CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 and BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2, the iControl REST interface has an unauthenticated remote command execution vulnerability.
A flaw was found in gnutls. A use-after-free issue in client_send_params in lib/ext/pre_shared_key.c may lead to memory corruption and other potential consequences.
A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to memory corruption and other consequences.
Unsigned code execution vulnerability in Azure Sphere. An attacker could exploit this flaw to run unauthorized code.
Remote code execution vulnerability in Windows DNS Server. An attacker could exploit it to execute code on the DNS server.
Remote code execution vulnerability in Windows DNS Server. An attacker could exploit it to execute code on the DNS server.
Remote code execution vulnerability in Windows DNS Server. An attacker could exploit this flaw to execute arbitrary code in the context of the service.
Remote code execution vulnerability in Windows DNS Server. An attacker could exploit this flaw to execute arbitrary code in the context of the service.
Remote code execution vulnerability in Windows DNS Server. An attacker could exploit it to execute code on the DNS server.
Remote code execution vulnerability in Windows Hyper-V. An attacker could exploit this flaw to execute arbitrary code on the host.
A PHP object injection vulnerability in profile.php of qcubed (all versions including 3.1.1) unserializes untrusted data from the POST variable "strProfileData", allowing an unauthenticated attacker to execute arbitrary code via a crafted POST request.
A SQL injection vulnerability in qcubed (all versions up to 3.1.1) in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request.
Rockwell Automation Studio 5000 Logix Designer w wersjach 21 i nowszych oraz RSLogix 5000 w wersjach od 16 do 20 są podatne na atak, który pozwala nieautoryzowanemu użytkownikowi obejść mechanizm weryfikacji komunikacji z kontrolerami Logix. Atakujący może uwierzytelnić się z użyciem urządzeń CompactLogix i ControlLogix.
Remote code execution vulnerability in Microsoft Exchange Server. Allows an attacker to execute arbitrary code on the server.
Microsoft Exchange Server contains a remote code execution vulnerability. This vulnerability can be exploited by an attacker to execute arbitrary code on the server.
Remote code execution vulnerability in Microsoft Exchange Server. Allows an attacker to execute arbitrary code on the server.
SerComm AG Combo VD625 devices running AGSOT_2.1.0 are vulnerable to CRLF injection in the download function via the Content-Disposition header. This allows an attacker to inject arbitrary HTTP headers.
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA_9_12_380 and later.
Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS