CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload up to version 9.22.0. An attacker can upload malicious files without authentication.
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. Affects multiple Windows versions including Windows 7, Windows 10, and Windows Server.
Qemu zawiera podatność typu Buffer Overflow w funkcji rtl8139_do_receive w pliku hw/net/rtl8139.c, spowodowaną użyciem nieprawidłowego typu danych całkowitych.
A vulnerability in the TCP syslog module of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to exhaust 1550-byte buffers on an affected device, causing a DoS condition. The issue is due to a missing boundary check in an internal function. An attacker could exploit this by performing a man-in-the-middle attack between the device and its TCP syslog server and modifying TCP headers.
A vulnerability in the per-user-override feature of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass an access control list (ACL) configured for an interface. The issue is due to errors that could occur when constructing and applying per-user-override rules. An attacker could connect to a network through an affected device, potentially accessing resources that would typically be protected by the interface ACL.
A vulnerability in the FTP inspection engine of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The issue occurs when the software fails to release spinlocks under low memory conditions, if FTP inspection and an access control rule with an FTP file policy are configured. An attacker could exploit this by sending high-rate transit traffic to cause a low-memory condition.
A vulnerability in the cryptographic hardware accelerator driver of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a temporary DoS condition. The issue exists because the devices have limited DMA memory and the software improperly handles resources in low-memory conditions. An attacker could exploit this by sending sustained high-rate malicious traffic, potentially exhausting DMA memory and causing a reload.
A vulnerability in the Sourcefire tunnel control channel protocol in Cisco Firepower System Software on FTD sensors could allow an authenticated, local attacker to execute specific CLI commands with root privileges on the Cisco Firepower Management Center (FMC) or through FMC on other Firepower sensors. The issue is due to insufficient checks for certain CLI commands when executed via a Sourcefire tunnel. An attacker with root privileges on at least one sensor or FMC could send commands, potentially modifying configurations or deleting files.
An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to a SUID (or otherwise privileged) binary could use this flaw to escalate their privileges on the system. Kernel versions 2.6.x, 3.10.x and 4.14.x are believed to be vulnerable.
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Successful exploitation could lead to arbitrary code execution.
W wersji MCMS 4.6.5 odkryto podatność typu CSRF, która umożliwia dodanie konta administratora poprzez ms/basic/manager/save.do.
W Snap Creek Duplicator przed wersją 1.2.42 odkryto problem, który pozwala atakującemu na dostęp do pozostałych plików instalacyjnych (installer.php i installer-backup.php). W trakcie konfiguracji bazy danych możliwe jest wstrzyknięcie kodu PHP do pliku wp-config.php, co prowadzi do wykonania dowolnego kodu.
An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC). This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise through the order_by parameter.
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise.
An SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can lead to data compromise through SQL injection attacks.
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise.
W produkcie Modicon M221 firmy Schneider Electric występuje podatność związana z uprawnieniami, przywilejami i kontrolą dostępu. Umożliwia ona nieautoryzowanym użytkownikom dekodowanie hasła za pomocą tabeli tęczowej.
W produkcie Modicon M221 firmy Schneider Electric występuje podatność związana z uprawnieniami, która pozwala nieautoryzowanym użytkownikom na nadpisanie oryginalnego hasła własnym hasłem. W wyniku wykorzystania tej podatności, atakujący może przesłać oryginalny program z PLC.
W produkcie Modicon M221 firmy Schneider Electric występuje podatność związana z błędem zarządzania informacjami, która dotyczy wszystkich wersji przed firmware V1.6.2.0. Umożliwia ona nieautoryzowanym użytkownikom powtarzanie sekwencji uwierzytelniających.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS