CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Adobe XD versions 16.0 and earlier have a path traversal vulnerability. Successful exploitation could lead to arbitrary code execution.
A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered.
Citrix Workspace App before 1904 for Windows has an incorrect access control vulnerability, potentially allowing unauthorized access to resources.
A remote code execution vulnerability in Remote Desktop Services allows an unauthenticated attacker to execute code by sending specially crafted requests to the target system via RDP.
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format, e.g., JSON.
The LG N1A1 NAS device is vulnerable to remote command execution via HTTP POST requests with specific parameters, allowing arbitrary code execution.
A buffer overflow vulnerability in the WhatsApp VOIP stack allows remote code execution via specially crafted RTCP packets sent to a target phone number.
A vulnerability in Pulse Connect Secure allows an unauthenticated remote attacker to read arbitrary files by sending a specially crafted URI.
An authentication bypass issue was discovered in Open XDMoD through version 7.5.0, which can lead to account takeover. A weak password reset mechanism allows an attacker to perform a brute-force attack on the MD5 rid value, requiring only 600 guesses if they know the victim initiated a password reset process in the past few minutes.
The ZyXEL P660HN-T1A router has a command injection vulnerability in the Remote System Log forwarding function, accessible by an unauthenticated user via the remote_host parameter on the ViewLog.asp page.
Podatność CVE-2019-10952 dotyczy kontrolerów CompactLogix 5370 oraz GuardLogix 5370, które są narażone na atak polegający na wysłaniu spreparowanego żądania HTTP/HTTPS. Może to prowadzić do niedostępności serwera webowego oraz zdalnego wykonania kodu z powodu przepełnienia bufora na stosie.
Multiple wireless presentation devices (including Crestron AM-100, Barco wePresent, Extron ShareLink) have a command injection vulnerability in the file_transfer.cgi HTTP endpoint, allowing a remote unauthenticated attacker to execute OS commands as root.
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8.
libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.
In Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions, missing validation of security headers allows bypassing authentication in the staging service and deserializing user-controlled .NET objects. This leads to unauthenticated remote code execution on the server hosting Kentico.
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that attempts to execute JavaScript code, potentially leading to arbitrary command execution with the permissions of the Kibana process on the host system.
The Widget Connector macro in Atlassian Confluence Server before versions 6.6.12, 6.12.3, 6.13.3, and 6.14.2 allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.
urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.
Sonatype Nexus Repository Manager before 3.15.0 has incorrect access control, which may allow unauthorized users to perform operations they are not permitted to do.
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_requirev functions. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS