CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by improper handling of Unicode encoding (with an incorrect netloc) during NFKC normalization. The impact is information disclosure (credentials, cookies, etc. cached against a given hostname). The components are urllib.parse.urlsplit and urllib.parse.urlparse. A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host.
Jenkins Pipeline: Groovy Plugin 2.63 and earlier has a sandbox bypass vulnerability that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.
Jenkins Script Security Plugin 1.53 and earlier has a sandbox bypass vulnerability that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.
Microsoft SharePoint has a remote code execution vulnerability when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'.
Wiele urządzeń Phoenix Contact umożliwia zdalnym atakującym nawiązywanie sesji TCP na porcie 1962, co pozwala na uzyskanie wrażliwych informacji lub wprowadzenie zmian. Przykładem jest wykorzystanie funkcji tworzenia kopii zapasowej do przeszukiwania wszystkich katalogów.
In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.
Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attackers actively exploited this vulnerability in the wild.
ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. In February 2019, attackers have actively exploited this in the wild to download and execute ransomware payloads on all endpoints managed by the VSA server. If the ManagedIT.asmx page is available via the Kaseya VSA web interface, anyone with access to the page is able to run arbitrary SQL queries, both read and write, without authentication.
Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions are susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
Spring Web Services versions 2.4.3, 3.0.4, and older unsupported versions of all three projects are susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.
FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.
FasterXML jackson-databind 2.x before 2.9.7 fails to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization. This allows remote attackers to execute arbitrary code.
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes functionality to read and write Machine Specific Registers (MSRs).
Netatalk w wersjach przed 3.1.12 jest podatny na zapis poza granicami w pliku dsi_opensess.c. Problem wynika z braku sprawdzania granic na danych kontrolowanych przez atakującego.
NoneCms V1.3 has a vulnerability in thinkphp/library/think/App.php that allows remote attackers to execute arbitrary PHP code via crafted use of the filter parameter, as demonstrated by the query string s=index/\think\Request/input&filter=phpinfo&data=1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS