CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Podatność w superjson przed wersją 1.8.1 pozwala na wykonanie dowolnego kodu na serwerze przy użyciu wejścia superjson bez wcześniejszej autoryzacji. Wymagana jest jedynie implementacja przynajmniej jednego punktu końcowego, który korzysta z superjson podczas przetwarzania żądań.
An IDOR vulnerability in PrinterLogic Web Stack versions 19.1.1.13 SP9 and below allows an unauthenticated attacker to reassign drivers for any printer.
An SSRF vulnerability in PrinterLogic Web Stack versions 19.1.1.13 SP9 and below allows an attacker to use user-controlled input to craft a URL, enabling server-side requests to internal network resources.
Multiple Tenda devices are vulnerable to authentication bypass, allowing an attacker to obtain sensitive information. This vulnerability can be combined with authenticated command injection to achieve remote code execution (RCE).
Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.
A vulnerability in Oracle Access Manager (component: OpenSSO Agent) in versions 11.1.2.3.0, 12.2.1.3.0, and 12.2.1.4.0 allows an unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. CVSS 3.1 Base Score 9.8.
The JDBCAppender in Log4j 1.2.x accepts SQL statements as a configuration parameter, allowing attackers to manipulate SQL by entering crafted strings into input fields or headers of an application. This can lead to unintended SQL queries being executed.
Corenlp jest podatny na niewłaściwe ograniczenie odniesienia do zewnętrznych jednostek XML. Może to prowadzić do nieautoryzowanego dostępu do danych lub wykonania niebezpiecznych operacji.
The EAP-pwd implementations in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks due to cache access patterns. This issue exists because of an incomplete fix for CVE-2019-9495.
The SAE protocol implementations in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks due to cache access patterns. This issue exists because of an incomplete fix for CVE-2019-9494.
NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root.
The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (glibc) through 2.34 copies its hostname argument on the stack without validating its length. This may result in a buffer overflow, potentially leading to a denial of service or, if an application is not built with a stack protector enabled, arbitrary code execution.
The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.
My Cloud OS 5 był podatny na lukę typu przepełnienie stosu w usłudze FTP, która mogła być wykorzystana przez nieautoryzowanych atakujących w sieci. Luka została załatana poprzez dodanie zabezpieczeń przeciwko problemom z przepełnieniem stosu.
JPress v4.2.0 is vulnerable to remote code execution via the doUploadAndInstall function in the _AddonController. An attacker can upload a malicious file, leading to full server compromise.
When SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor because the user login stored in the session was not verified. An unauthenticated attacker may exploit this to escalate privileges and gain admin access to Zabbix Frontend.
The defineAttribute function in xmlparse.c in Expat (libexpat) before 2.4.3 has an integer overflow. This may lead to incorrect behavior of the XML parser.
The build_model function in xmlparse.c in Expat (libexpat) before 2.4.3 has an integer overflow. This may lead to incorrect behavior of the XML parser.
addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
Mbed TLS przed wersją 3.0.1 zawiera błąd podwójnego zwolnienia pamięci w określonych warunkach braku pamięci, co zostało udowodnione przez niepowodzenie funkcji mbedtls_ssl_set_session().
Vulnerability data from NVD (NIST) · CISA KEV · EPSS