CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1, and 2.9.x before 2.9.5 allows unauthenticated remote code execution due to an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.
Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects.
A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose content from local files, HTTP, or FTP servers that might otherwise be unreachable.
An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. Sending a handcrafted message may cause a buffer overflow, which can be used to execute code remotely.
A vulnerability in the web interface of Cisco RV132W ADSL2+ Wireless-N VPN and RV134W VDSL2 Wireless-AC VPN Routers is due to incomplete input validation on user-controlled input in an HTTP request. An unauthenticated remote attacker can send a crafted HTTP request to execute arbitrary code with root privileges and gain full control of the system or cause it to reload.
A deserialization flaw in jackson-databind (versions before 2.6.7.1, 2.7.9.1, and 2.8.9) could allow an unauthenticated user to perform code execution by sending maliciously crafted input to the readValue method of the ObjectMapper.
A deserialization flaw was discovered in jackson-databind before 2.8.10 and 2.9.1, allowing an unauthenticated user to perform code execution by sending maliciously crafted input to the readValue method of ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.
A vulnerability in the SSL VPN functionality of Cisco ASA Software could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The issue is due to a double-free memory condition when the webvpn feature is enabled. An attacker could exploit this by sending multiple crafted XML packets to a webvpn-configured interface.
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to unauthenticated remote code execution. An attacker can transfer a serialized Java SignedObject to the Jenkins CLI, which is deserialized using a new ObjectInputStream, bypassing the existing blacklist-based protection mechanism.
Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.
Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution.
A vulnerability in Trustwave Secure Web Gateway (SWG) through version 11.8.0.27 allows remote attackers to append an arbitrary public key to the device's SSH Authorized Keys data, leading to remote root access.
The Biometric Shift Employee Management System allows arbitrary file download via directory traversal sequences in the form_file_name parameter in a download_form action.
Dozer improperly uses a reflection-based approach to type conversion, which might allow remote attackers to execute arbitrary code via a crafted serialized object.
The XXE vulnerability in the XML processing functionality in Play before version 2.2.6 and 2.3.x before 2.3.5 may allow remote attackers to read arbitrary files, cause denial of service, or have unspecified other impacts via crafted XML data.
The admin terminal in Hawt.io does not require authentication, allowing remote attackers to execute arbitrary commands via the k parameter.
A vulnerability in BAS920 and ISC2000 devices allows remote attackers to obtain sensitive information through a specific request. Attackers can gain credential information for the Supervisor/Administrator account.
A buffer overflow vulnerability in NetTransport Download Manager version 2.96L and earlier could allow remote HTTP servers to execute arbitrary code on NAS devices via a long HTTP response.
The Zend_Db_Select::order function in Zend Framework before 1.12.7 does not properly handle parentheses, allowing remote attackers to conduct SQL injection attacks via unspecified vectors.
PHP Scripts Mall PHP Multivendor Ecommerce has an SQL Injection vulnerability via the usid parameter in the seller-view.php file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS