CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use this vulnerability to execute shell commands as root on versions before 1.0.19.20 or inject HTML in password recovery emails in versions before 1.0.20.17.
Deserialization of untrusted data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).
Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary data to an arbitrary path on affected installations and bypass ROOT login. Authentication is not required to exploit this vulnerability.
Unraid w wersjach do 6.8.0 umożliwia zdalne wykonanie kodu. Ta podatność może być wykorzystana przez atakującego do uruchomienia nieautoryzowanego kodu na systemie.
W kontrolerach Rockwell Automation MicroLogix 1400 Series B w wersji v21.001 i wcześniejszych, oraz w kontrolerach MicroLogix 1100 i oprogramowaniu RSLogix 500 w wersji v12.001 i wcześniejszych, klucz kryptograficzny używany do ochrony hasła konta jest zakodowany na stałe w pliku binarnym RSLogix 500. Atakujący może zidentyfikować klucze kryptograficzne i wykorzystać je do dalszych ataków kryptograficznych.
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.
goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges (administrator) on a device, as demonstrated by a setString=new_user<*1*>administrator<*1*>123456 request.
SAP Solution Manager (User Experience Monitoring), version 7.2, due to Missing Authentication Check does not perform any authentication for a service resulting in complete compromise of all SMDAgents connected to the Solution Manager.
Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage class. This is related to the CewolfServlet and MDMLogUploaderServlet servlets.
Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability. The weblogin.cgi CGI executable fails to properly sanitize the username parameter, allowing a remote, unauthenticated attacker to execute arbitrary code with root privileges. Affected products include NAS326, NAS520, NAS540, NAS542, and end-of-support models NSA210, NSA220, NSA220+, NSA221, NSA310, NSA310S, NSA320, NSA320S, NSA325, and NSA325v2.
A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.
A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, which would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).
FasterXML jackson-databind w wersjach 2.x przed 2.9.10.4 niewłaściwie obsługuje interakcję między gadżetami serializacyjnymi a typowaniem, co dotyczy org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (znanego jako shaded hikari-config).
The Ghostcat vulnerability in Apache Tomcat affects the AJP protocol. The default-enabled AJP connector listened on all IP addresses, allowing an attacker to read arbitrary files from the web application and process them as JSP, potentially leading to remote code execution.
Zimbra Collaboration Suite (ZCS) przed wersją 8.8.15 Patch 7 umożliwia atak typu SSRF, gdy zainstalowany jest zimlet WebEx i włączony jest zimlet JSP.
FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter. This may allow remote code execution.
An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key (hardcoded as EONAPI_KEY in include/api_functions.php for API version 2.4.2) by default for all installations, hence allowing an attacker to calculate/guess the admin access token.
PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS