CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The EjbObjectInputStream class in Apache TomEE before 1.7.4 and 7.x before 7.0.0-M3 allows remote attackers to execute arbitrary code via a crafted serialized object.
The Intellinet NFC-30ir IP Camera has a vendor backdoor that can allow a remote attacker access to a vendor-supplied CGI script in the web directory.
In Fiyo CMS versions 2.x through 2.0.7, attackers may upload a webshell via the content parameter to '/dapur/apps/app_theme/libs/save_file.php', allowing code execution.
Ninka before 1.3.2 might allow remote attackers to obtain sensitive information, manipulate license compliance scan results, or cause a denial of service (process hang) via a crafted filename.
The JIRA Workflow Designer Plugin in Atlassian JIRA Server before version 6.3.0 improperly uses an XML parser and deserializer, allowing remote attackers to execute arbitrary code, read arbitrary files, or cause a denial of service via a crafted serialized Java object.
The Curve25519 code in Botan before version 1.11.31 may allow attackers to have unspecified impact on systems without a native 128-bit integer type, as demonstrated on 32-bit ARM systems compiled by Clang.
A stack-based buffer overflow in SAP NetWeaver versions 7.0 through 7.5 allows remote attackers to cause a denial of service by sending a crafted packet to the SAPSTARTSRV port.
Botan versions 1.11.x before 1.11.22 improperly handle wildcard matching against hostnames, which might allow remote attackers to have unspecified impact via a valid X.509 certificate.
Web2py versions before 2.14.6 do not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-force attacks.
CloudView NMS before version 2.10a has a format string issue that can be exploited over SNMP.
Sierra Wireless GX 440 devices with ALEOS firmware version 4.3.2 store passwords in cleartext.
Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 use guessable session tokens, which are in the URL.
Sierra Wireless GX 440 devices with ALEOS firmware version 4.3.2 do not require authentication for Embedded_Ace_Get_Task.cgi requests.
Sierra Wireless GX 440 devices with ALEOS firmware version 4.3.2 have weak passwords for admin, rauser, sconsole, and user accounts.
Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 allow command injection via the Embedded_Ace_Set_Task.cgi script.
Osram Lightify Home before July 26, 2016, allows remote attackers to execute arbitrary commands via TCP port 4000.
A stack-based buffer overflow in the havok_write function in havok.c in Amazon Fire OS before January 15, 2016 allows attackers to cause a denial of service (panic) or possibly have unspecified other impact via a long string to /dev/hv.
Dell Integrated Remote Access Controller (iDRAC) 7/8 before version 2.21.21.21 has an XXE vulnerability.
Dell Integrated Remote Access Controller (iDRAC) 6 before version 2.80 and 7/8 before version 2.21.21.21 is vulnerable to attacks that can lead to denial of service (buffer overflow) or other unspecified impacts via a long SSH username or input.
Dell Integrated Remote Access Controller (iDRAC) 7/8 before version 2.21.21.21 has a format string issue in the racadm getsystinfo command.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS