CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links, known as 'Windows Installer Elevation of Privilege Vulnerability'.
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, known as 'Scripting Engine Memory Corruption Vulnerability'.
A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests.
Netis WF2419 is vulnerable to authenticated Remote Code Execution (RCE) as root through the router Web management page. The vulnerability exists in firmware versions V1.2.31805 and V2.2.36123 due to lack of user input sanitizing in the tracert diagnostic tool.
TeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control because the same key is used for different customers' installations. An attacker knowing this key could decrypt protected information stored in the registry or configuration files, and in versions before v9.x, decrypt the Unattended Access password.
An issue was discovered in EyesOfNetwork 5.3. The sudoers configuration is prone to a privilege escalation vulnerability, allowing the apache user to run arbitrary commands as root via a crafted NSE script for nmap 7.
An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key (hardcoded as EONAPI_KEY in include/api_functions.php for API version 2.4.2) by default for all installations, hence allowing an attacker to calculate/guess the admin access token.
PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.
A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a reload on an affected device. It is due to improper validation of string input from certain fields in Cisco Discovery Protocol messages. Sending a malicious CDP packet could cause a stack overflow, potentially allowing code execution with administrative privileges.
DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed in Vigor3900/2960/300B v1.5.1.
ABRT might allow attackers to obtain sensitive information from crash reports.
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.
A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and local file reading. Exploiting the vulnerability requires the victim to click a link preview from a specially crafted text message.
Vulnerability in Oracle Coherence (component: Caching, CacheStore, Invocation) allows an unauthenticated attacker with network access via T3 to compromise the product. Affected versions are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, and 12.2.1.4.0. CVSS 3.0 Base Score 9.8.
Vulnerability in Oracle WebLogic Server (component: WLS Core Components) allows an unauthenticated attacker with network access via IIOP to compromise the server. Affected versions are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, and 12.2.1.4.0. CVSS 3.0 Base Score 9.8.
A remote code execution vulnerability exists in Microsoft .NET Framework due to improper input validation, aka '.NET Framework Remote Code Execution Injection Vulnerability'.
An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files. To exploit, an attacker would first have to gain execution on the victim system.
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source.
OpenJPEG through 2.3.1 has a heap-based buffer overflow in opj_t1_clbl_decode_processor in openjp2/t1.c because of lack of opj_j2k_update_image_dimensions validation.
A Bash script injection vulnerability in Kemp Load Master 7.1-16 and earlier due to insufficient input sanitization in the Web User Interface (WUI).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS