CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Vulnerability in Splunk Enterprise before versions 10.4.3 and 10.2.7 allows an unauthenticated user with network access to the Patroni REST API on a search head cluster member to execute attacker-controlled OS commands. The interface does not require authentication for critical configuration operations.
Deserialization of untrusted data vulnerability in The Events Calendar plugin allows object injection. Affects versions up to 6.17.4.
SQL injection vulnerability in WP Data Access allows blind SQL injection. Affects versions up to 5.5.82.
Vulnerability in SRv6 OAM (NGOAM) feature of Cisco NX-OS allows unauthenticated remote attacker to execute arbitrary code with root privileges or cause DoS. Due to improper input validation when NGOAM and SRv6 features are enabled.
A security review in Cisco APIC revealed multiple vulnerabilities related to improper control of a resource through its lifetime (CWE-664). These have been addressed in hardening releases.
A security review in Cisco APIC revealed multiple vulnerabilities related to improper neutralization issues (CWE-707). These have been addressed in hardening releases.
A security review in Cisco APIC revealed multiple vulnerabilities related to improper access control (CWE-284). These have been addressed in hardening releases.
Vulnerability in VXLAN OAM (NGOAM) feature of Cisco NX-OS allows unauthenticated remote attacker to execute arbitrary code with root privileges or cause DoS. Due to improper input validation when NGOAM is enabled.
Vulnerability in VXLAN OAM (NGOAM) feature of Cisco NX-OS allows unauthenticated remote attacker to execute arbitrary code with root privileges or cause DoS. Due to improper input validation when NGOAM is enabled.
A security review in Cisco License On-Prem (formerly SSM On-Prem) revealed multiple vulnerabilities related to insufficiently protected credentials (CWE-522). These have been addressed in hardening releases.
A security review in Cisco License On-Prem (formerly SSM On-Prem) revealed multiple vulnerabilities related to improper input verification (CWE-347). These have been addressed in hardening releases.
Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) contains vulnerabilities related to improper authentication, grouped under CWE-306. They were discovered during an internal security review and addressed in a hardening release.
A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a DoS condition. It is due to insufficient input validation of data sent to the NX-API.
A vulnerability in the MPLS OAM feature of Cisco NX-OS Software for Nexus 3000 and 9000 Series Switches could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a DoS condition. It is due to improper validation of MPLS echo-request packets.
The Cisco networking engineering team discovered vulnerabilities related to buffer management (CWE-119) during an internal security review. They were addressed in a hardening release.
A vulnerability in Cisco NX-OS discovered during internal security review concerns out-of-bounds write (CWE-787). It is fixed in a software hardening release.
The Cisco NX-OS team discovered vulnerabilities related to improper access control (CWE-284) during an internal security review. They were addressed in a hardening release.
A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Prem (formerly SSM On-Prem) could allow an unauthenticated, remote attacker to write arbitrary files to the system or cause a DoS condition. It is due to improper input validation and lack of authentication in the management API.
Homer, open source telecom observability software, prior to version 11.0.283 has a vulnerability where JWT middleware functions (`JWTMiddleware` and `JWTMiddlewareV4`) immediately return `next(c)` when `jwtSecret` is empty. The JWT secret defaults to an empty string, leaving all protected API endpoints completely unauthenticated.
Homer prior to version 11.0.283, on every fresh deployment using internal authentication, automatically creates an `admin` account with the password `sipcapture` (stored as a legacy SHA-256 hex hash). There is no first-login forced-change mechanism, allowing any attacker to gain full administrative access.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS