CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/* request to the server. The vulnerability exists due to the usage of Sun ONE Application Framework (JATO) found in versions of Java 8 or earlier.
Remote code execution vulnerability in the Windows kernel. It could allow an attacker to execute code in the kernel context.
Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows before 15.2.3 HF2 are affected by this vulnerability.
Elevation of privilege vulnerability in Microsoft Exchange Server. Allows an attacker to elevate their privileges in the system.
Remote code execution vulnerability in Microsoft Exchange Server. Allows an attacker to execute arbitrary code remotely on the server.
W podatności CVE-2021-22779 występuje możliwość ominięcia uwierzytelniania poprzez spoofing w EcoStruxure Control Expert oraz powiązanych produktach. Dotyczy to wszystkich wersji przed V15.0 SP1 oraz wersji V15.0 SP1, co może prowadzić do nieautoryzowanego dostępu do kontrolera.
Kaseya VSA before 9.5.7 allows attackers to bypass the 2FA requirement. The 2FA check is enforced client-side instead of server-side and can be bypassed using a local proxy.
Kaseya VSA before 9.5.7 allows credential disclosure. The default download page (dl.asp) is unauthenticated and generates KaseyaD.ini with Agent_Guid and AgentPassword, which can be used to obtain a sessionId and bypass authentication.
In MISP version 2.4.144, the file app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp does not sanitize certain data related to generic-template:index.
A deserialization flaw in Apache Chainsaw versions prior to 2.1.0 could lead to malicious code execution.
W podatności CWE-20: Niewłaściwa walidacja danych wejściowych w urządzeniach PowerLogic EGX100 (wersje 3.0.0 i nowsze) oraz PowerLogic EGX300 (wszystkie wersje) może dojść do odmowy usługi lub zdalnego wykonania kodu poprzez specjalnie przygotowany pakiet HTTP.
W podatności CWE-20: Niewłaściwa walidacja danych wejściowych w urządzeniach PowerLogic EGX100 (wersje 3.0.0 i nowsze) oraz PowerLogic EGX300 (wszystkie wersje) może dojść do odmowy usługi lub zdalnego wykonania kodu poprzez specjalnie przygotowany pakiet HTTP.
W podatności CWE-20: Niewłaściwa walidacja danych wejściowych w urządzeniach PowerLogic EGX100 (wersje 3.0.0 i nowsze) oraz PowerLogic EGX300 (wszystkie wersje) może dojść do odmowy usługi lub zdalnego wykonania kodu poprzez specjalnie przygotowany pakiet HTTP.
W urządzeniach PowerLogic PM55xx, PM8ECC, EGX100 i EGX300 występuje podatność CWE-640 związana z słabym mechanizmem odzyskiwania hasła dla zapomnianego hasła. Może to umożliwić atakującemu uzyskanie dostępu na poziomie administratora do urządzenia.
There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.
Zidentyfikowano podatność w rodzinie kontrolerów SIMATIC Drive oraz innych urządzeniach, które mogą być narażone na obejście ochrony pamięci. Atakujący zdalny, nieautoryzowany, mający dostęp do portu 102/tcp, może potencjalnie zapisywać dowolne dane i kod w chronionych obszarach pamięci lub odczytywać wrażliwe dane.
Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code. This issue affects: Checkbox Survey versions prior to 7.
In Versa Director, a command injection vulnerability was detected that allows execution of arbitrary commands on the host operating system via a vulnerable application. The attack is possible when the application passes unsafe user-supplied data to a system shell, largely due to insufficient input validation.
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
The mq_notify function in the GNU C Library (glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS