CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Broadcom RAID Controller is vulnerable to privilege escalation to root due to the creation of insecure folders by the Web GUI.
Broadcom RAID Controller is vulnerable to privilege escalation by taking advantage of session prints in the log file.
The Broadcom RAID Controller web interface is vulnerable due to an insecure default HTTP configuration that does not provide X-Content-Type-Options headers.
The Broadcom RAID Controller web interface is vulnerable to improper session handling of managed servers on Gateway installation.
The Broadcom RAID Controller web interface is vulnerable due to an insecure default HTTP configuration that does not safeguard cookies with the Secure attribute.
The Broadcom RAID Controller web interface is vulnerable due to an insecure default HTTP configuration that does not safeguard the SESSIONID cookie with the SameSite attribute.
The Broadcom RAID Controller web interface is vulnerable due to the use of Libcurl, which has known vulnerabilities.
The Broadcom RAID Controller web interface is vulnerable due to insecure defaults lacking HTTP Content-Security-Policy headers.
The Broadcom RAID Controller web interface is vulnerable to improper session management of active sessions on Gateway setup.
COMFAST CF-XR11 version V2.7.2 has a command injection vulnerability detected at function sub_4143F0. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter timestr.
Version 2.7.2 of the COMFAST CF-XR11 device contains a vulnerability that allows an attacker to execute arbitrary code via the ifname and mac parameters in the sub_410074 function in the bin/webmgnt file.
Version 2.7.2 of the COMFAST CF-XR11 device contains a vulnerability that allows an attacker to execute arbitrary code via the destination parameter of the sub_431F64 function in the bin/webmgnt file.
An issue in Wavlink WL_WNJ575A3 v.R75A3_V1410_220513 allows a remote attacker to execute arbitrary code via the username parameter of the set_sys_adm function in adm.cgi.
Versions of llama_index up to 0.7.13 contain a vulnerability that allows a remote attacker to execute arbitrary code via the `exec` parameter in the PandasQueryEngine function.
An issue in pandas-ai versions 0.9.1 and earlier allows a remote attacker to execute arbitrary code via the _is_jailbreak function.
Versions of langchain langchain-ai up to 0.0.232 contain a vulnerability that allows a remote attacker to execute arbitrary code via a crafted script in the PythonAstREPLTool._run component.
File Upload vulnerability in Wolf-leo EasyAdmin8 v.1.0 allows a remote attacker to execute arbitrary code via the upload type function.
Versions of Harrison Chase langchain up to 0.0.194 contain a vulnerability that allows a remote attacker to execute arbitrary code via the from_math_prompt and from_colored_object_prompt functions.
An issue in Alluxio v.2.9.3 and before allows an attacker to execute arbitrary code via a crafted script to the username parameter of lluxio.util.CommonUtils.getUnixGroups(java.lang.String).
Version 0.0.231 of LangChain contains a vulnerability that allows a remote attacker to execute arbitrary code via the prompt parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS