CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system.
A vulnerability was discovered in MISP version 2.4.91 that allows reflected XSS. The issue is in app/View/Elements/eventattribute.ctp when a user clicks on a malicious link for an event view and then clicks on the deleted attributes quick filter.
Wersje curl od 7.20.0 do 7.59.0 zawierają podatność CWE-126: Buffer Over-read, która może prowadzić do odmowy usługi. Atakujący może oszukać curl, aby odczytał dane poza końcem bufora w pamięci, używanego do przechowywania pobranych treści RTSP.
Podatność CVE-2018-3639 dotyczy systemów z mikroprocesorami wykorzystującymi spekulacyjną egzekucję, które mogą ujawniać informacje osobom nieuprawnionym. Atakujący z lokalnym dostępem do systemu może wykorzystać analizę kanałów bocznych do uzyskania dostępu do danych, co jest znane jako Speculative Store Bypass (SSB), wariant 4.
Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of Untrusted Data vulnerability. Successful exploitation could lead to arbitrary code execution.
A vulnerability in the detection engine of Cisco Firepower Threat Defense software could allow an unauthenticated, remote attacker to bypass a configured SSL Access Control (AC) policy to block SSL traffic. The issue is due to incorrect handling of TCP SSL packets received out of order. An attacker could send a crafted SSL connection through the device, bypassing the AC policy.
W MyBiz MyProcureNet w wersji 5.0.0 odkryto problem, który pozwala atakującemu na przesłanie złośliwego pliku na serwer WWW. Atakujący może przesłać skrypt, który umożliwia wydawanie poleceń systemu operacyjnego.
Vulnerability in Spring Data Commons (versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7) used with XMLBeam 1.4.14 or earlier, results from improper restriction of XML external entity references. An unauthenticated remote attacker can send specially crafted request parameters to access arbitrary files on the system via projection-based request payload binding.
Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Remote Code Execution Vulnerability.' This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability.' This affects Windows Server 2008, Windows 7, Windows Server 2008 R2. This CVE ID is unique from CVE-2018-8124, CVE-2018-8164, CVE-2018-8166.
A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Microsoft COM for Windows Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user, it's simple to execute commands and retrieve their output.
An issue was discovered on Dasan GPON home routers. It is possible to bypass authentication simply by appending "?images" to any URL of the device that requires authentication, as demonstrated by the /menu.html?images/ or /GponForm/diag_FORM?images/ URI. One can then manage the device.
A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass configured file action policies if Intelligent Application Bypass (IAB) with a drop percentage threshold is also configured. The issue is due to incorrect counting of dropped traffic percentage. An attacker could send network traffic to the device, bypassing policies and allowing traffic that should be dropped.
A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass a configured file action policy to drop the SMB protocol if a malware file is detected. The issue is due to how SMB handles a case where a large file transfer fails. An attacker could send a crafted SMB file transfer request through the device, allowing an SMB file containing malware to pass.
A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass a configured file action policy intended to drop SMB2 and SMB3 protocols if malware is detected. The issue is due to incorrect detection of SMB2/SMB3 files based on total file length. An attacker could exploit this by sending a crafted SMB2 or SMB3 transfer request through the targeted device.
Multiple vulnerabilities in the Application Layer Protocol Inspection feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerabilities are due to logical errors during traffic inspection. An attacker could exploit these vulnerabilities by sending a high volume of malicious traffic across an affected device. An exploit could cause a deadlock condition, resulting in a reload. These affect many Cisco products including ASA 5500 Series, ASAv, Firepower 2100/4100/9300, and others.
A vulnerability in the Transport Layer Security (TLS) library of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a reload of the affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a malicious TLS message to an interface enabled for SSL services. Messages using SSLv3 or SSLv2 cannot be used to exploit this vulnerability. An exploit could cause a buffer underflow, triggering a crash. This affects ASAv, FTDv, and Firepower 2100 Series.
A vulnerability in the internal packet-processing functionality of Cisco Firepower Threat Defense (FTD) Software for Firepower 2100 Series could allow an unauthenticated, remote attacker to cause the device to stop processing traffic, resulting in a denial of service (DoS) condition. The issue is due to improper validation of IPv4 and IPv6 packets after reassembly.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS