CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.03)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The login page in Epiphany Cardio Server versions 3.3, 4.0, and 4.1 mishandles authentication requests, allowing remote attackers to conduct LDAP injection attacks and bypass intended access restrictions via a crafted URL.
SQL injection vulnerability in the login page in Epiphany Cardio Server 3.3 allows remote attackers to execute arbitrary SQL commands via a crafted URL.
The MIDI subsystem in Google Chrome before version 47.0.2526.106 does not properly handle the sending of data, allowing remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors.
The Adcon Telemetry A840 telemetry gateway has hardcoded credentials, allowing remote attackers to gain administrative access via unspecified vectors.
The ChangePasswordIndex method in PasswordReset.dll in Dovestones AD Self Password Reset before version 3.0.4.0 allows remote attackers to reset arbitrary passwords via a crafted request with a valid username.
eWON devices with firmware before version 10.1s0 omit RBAC for I/O server information and status requests, allowing remote attackers to obtain sensitive information via an unspecified URL.
Saia Burgess devices PCD1.M0xx0, PCD1.M2xx0, PCD2.M5xx0, PCD3.Mxx60, PCD3.Mxxx0, PCD7.D4xxD, PCD7.D4xxV, PCD7.D4xxWTPF, PCD7.D4xxxT5F, and PCD3.T665 and PCD3.T666 before versions 1.24.50 and 1.24.41 have hardcoded credentials, allowing remote attackers to gain administrative access via an FTP session.
SearchBlox 8.3 before 8.3.1 allows remote attackers to write to the config file, potentially leading to application crashes.
Wersje Juniper ScreenOS od 6.2.0r15 do 6.2.0r18 oraz od 6.3.0r12 do 6.3.0r20 przed odpowiednimi poprawkami umożliwiają zdalnym atakującym uzyskanie dostępu administracyjnego poprzez wprowadzenie nieokreślonego hasła podczas sesji SSH lub TELNET.
Interfejsy obiektów zserializowanych w niektórych produktach Cisco Collaboration i Social Media, a także w urządzeniach zabezpieczeń sieciowych, umożliwiają zdalnym atakującym wykonanie dowolnych poleceń za pomocą spreparowanego zserializowanego obiektu Java, związane z biblioteką Apache Commons Collections.
The BasicJsonStringifier::SerializeJSArray function in json-stringifier.h in the JSON stringifier in Google V8, as used in Google Chrome before version 47.0.2526.73, improperly loads array elements. This allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via crafted JavaScript code.
PCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits>) conditions, allowing remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression.
The pcre_compile function in PCRE before 8.38 mishandles certain [: nesting, which can lead to denial of service (CPU consumption) or other unspecified impacts via a crafted regular expression.
PCRE before 8.38 mishandles the [: and \ substrings in character classes, allowing remote attackers to cause a denial of service (uninitialized memory read) or possibly have unspecified other impact via a crafted regular expression.
PCRE before 8.38 mishandles the /(?:|a|){100}x/ pattern and related patterns, allowing remote attackers to cause a denial of service (infinite recursion) or possibly have unspecified other impact via a crafted regular expression.
PCRE before 8.38 mishandles the interaction of lookbehind assertions and mutually recursive subpatterns, allowing remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression.
PCRE before 8.38 mishandles certain repeated conditional groups, allowing remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression.
The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the 'Groovy variant in 'ysoserial'.
Komponent bezpieczeństwa WLS w Oracle WebLogic Server w wersjach 10.3.6.0, 12.1.2.0, 12.1.3.0 oraz 12.2.1.0 umożliwia zdalnym atakującym wykonanie dowolnych poleceń poprzez spreparowany zserializowany obiekt Java w ruchu protokołu T3 na porcie TCP 7001. Problem dotyczy modułu oracle_common/modules/com.bea.core.apache.commons.collections.jar.
The KVM subsystem in the Linux kernel through 4.2.6 and Xen 4.3.x through 4.6.x allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #DB (Debug) exceptions related to svm.c.