CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Execution of user-supplied JavaScript during array deserialization leading to an out-of-bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
The Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier, has a code execution vulnerability that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.
Kontrolery Rockwell Automation MicroLogix 1400 oraz moduły komunikacyjne 1756 ControlLogix są podatne na atak zdalny, który pozwala nieautoryzowanemu podmiotowi wysłać żądanie połączenia CIP. Po nawiązaniu połączenia, atakujący może zmienić konfigurację IP urządzenia, co prowadzi do utraty komunikacji z systemem.
An issue was discovered in MISP versions 2.4.9x before 2.4.99 related to improper handling of filenames in the STIX 1 import code. An unescaped filename string is used to construct a shell command, allowing a malicious authenticated user to execute arbitrary commands.
Arm Mbed TLS w wersjach przed 2.14.1, 2.7.8 i 2.1.17 umożliwia lokalnemu atakującemu bez uprawnień odzyskanie tekstu jawnego z odszyfrowania RSA, co dotyczy zestawów szyfrujących RSA bez (EC)DH(E).
Podatność w poleceniu configdownload interfejsu wiersza poleceń (CLI) Brocade Fabric OS w wersjach przed 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d może pozwolić lokalnemu atakującemu na ucieczkę z ograniczonej powłoki i uzyskanie dostępu do konta root.
W bibliotece libsixel w wersji 1.8.2 występuje przepełnienie bufora na stercie w funkcji image_buffer_resize w pliku fromsixel.c, co może prowadzić do odmowy usługi lub innych nieokreślonych skutków.
PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges (including administrator). A remote unauthenticated user can craft an HTTP request and override attributes of the 'include' directive in /public/login.htm and perform a Local File Inclusion attack, by including /api/addusers and executing it. By providing the 'id' and 'users' parameters, an unauthenticated attacker can create a user with read-write privileges (including administrator).
Buffer overflow in PCMan FTP Server 2.0.7 allows remote code execution via the APPE command.
Integer overflow in computing the required allocation size when instantiating a new JavaScript object in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
An elevation of privilege vulnerability exists when Windows improperly handles calls to Win32k.sys. This affects Windows Server 2008, Windows 7, and Windows Server 2008 R2.
An elevation of privilege vulnerability exists in Microsoft Exchange Server. This affects Microsoft Exchange Server.
A NULL pointer dereference vulnerability has been found in the ncurses library, possibly version 6.x, in the function _nc_name_match, which can lead to a denial of service attack.
In ncurses 6.1, a null pointer dereference in the _nc_parse_entry function in parse_entry.c leads to a denial of service attack. The program proceeds to the dereference code path even after detecting a "dubious character `*' in name or alias field".
The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects.
W urządzeniach Modicon M221, we wszystkich wersjach, występuje podatność związana z niewystarczającą weryfikacją autentyczności danych (CWE-345). Może to prowadzić do zmiany konfiguracji IPv4 (adres IP, maska i brama) podczas zdalnego połączenia z urządzeniem.
A vulnerability in the Session Initiation Protocol (SIP) inspection engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload or trigger high CPU, resulting in a denial of service (DoS) condition. The vulnerability is due to improper handling of SIP traffic. An attacker could exploit this vulnerability by sending SIP requests designed to trigger this issue at a high rate. Software updates addressing this vulnerability are not yet available.
An issue was discovered on Tenda AC7, AC9, and AC10 devices with specific firmware versions. A command injection vulnerability allows attackers to execute arbitrary OS commands via a crafted goform/setUsbUnload request because the formsetUsbUnload function executes a dosystemCmd function with untrusted input.
Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webflux. Such applications must also have a registration for serving static resources (e.g. JS, CSS, images, and others), or have an annotated controller that returns an org.springframework.core.io.Resource. Spring Boot applications that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS