CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A broken or risky cryptographic algorithm was found in AnonAddy 0.8.5 within VerificationController.php. This vulnerability could allow an attacker to manipulate the verification process.
iTextPDF w wersji 7 oraz do (wyłączając 4.4.13.3) 7.1.17 umożliwia wstrzyknięcie poleceń poprzez nazwę pliku CompareTool, która jest niewłaściwie obsługiwana w linii poleceń gs (Ghostscript) w pliku GhostscriptHelper.java.
The fix for CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. Attackers with control over Thread Context Map (MDC) input data when using a non-default Pattern Layout with Context Lookup (e.g., $${ctx:loginId}) or Thread Context Map pattern (%X, %mdc, %MDC) can craft malicious input using a JNDI Lookup pattern, leading to information leak and remote code execution in some environments and local code execution in all environments.
Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in December 2021. For Enterprise builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18; for Enterprise builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3; for MSP builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18; for MSP builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3.
Podatność w Apache Log4j2 (w wersjach od 2.0-beta9 do 2.15.0, z wyjątkiem wydań zabezpieczeń 2.12.2, 2.12.3 i 2.3.1) pozwala atakującym na wykonanie dowolnego kodu poprzez kontrolowane przez nich wiadomości logów i parametry, gdy włączona jest substytucja wyszukiwania wiadomości. Od wersji 2.15.0 to zachowanie zostało domyślnie wyłączone, a w wersji 2.16.0 całkowicie usunięte.
A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).
A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p92 and 10.2.2r44p1 allows a remote, unauthenticated attacker to upload a file to any location on the filesystem. The FatPipe advisory identifier for this vulnerability is FPSA006.
A stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to potentially execute code as a 'nobody' user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier versions.
The Maharashtra State Electricity Board Mahavitara Android application version 8.20 and prior is vulnerable to remote account takeover due to an OTP fixation vulnerability in the password reset function.
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration.
A vulnerability in the firmware of multiple ASUS routers allows bypassing CAPTCHA protection against brute-force attacks. An attacker can send a specific HTTP request to perform unlimited login attempts.
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params. The vulnerability may allow an attacker to manipulate database queries.
Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded.
The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to remote code execution via a crafted payload in an IP address input field.
Remote code execution vulnerability in Microsoft Virtual Machine Bus (VMBus). An attacker could exploit this flaw to execute arbitrary code.
A vulnerability in Sitecore XP from version 7.5 to 8.2 Update-7 allows remote code execution through insecure deserialization. No authentication or special configuration is required to exploit this flaw.
A command injection vulnerability was discovered in the HNAP1 protocol on D-Link DIR-823G devices running firmware V1.0.2B05. An attacker can remotely execute arbitrary system commands by sending a crafted login request with shell metacharacters in the PrivateLogin field.
A vulnerability in the /cgi-bin/upload_firmware.cgi component of D-Link DIR-823G REVA1 1.02B05 allows attackers to cause a denial of service (DoS) via unspecified vectors.
A command injection vulnerability was discovered in the HNAP1 protocol in D-Link DIR-823G devices with firmware V1.0.2B05. An attacker can remotely execute arbitrary web scripts by sending shell metacharacters in the Captcha field during login.
An XML External Entity (XXE) vulnerability was found in Symphony 2.7.10 in the class.xmlelement.php file, potentially leading to information disclosure or denial of service (DOS).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS