CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution due to incorrect data validation. Affected appliances are SA 100, SA 400, and Virtual SA.
SCBS Online Sports Venue Reservation System v1.0 was found to have a local file inclusion (LFI) vulnerability. This allows an attacker to execute arbitrary code via a crafted PHP file.
An issue was discovered in MISP before version 2.4.158 related to PHAR deserialization.
Vulnerability in Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces) in versions 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise ADF, potentially leading to takeover. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).
Wtyczka SiteGround Security dla WordPressa jest podatna na obejście uwierzytelniania, co pozwala nieautoryzowanym użytkownikom zalogować się jako użytkownicy administracyjni. Problem wynika z braku weryfikacji tożsamości podczas początkowej konfiguracji 2FA, co umożliwia nieautoryzowanym użytkownikom skonfigurowanie 2FA dla oczekujących kont.
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as ../../../../repository/deployment/server/webapps. Affects WSO2 API Manager 2.2.0-4.0.0, WSO2 Identity Server 5.2.0-5.11.0, WSO2 Identity Server Analytics 5.4.0-5.6.0, WSO2 Identity Server as Key Manager 5.3.0-5.11.0, WSO2 Enterprise Integrator 6.2.0-6.6.0, WSO2 Open Banking AM 1.4.0-2.0.0, and WSO2 Open Banking KM 1.4.0-2.0.0.
JAI-EXT is an open-source project extending the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script via network request can lead to Remote Code Execution as the script is compiled into Java code via Janino and executed. This affects the downstream GeoServer project. Version 1.2.22 contains a patch that disables the ability to inject malicious code into the resulting script.
An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file. The vendor states that files can only be uploaded and published by trusted users, which is intentional.
An arbitrary file upload vulnerability in the file upload module of Skipper v0.9.1 allows attackers to execute arbitrary code via a crafted file.
An arbitrary file upload vulnerability in the file upload component of ButterCMS v1.2.8 allows attackers to execute arbitrary code via a crafted SVG file.
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.
SQL Injection vulnerability in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0. An attacker can inject malicious SQL queries via the input_id POST parameter in index.php.
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment; applications deployed as Spring Boot executable jars are not vulnerable to this specific exploit, but the vulnerability is more general in nature.
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
Online Banking System Protect v1.0 contains a local file inclusion (LFI) vulnerability via the pages parameter. This allows an attacker to read sensitive files on the server.
A remote code execution (RCE) vulnerability in Online Banking System Protect v1.0 allows attackers to execute arbitrary code via a crafted PHP file uploaded through the Upload Image function.
In Totolink A3100R V5.9c.4577, multiple pages can be read without authentication using curl or Burp Suite. Additionally, admin configurations can be set without requiring cookies.
The Totolink A3100R router with firmware version V5.9c.4577 is vulnerable to OS command injection. The ping function in the admin panel does not properly filter special characters, allowing an attacker to execute arbitrary commands.
An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead to remote code execution.
An access control issue was discovered in NUUO software version v03.11.00. This vulnerability may allow an unauthorized user to bypass security mechanisms.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS