CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
EMC Mainframe Enablers ResourcePak versions 7.6.0, 8.0.0, and 8.1.0 contains a fix for a privilege management vulnerability that could potentially be exploited by malicious users to compromise the affected system.
The forgotpassword.php file in GeniXCMS 1.0.2 lacks a rate limit, which may allow remote attackers to cause a denial of service (login inability) or conduct Arbitrary User Password Reset attacks.
A Password in Configuration File issue was identified in Dahua devices such as DH-IPC-HDBW23A0RN-ZS and others. This vulnerability could allow a malicious user to assume the identity of a privileged user and gain access to sensitive information.
W urządzeniach Hikvision z serii DS-2CD2xx2F-I, DS-2CD2xx0F-I, DS-2CD2xx2FWD, DS-2CD4x2xFWD, DS-2CD4xx5, DS-2DFx oraz DS-2CD63xx występuje problem z niewłaściwą autoryzacją. Wersje od V5.2.0 do V5.4.0 mogą pozwolić na eskalację uprawnień przez złośliwego użytkownika, co prowadzi do dostępu do wrażliwych informacji.
A Use of Client-Side Authentication issue was discovered in Advantech B+B SmartWorx MESR901 firmware versions 1.5.2 and prior. The web interface uses JavaScript to check client authentication and redirect unauthorized users.
All iRODS versions before 4.1.11 and 4.2.1 are vulnerable, allowing other iRODS users (potentially anonymous) to execute remote shell commands via iRODS virtual pathnames. Exploiting this vulnerability involves retrieving a virtual iRODS pathname containing a semicolon using igetwild.
An issue was discovered on Accellion FTA devices before FTA_9_12_180 due to the misuse of mysql_real_escape_string. This allows SQL injection via the app_id parameter in seos/courier/communication_p2p.php.
An issue was discovered on Accellion FTA devices before FTA_9_12_180 related to a regular expression that lacks an initial ^ character. This allows SSRF attacks with the file:///etc/passwd#https:// URL pattern.
An issue was discovered on Accellion FTA devices before FTA_9_12_180 related to LDAP Injection. The POST parameter 'filter' in ldaptest.html can be exploited.
An issue was discovered on Accellion FTA devices before FTA_9_12_180 related to an SQL injection vector via report_error.php?year='payload.
An issue was discovered on Accellion FTA devices before FTA_9_12_180 that allows Remote Code Execution using shell metacharacters in the method parameter seos/1000/find.api.
The pcre2test.c file in PCRE2 version 10.23 contains a vulnerability that allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression.
Atlassian SourceTree v2.5c and prior are affected by a command injection in the handling of the sourcetree:// scheme. It will lead to arbitrary OS command execution with a URL substring of sourcetree://cloneRepo/ext:: or sourcetree://checkoutRef/ext:: followed by the command.
Quick Heal Internet Security, Quick Heal Total Security, and Quick Heal AntiVirus Pro are vulnerable to memory corruption while parsing a malformed Mach-O file.
Quick Heal Internet Security, Total Security, and AntiVirus Pro version 10.1.0.316 are vulnerable to memory corruption while parsing a malformed Mach-O file.
Quick Heal Internet Security, Total Security, and AntiVirus Pro version 10.1.0.316 are vulnerable to Out of Bounds Write on a Heap Buffer due to improper validation of dwCompressionSize of WIM Header. This vulnerability can be exploited for Remote Code Execution and Privilege Escalation.
Vaultive O365 versions before 4.5.21 have an issue with handling PGP/MIME messages injected via IMAP or SMTP. The change in Content-Type header causes most mail user agents to be unable to decrypt the message correctly, leading to a denial of service.
Novell iManager 2.7.x before 2.7 SP7 Patch 10 HF1 and NetIQ iManager 3.x before 3.0.3.1 have a webshell upload vulnerability.
Gnulib before 2017-04-26 has a heap-based buffer overflow with the TZ environment variable. The error is in the save_abbr function in time_rz.c.
Pexip Infinity before version 14.2 allows remote attackers to cause a denial of service (service restart) or execute arbitrary code via vectors related to Conferencing Nodes.