CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4. An application may be able to execute arbitrary code with kernel privileges.
A memory corruption issue in Apple iOS and macOS due to insufficient input validation. It is fixed in iOS 12.1.4 and macOS Mojave 10.14.3 Supplemental Update. An application may be able to gain elevated privileges.
IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as 'admin', and then execute code as root or SYSTEM via TM1 scripting. IBM X-Force ID: 172094.
A vulnerability in SonicWall SMA100 allows an unauthenticated user to gain read-only access to unauthorized resources. This affects SMA100 version 9.0.0.3 and earlier.
The vulnerability in class.upload.php (versions up to 1.0.3 and 2.x up to 2.0.4), used in the K2 extension for Joomla! and other products, omits .pht from the set of dangerous file extensions, similar to CVE-2019-19576.
Seria PLC Omron CS i CJ posiada podatność na nieograniczony dostęp do zewnętrznego mechanizmu blokady. Umożliwia to potencjalnym atakującym dostęp do systemu bez odpowiednich uprawnień.
In RubyGem excon before version 0.71.0, a race condition exists around persistent connections. An interrupted connection (e.g., due to a timeout) leaves data on the socket, which is read by subsequent requests, returning content from the previous response. The race condition window is narrow, making intentional exploitation difficult.
W serii PLC CJ oraz CS firmy Omron, we wszystkich wersjach, atakujący może monitorować ruch między PLC a kontrolerem oraz powtarzać żądania, co może prowadzić do otwierania i zamykania zaworów przemysłowych.
W libsixel w wersji 1.8.2 odkryto problem związany z nadmiernym odczytem bufora w stercie w funkcji load_sixel w pliku loader.c.
Wersja 2.23 biblioteki stb_image.h, używana w libsixel i innych produktach, zawiera błąd przepełnienia bufora w pamięci sterty w funkcji stbi__load_main. Może to prowadzić do nieautoryzowanego odczytu danych z pamięci.
Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote code execution. (As of 2020.1.114, a default setting prevents the exploit. In 2019.3.1023, but not earlier versions, a non-default setting can prevent exploitation.)
A vulnerability in Windows when the Win32k component fails to properly handle objects in memory allows elevation of privilege.
W libsixel w wersji 1.8.2 odkryto problem związany z przepełnieniem bufora na stercie w funkcji load_pnm w pliku frompnm.c, spowodowanym przepełnieniem całkowitym.
W libsixel w wersji 1.8.2 odkryto problem związany z przepełnieniem całkowitym w funkcji sixel_decode_raw_impl w pliku fromsixel.c.
W wersji 1.8.2 biblioteki libsixel odkryto problem związany z przepełnieniem całkowitym w funkcji sixel_encode_body w pliku tosixel.c.
W wersji 1.8.2 biblioteki libsixel odkryto problem związany z przepełnieniem bufora w stercie w funkcji sixel_decode_raw_impl w pliku fromsixel.c.
OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.
This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions.
This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS