CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An authentication bypass vulnerability exists in Apache IoTDB's Thrift RPC service in versions from 2.0.0 before 2.0.11. It may allow an attacker to gain access without valid credentials.
In OpenStack Manila before 23.0.1, multiple API operations on public shares do not verify that the caller owns the share. An authenticated project member can grant access, revoke rules, escalate privileges, create backups, and disclose metadata and CephFS keys.
A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the httpd Web Management Service component. Manipulation of the firewallEn argument leads to a stack-based buffer overflow. The attack may be launched remotely and the exploit has been publicly disclosed.
Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the database instance can authenticate as sysadmin, bypass application authentication, and execute operating system commands as SYSTEM.
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require_auth() returns early when API_AUTH_KEY is unset. Attackers can post messages to /sessions/{id}/messages to trigger root shell commands via BashTool, upload .py or .sh files via /upload, read session histories, and obtain partial API keys.
A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function login_prepare_hnap of the file etc/defnodes/defaultvalue.xml of the HNAP Login component. Manipulation of the Password argument leads to an empty password in the configuration file. The attack can be initiated remotely and the exploit has been disclosed to the public.
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to binding to an unrestricted IP address.
Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. An easily exploitable vulnerability allows an unauthenticated attacker with network access via TCP to compromise Oracle Essbase. CVSS 3.1 Base Score 9.8.
Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. An easily exploitable vulnerability allows a low-privileged attacker with network access via T3, IIOP to compromise Oracle Essbase, with potential impact on additional products (scope change). CVSS 3.1 Base Score 9.9.
Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. An easily exploitable vulnerability allows a low-privileged attacker with network access via HTTP to compromise Oracle Essbase, with potential impact on additional products (scope change). CVSS 3.1 Base Score 9.9.
Vulnerability in Oracle Essbase (component: Federated Partitions) affecting version 21.8.3.0.0. An easily exploitable vulnerability allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data, update, insert or delete it, and cause a partial denial of service, with potential impact on additional products (scope change). CVSS 3.1 Base Score 9.1.
Vulnerability in Oracle Essbase (Security component) affecting version 21.8.3.0.0. A low-privileged attacker with network access via HTTP can exploit it to gain unauthorized access to critical data, modify data, and cause partial denial of service. CVSS 9.1.
Vulnerability in Oracle Essbase (Security component) affecting version 21.8.3.0.0. An unauthenticated attacker with network access via HTTP can gain unauthorized access to critical data and modify data. CVSS 9.3.
Vulnerability in Oracle Essbase (Security component) affecting version 21.8.3.0.0. A low-privileged attacker with network access via HTTP can take over Oracle Essbase. CVSS 9.9.
Vulnerability in Oracle Essbase (Security component) affecting version 21.8.3.0.0. A low-privileged attacker with network access via HTTP can take over Oracle Essbase. CVSS 9.9.
Vulnerability in Oracle Agile Product Lifecycle Management for Process (Product Quality Management component) affecting version 6.2.4. An unauthenticated attacker with network access via HTTP can create, delete, or modify critical data and gain unauthorized access to it. CVSS 9.1.
Vulnerability in Oracle Agile Product Lifecycle Management for Process (Product Quality Management component) affecting version 6.2.4. An unauthenticated attacker with network access via HTTP, requiring user interaction, can create, delete, or modify critical data and gain unauthorized access to it. CVSS 9.3.
Vulnerability in Oracle WebCenter Content (Content Server component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can take over Oracle WebCenter Content. CVSS 9.8.
Vulnerability in Oracle Identity Manager Connector (LDAP Gateway component) affecting versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via LDAP can take over Oracle Identity Manager Connector. CVSS 9.8.
Vulnerability in Oracle Identity Manager Connector (LDAP Gateway component) affecting versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via LDAP can create, delete, or modify critical data and gain unauthorized access to it. CVSS 9.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS