CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
BMC Remedy Mid Tier 9.1SP3 is affected by remote and local file inclusion. Due to the lack of restrictions on what can be targeted, the system can be vulnerable to attacks such as system fingerprinting, internal port scanning, Server Side Request Forgery (SSRF), or remote code execution (RCE).
An improper authorization vulnerability has been reported in QNAP NAS running HBS 3 (Hybrid Backup Sync). If exploited, the vulnerability allows remote attackers to log in to a device without proper authorization.
Zidentyfikowano podatność w różnych modelach paneli HMI SIMATIC oraz systemach SINAMICS, która dotyczy nieprawidłowego dostępu do pamięci w obsłudze układu urządzenia. Może to prowadzić do wykonania złośliwego kodu.
A remote code execution vulnerability exists in the HTTP Protocol Stack. Technical details are not provided in the description.
A stack buffer overflow vulnerability exists in /goform/setmac on Tenda AC11 devices with firmware through 02.03.01.104_CN. It allows attackers to execute arbitrary code via a crafted POST request.
An authentication bypass vulnerability exists in the administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface.
In Python before 3.9.5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.
Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information, see the Details section of the advisory.
Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information, see the Details section of the advisory.
In the Node.js mixme library before version 0.5.1, an attacker can add or alter object properties via '__proto__' using the mutate() and merge() functions. The polluted attribute is directly assigned to every object in the program.
A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 could allow unauthenticated remote attackers to bypass authentication.
A vulnerability in GitLab CE/EE from version 11.9 allows remote code execution due to improper validation of image files passed to a parser.
Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.
A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application.
System Recenzenta Online w wersji 1.0 zawiera podatność na wstrzykiwanie SQL poprzez obejście uwierzytelniania, co może prowadzić do przesyłania powłoki odwrotnej.
A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.
In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. There is no known practical attack exploiting this vulnerability.
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution.
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution.
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI normalization, which may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may theoretically allow bypass of URL based access control or remote code execution (RCE).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS