CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.20)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Podatność CVE-2024-49653 dotyczy Portfolleo, umożliwiając nieograniczone przesyłanie plików o niebezpiecznych typach, co pozwala na przesłanie powłoki sieciowej na serwer WWW. Problem ten dotyczy wersji Portfolleo od n/a do 1.2 włącznie.
Podatność CVE-2024-49652 dotyczy nieograniczonego przesyłania plików z niebezpiecznym typem w aplikacji 3D Work In Progress autorstwa Renaty Bracichowicz. Umożliwia to przesłanie powłoki sieciowej na serwer WWW, co może prowadzić do poważnych zagrożeń bezpieczeństwa.
A missing authentication for critical function in FortiManager and FortiManager Cloud allows an attacker to execute arbitrary code or commands via specially crafted requests.
Serwer FTP Xlight w wersjach poniżej 3.9.4.3 ma podatność na przepełnienie całkowitoliczbowe w logice parsowania pakietów serwera SFTP, co może prowadzić do przepełnienia sterty z wykorzystaniem treści kontrolowanej przez atakującego.
Seria DDC4000 firmy Kieback & Peter wykorzystuje słabe dane uwierzytelniające, co może umożliwić nieautoryzowanemu atakującemu uzyskanie pełnych praw administratora w systemie.
Seria DDC4000 firmy Kieback & Peter jest podatna na lukę typu path traversal, która może umożliwić nieautoryzowanemu atakującemu odczyt plików na systemie.
W systemie Casa Systems NTC-221 w wersji 2.0.99.0 i wcześniejszych występuje problem, który pozwala zdalnemu atakującemu na wykonanie dowolnego kodu poprzez spreparowany ładunek skierowany do komponentu /www/cgi-bin/nas.cgi.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack due to insufficient input validation. Successful exploit could allow unauthorized access, enabling viewing, corrupting, or deleting users' data and system configurations.
A command injection vulnerability in Vilo 5 Mesh WiFi System version 5.16.1.33 and earlier allows remote, authenticated attackers to execute arbitrary code by injecting shell commands into the device name.
Vilo 5 Mesh WiFi System version 5.16.1.33 and earlier suffers from insecure permissions. Lack of authentication in the custom TCP service on port 5432 allows remote, unauthenticated attackers to gain administrative access to the router.
A buffer overflow vulnerability in the local_app_set_router_wifi_SSID_PWD function of Vilo 5 Mesh WiFi System version 5.16.1.33 and earlier allows remote, unauthenticated attackers to execute arbitrary code by sending a password longer than 64 bytes.
A buffer overflow vulnerability in the local_app_set_router_wan function of Vilo 5 Mesh WiFi System versions up to 5.16.1.33 allows remote, unauthenticated attackers to execute arbitrary code by sending pppoe_username and pppoe_password fields longer than 128 bytes.
In the Vilo 5 Mesh WiFi system version 5.16.1.33 and earlier, the Boa webserver contains a buffer overflow vulnerability. A remote, unauthenticated attacker can exploit exceptionally long HTTP methods or paths to execute arbitrary code.
A buffer overflow vulnerability in the local_app_set_router_token function of Vilo 5 Mesh WiFi System version 5.16.1.33 and earlier. A remote, unauthenticated attacker can execute arbitrary code by reading the token and timezone JSON fields via sscanf into a fixed-length buffer.
A vulnerability in the Linux kernel's NFSv4 implementation can cause a NULL-pointer dereference in nfs42_complete_copies(). It occurs when an NFS client copies files from the NFS server mountpoint to another location on the same server, leading to a kernel crash during state recovery. This can result in system instability and service disruption.
In the Linux kernel, the NFS server (nfsd) has an issue in FREE_STATEID handling. Sending multiple FREE_STATEIDs for the same delegation stateid can lead to use-after-free or counter refcount underflow. The fix addresses the critical section in nfsd4_free_stateid() where the lock is dropped before calling nfs4_put_stid(), allowing the stateid to be found again.
A vulnerability was found in the Linux kernel's slhc_remember() function in the SLIP driver, which improperly validated network packets. Missing checks could lead to reading uninitialized memory, as reported by syzbot.
A vulnerability in the Linux kernel's NVMe subsystem was found, where the nvme_ns_head list is not properly protected by SRCU in nvme_mpath_revalidate_paths(). Lack of synchronization when removing namespaces can lead to use-after-free during concurrent scan work.
In the Linux kernel, the mana network driver has a race condition on the per-CQ variable napi work_done. After calling napi_complete_done(), the NAPIF_STATE_SCHED bit may be cleared, and another CPU can start the napi thread and access the per-CQ variable cq->work_done. If another thread sets it to a value >= budget, this thread will continue to run when it should stop, potentially causing memory corruption and panic. The fix saves the work_done variable in a local variable before napi_complete_done() to avoid corruption.
A vulnerability related to buffer overflow when parsing NFS reparse points has been fixed in the Linux kernel. The issue stemmed from incorrect calculation of the data buffer size, leading to access beyond its bounds.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS