CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be closed prematurely instead of producing a 400 response.
The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain. In order for this to happen, the HttpClient must have been explicitly configured to follow redirects.
Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 68.4.1, Thunderbird < 68.4.1, and Firefox < 72.0.1.
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
FasterXML jackson-databind w wersjach 2.x przed 2.9.10.4 niewłaściwie obsługuje interakcję między gadżetami serializacyjnymi a typowaniem, co dotyczy org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (znanego jako shaded hikari-config).
Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. An application may be able to execute arbitrary code with kernel privileges.
A vulnerability in the CLI of Cisco FXOS and Cisco UCS Manager Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying OS. The issue is due to insufficient input validation. An attacker could exploit this by including crafted arguments to specific commands. On Cisco UCS 6400 Series Fabric Interconnects, injected commands are executed with root privileges.
A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to read or write arbitrary files on the underlying operating system. This is due to insufficient input validation. An attacker could exploit this by including crafted arguments to a specific CLI command, allowing arbitrary file read or write.
The Ghostcat vulnerability in Apache Tomcat affects the AJP protocol. The default-enabled AJP connector listened on all IP addresses, allowing an attacker to read arbitrary files from the web application and process them as JSP, potentially leading to remote code execution.
Apache Tomcat versions 9.0.28 to 9.0.30, 8.5.48 to 8.5.50, and 7.0.98 to 7.0.99 contain a regression that causes invalid Transfer-Encoding headers to be incorrectly processed, leading to a possibility of HTTP Request Smuggling if Tomcat is behind a reverse proxy that incorrectly handles the invalid Transfer-Encoding header in a particular manner.
A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to incorrect handling of directory paths.
A vulnerability in the upgrade component of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to install a malicious file when upgrading. The issue is due to insufficient signature validation, and exploitation could allow uploading crafted code to the device.
Zimbra Collaboration Suite (ZCS) przed wersją 8.8.15 Patch 7 umożliwia atak typu SSRF, gdy zainstalowany jest zimlet WebEx i włączony jest zimlet JSP.
An issue was discovered in MISP before version 2.4.121 where ACLs for discussion threads were mishandled in app/Controller/ThreadsController.php and app/Model/Thread.php.
An issue was discovered in MISP before version 2.4.121 related to an incorrectly sanitized search string in the Galaxy view in app/View/Galaxies/view.ctp.
An issue was discovered in MISP before version 2.4.121 that did not consider the HTTP PUT method when trying to block a brute-force series of invalid requests.
An issue was discovered in MISP before version 2.4.121, which did not canonicalize usernames when trying to block a brute-force series of invalid requests.
An issue was discovered in MISP before version 2.4.121 that mishandled time skew between the web server and the database, potentially leading to ineffective protection against brute-force attacks.
A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, known as 'Microsoft Exchange Memory Corruption Vulnerability'.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS