of symbolic links.
goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges (administrator) on a device, as demonstrated by a setString=new_user<*1*>administrator<*1*>123456 request.
SAP Solution Manager (User Experience Monitoring), version 7.2, due to Missing Authentication Check does not perform any authentication for a service resulting in complete compromise of all SMDAgents connected to the Solution Manager.
In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android, Versions: Android kernel, Android ID: A-147882143, References: M-ALPS04356754.
In binder_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android, Versions: Android kernel, Android ID: A-145988638, References: Upstream kernel.
Zidentyfikowano podatność w rodzinie CPU SIMATIC S7-300 oraz powiązanych urządzeniach, które mogą zostać wywołane przez specjalnie skonstruowane pakiety wysyłane na port 102/tcp (Profinet). W wyniku tego urządzenie może przejść w tryb awarii, co wymaga ponownego uruchomienia systemu.
MISP version 2.4.122 has a Persistent XSS vulnerability in the sighting popover tool. This is related to the file app/View/Elements/Events/View/sighting_field.ctp.
MISP version 2.4.122 has a reflected XSS vulnerability via unsanitized URL parameters. This is related to app/View/Users/statistics_orgs.ctp.
setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in the SystemCommand parameter.
lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the fileName POST parameter.
CKEditor 4.0 before 4.14 contains a cross-site scripting (XSS) vulnerability in the HTML Data Processor. A remote attacker can inject arbitrary script through a crafted "protected" comment (with the cke_protected syntax).
Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage class. This is related to the CewolfServlet and MDMLogUploaderServlet servlets.
Wszystkie wersje sterowników PLC serii CJ firmy Omron są podatne na atak, w którym napastnik może wysłać serię specyficznych pakietów danych w krótkim czasie. To prowadzi do błędu usługi w module Ethernet PLC, co skutkuje odmową dostępu do usługi PLC.
D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.
Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability. The weblogin.cgi CGI executable fails to properly sanitize the username parameter, allowing a remote, unauthenticated attacker to execute arbitrary code with root privileges. Affected products include NAS326, NAS520, NAS540, NAS542, and end-of-support models NSA210, NSA220, NSA220+, NSA221, NSA310, NSA310S, NSA320, NSA320S, NSA325, and NSA325v2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS