CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.03)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
W wersjach SAP NetWeaver (Visual Composer 7.0 RT) 7.30, 7.31, 7.40, 7.50, brak ograniczeń pozwala uwierzytelnionemu atakującemu jako użytkownikowi niebędącemu administratorem na przesłanie złośliwego pliku przez sieć i wywołanie jego przetwarzania. To może prowadzić do uruchomienia poleceń systemu operacyjnego z uprawnieniami procesu Java Server.
An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.
A permissions issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.4. A malicious application may be able to bypass Privacy preferences. Apple is aware of a report that this issue may have been actively exploited.
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 12.5.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
A memory corruption issue was addressed with improved state management. This issue is fixed in watchOS 7.4.1, iOS 14.5.1 and iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, macOS Big Sur 11.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
An integer overflow was addressed with improved input validation. This issue is fixed in iOS 14.5.1 and iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, Safari 14.1.1, macOS Big Sur 11.3.1. Processing maliciously crafted web content may lead to arbitrary code execution.
A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.1, iOS 12.5.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3, Security Update 2021-002 Catalina. A malicious application may bypass Gatekeeper checks.
A use-after-free vulnerability in WebKit, fixed in iOS 12.5.4, may lead to arbitrary code execution when processing malicious web content. Apple is aware of active exploitation.
A memory corruption vulnerability in WebKit, fixed in iOS 12.5.4, may allow arbitrary code execution when processing malicious web content. Apple is aware of active exploitation.
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.
A Use After Free vulnerability in Adobe Acrobat Reader DC affects versions 2021.001.20150 and earlier, 2020.001.30020 and earlier, and 2017.011.30194 and earlier. An unauthenticated attacker could leverage this to achieve arbitrary code execution in the context of the current user, but requires user interaction to open a malicious file.
Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication.
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance.
A vulnerability in the october/system package of October CMS allows an attacker to request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5.
A deserialization issue in Apple systems, fixed in Security Update 2021-005 Catalina, iOS 12.5.5, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, and watchOS 7.6.2, may allow a sandboxed process to circumvent sandbox restrictions. Apple is aware of active exploitation.
A buffer overflow issue in Apple systems, fixed in iOS 15.2 and iPadOS 15.2, may allow an application to execute arbitrary code with kernel privileges.
Wykryto przepełnienie całkowitoliczbowe, które zostało naprawione dzięki poprawionej walidacji wejścia. Problem ten został rozwiązany w tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2, iPadOS 15.2 oraz watchOS 8.3.
An out-of-bounds write issue in Apple systems, fixed in iOS 14.8.1 and iPadOS 14.8.1, and iOS 15.1 and iPadOS 15.1, may allow a malicious application to execute arbitrary code with kernel privileges.
A memory corruption issue in Apple systems, fixed in iOS 15.0.2 and iPadOS 15.0.2, macOS Monterey 12.0.1, iOS 14.8.1 and iPadOS 14.8.1, tvOS 15.1, watchOS 8.1, and macOS Big Sur 11.6.1, may allow an application to execute arbitrary code with kernel privileges. Apple is aware of active exploitation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS