CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Klient w OpenSSH przed wersją 7.2 niewłaściwie obsługuje nieudane generowanie ciasteczek dla nieufnego przekazywania X11 i polega na lokalnym serwerze X11 w podejmowaniu decyzji o kontroli dostępu. To pozwala zdalnym klientom X11 na wywołanie mechanizmu awaryjnego i uzyskanie uprawnień do zaufanego przekazywania X11, wykorzystując problemy konfiguracyjne na tym serwerze X11.
The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a non-UTF-8 attribute value, related to serialization.
The EjbObjectInputStream class in Apache TomEE before 1.7.4 and 7.x before 7.0.0-M3 allows remote attackers to execute arbitrary code via a crafted serialized object.
The Intellinet NFC-30ir IP Camera has a vendor backdoor that can allow a remote attacker access to a vendor-supplied CGI script in the web directory.
An SQL injection vulnerability exists in Pivotal Cloud Foundry (PCF) before version 238 and in UAA 2.x before 2.7.4.4, 3.x before 3.3.0.2, and 3.4.x before 3.4.1. This allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
In Apache Hadoop 2.x before 2.7.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.
Foscam networked devices use the same hardcoded SSL private key across different customers' installations, allowing remote attackers to defeat cryptographic protection mechanisms.
SolarWinds Log & Event Manager (LEM) before 6.3.1 Hotfix 4 allows an authenticated user to execute arbitrary commands.
Lenovo Updates (not Lenovo System Update) has a remote code execution vulnerability that allows man-in-the-middle attackers to execute arbitrary code.
Lenovo Customer Care Software Development Kit (CCSDK) versions earlier than 2.0.16.3 have a vulnerability that allows local users to escalate privileges and execute code with elevated privileges.
Synology Photo Station before version 6.3-2958 allows local users to gain privileges by leveraging setuid execution of the 'synophoto_dsm_user --copy-no-ea' command.
Synology Photo Station before 6.3-2958 allows remote authenticated guest users to execute arbitrary commands via shell metacharacters in the X-Forwarded-For HTTP header to photo/login.php.
In Fiyo CMS versions 2.x through 2.0.7, attackers may upload a webshell via the content parameter to '/dapur/apps/app_theme/libs/save_file.php', allowing code execution.
dde-daemon, the daemon process of DDE (Deepin Desktop Environment) versions 15.0 through 15.3, runs with root privileges and hardly identifies the user calling the function through D-Bus. Anyone can change the grub config, potentially creating a backdoor or escalating privileges.
The dwarf_macro5.c file in libdwarf before version 20160923 contains a vulnerability that allows remote attackers to cause a denial of service (NULL pointer dereference) via a debugging information entry using DWARF5 without a DW_AT_name.
Ninka before 1.3.2 might allow remote attackers to obtain sensitive information, manipulate license compliance scan results, or cause a denial of service (process hang) via a crafted filename.
CVE-2017-7185 is a use-after-free vulnerability in the mg_http_multipart_wait_for_boundary function in the Cesanta Mongoose Embedded Web Server Library. It allows remote attackers to cause a denial of service (crash) via a multipart/form-data POST request without a MIME boundary string.
NetApp Clustered Data ONTAP versions 8.1 through 9.1P1, when NFS or SMB is enabled, allows remote attackers to cause a denial of service via unspecified vectors.
The JIRA Workflow Designer Plugin in Atlassian JIRA Server before version 6.3.0 improperly uses an XML parser and deserializer, allowing remote attackers to execute arbitrary code, read arbitrary files, or cause a denial of service via a crafted serialized Java object.
The X509_Certificate::allowed_usage function in botan 1.11.x before 1.11.31 might allow attackers to have unspecified impact by leveraging a call with more than one Key_Usage set in the enum value.