CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating QTS to their latest versions.
This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, QNAP recommend updating Photo Station to their latest versions.
Vulnerability in class.upload.php (versions before 1.0.3 and 2.x before 2.0.4) omits .phar from the list of dangerous file extensions. This library is used in the K2 extension for Joomla! and other products.
W rhn-proxy znaleziono lukę, która może pozwolić na przesyłanie danych uwierzytelniających użytkowników w postaci niezaszyfrowanej podczas dostępu do RHN Satellite. Może to prowadzić do ujawnienia informacji, w tym wrażliwych danych uwierzytelniających.
In MISP 2.4.118 in app/Controller/TagsController.php, users can bypass intended restrictions on tagging data.
Crestron DMC-STRO 1.0 devices allow remote command execution as root via shell metacharacters in the ping function.
A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker to execute arbitrary commands with root privileges. The attacker must have either a valid credential or an active session token. The vulnerability is due to lack of input validation of the HTTP payload.
Out of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Use after free in PDFium in Google Chrome prior to version 78.0.3904.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could lead to arbitrary code execution.
The Quick Tabs module for Drupal has an XSS vulnerability in versions 6.x-2.x before 6.x-2.1, 6.x-3.x before 6.x-3.1, and 7.x-3.x before 7.x-3.3. This allows an attacker to inject client-side scripts.
Versions of Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, and 13.0.197.13 and below have incorrect access control.
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).
A CWE-200: Information Exposure vulnerability exists in Modicon Controllers (M340, Premium, Quantum) that could lead to the disclosure of hardcoded FTP credentials when using the controller's web server on an unsecure network.
In tesseract 2.03 and 2.04, an attacker can rewrite an arbitrary user file by guessing the PID and creating a link to the user's file. The vulnerability stems from insufficient protection of temporary file operations.
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. It could allow an attacker to execute arbitrary code in the context of the user.
Elevation of privilege vulnerability in Windows Universal Plug and Play (UPnP) service due to improper allowance of COM object creation.
An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user privileges, aka 'Windows Certificate Dialog Elevation of Privilege Vulnerability'. It could allow an attacker to gain higher privileges.
An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files. An authenticated attacker would need to run a specially crafted application to elevate privileges.
A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This can result in an XSS attack.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS