CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.19)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An authentication bypass in Palo Alto Networks PAN-OS software allows an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges. Affects PAN-OS 10.2, 11.0, 11.1, and 11.2. Risk can be reduced by restricting access to the management interface to trusted IPs.
Windows Task Scheduler Elevation of Privilege Vulnerability.
The upgrademysqlstatus function in databases/views.py in CyberPanel before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.
getresetstatus in dns/views.py and ftp/views.py in CyberPanel before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.
Unrestricted file upload and download in Cleo Harmony, VLTrader, and LexiCom before 5.8.0.21, potentially leading to remote code execution.
A vulnerability in the Remote Access VPN (RAVPN) service of Cisco ASA and FTD Software allows an unauthenticated, remote attacker to cause a denial of service (DoS) of the RAVPN service. The issue is due to resource exhaustion. A successful exploit could exhaust resources, resulting in DoS of the RAVPN service, and a device reload may be required to restore service.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack due to insufficient input validation. Successful exploit could allow unauthorized access, enabling viewing, corrupting, or deleting users' data and system configurations.
An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.
A spoofing vulnerability in the Windows MSHTML platform.
Security feature bypass vulnerability in Microsoft Publisher. An attacker could exploit it to bypass security features and run unsafe content.
Security feature bypass vulnerability in Windows Mark of the Web. It allows an attacker to bypass security protections related to files downloaded from the internet.
Elevation of privilege vulnerability in Windows Installer. An attacker could exploit it to gain elevated privileges.
Nieprawidłowa implementacja algorytmu uwierzytelniania w Ivanti vTM, z wyjątkiem wersji 22.2R1 lub 22.7R2, umożliwia zdalnemu, nieautoryzowanemu atakującemu ominięcie uwierzytelnienia panelu administracyjnego.
Podatność w produkcie Oracle WebLogic Server w ramach Oracle Fusion Middleware (komponent: Core) dotyczy wersji 12.2.1.4.0 oraz 14.1.1.0.0. Łatwo eksploatowalna podatność pozwala nieautoryzowanemu atakującemu z dostępem do sieci na kompromitację Oracle WebLogic Server.
A vulnerability in the Windows kernel-mode driver allows elevation of privilege. This flaw can be exploited by a local attacker to gain system-level privileges.
A vulnerability in the Windows kernel allows elevation of privilege. This flaw can be exploited by a local attacker to gain higher privileges on the system.
Rejetto HTTP File Server up to version 2.3m is vulnerable to template injection. A remote, unauthenticated attacker can execute arbitrary commands on the system by sending a specially crafted HTTP request. Version 2.3m is no longer supported.
A vulnerability in Check Point Security Gateways that may allow an attacker to read certain information when the gateway is connected to the internet and has Remote Access VPN or Mobile Access Software Blades enabled. A security fix is available.
A vulnerability in a legacy capability for preloading VPN clients and plug-ins in Cisco ASA and FTD Software allows an authenticated, local attacker with administrator privileges to execute arbitrary code with root-level privileges. The issue is due to improper validation of a file read from system flash memory. A successful exploit could allow code execution after the next reload, potentially altering system behavior.
A vulnerability in the management and VPN web servers of Cisco ASA and FTD Software allows an unauthenticated, remote attacker to cause an unexpected reload, resulting in DoS. The issue is due to incomplete error checking when parsing an HTTP header. A successful exploit could cause a DoS condition when the device reloads.