CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The vulnerability in DigiExam up to v14.0.2 lacks integrity checks for native modules, allowing attackers to access PII and take over accounts on shared computers.
The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1.
The Orchid package, used for back-office application development, has a vulnerability related to the deserialization of untrusted data from the `_state` query parameter. This can lead to remote code execution. The issue has been addressed in version 14.5.0.
A vulnerability in the Windows Routing and Remote Access Service (RRAS) allows for remote code execution. An attacker can exploit this flaw to gain control over the system.
A vulnerability in the Windows Routing and Remote Access Service (RRAS) allows for remote code execution. An attacker can exploit this flaw to gain control over the system.
A vulnerability in the Windows Routing and Remote Access Service (RRAS) allows for remote code execution. An attacker can exploit this flaw to gain control over the system.
A vulnerability in Microsoft Office allows for a security feature bypass, potentially leading to unauthorized access to user data.
xalpha version 0.11.4 is vulnerable to Remote Command Execution (RCE).
WebsiteGuide v0.2 is vulnerable to Remote Command Execution (RCE) via image upload.
A buffer overflow in the level parsing code of RobTop Games AB Geometry Dash v2.113 allows attackers to execute arbitrary code via entering a Geometry Dash level.
A vulnerability has been identified in RUGGEDCOM ROX MX5000, MX5000RE, RX1400, RX1500, RX1501, RX1510, RX1511, RX1512, RX1524, RX1536, and RX5000 devices in versions below V2.16.0. The SCEP CA Certificate Name parameter in the web interface is vulnerable to command injection due to missing server-side input sanitation.
A vulnerability has been identified in RUGGEDCOM ROX MX5000, ROX MX5000RE, ROX RX1400, ROX RX1500, ROX RX1501, ROX RX1510, ROX RX1511, ROX RX1512, ROX RX1524, ROX RX1536, and ROX RX5000 in versions below V2.16.0. The SCEP server configuration URL parameter in the web interface is vulnerable to command injection due to missing server-side input sanitation.
A vulnerability has been identified in RUGGEDCOM ROX MX5000, ROX MX5000RE, ROX RX1400, ROX RX1500, ROX RX1501, ROX RX1510, ROX RX1511, ROX RX1512, ROX RX1524, ROX RX1536, and ROX RX5000 devices in versions below V2.16.0. The uninstall-app App-name parameter in the web interface is vulnerable to command injection due to missing server-side input sanitation.
A vulnerability has been identified in RUGGEDCOM ROX MX5000, ROX MX5000RE, ROX RX1400, ROX RX1500, ROX RX1501, ROX RX1510, ROX RX1511, ROX RX1512, ROX RX1524, ROX RX1536, and ROX RX5000 (all versions < V2.16.0). The upgrade-app URL parameter in the web interface of affected devices is vulnerable to command injection due to missing server side input sanitation.
A vulnerability has been identified in RUGGEDCOM ROX MX5000, ROX MX5000RE, ROX RX1400, ROX RX1500, ROX RX1501, ROX RX1510, ROX RX1511, ROX RX1512, ROX RX1524, ROX RX1536, and ROX RX5000 (all versions < V2.16.0). The install-app URL parameter in the web interface is vulnerable to command injection due to missing server-side input sanitation.
A vulnerability has been identified in RUGGEDCOM ROX MX5000, ROX MX5000RE, ROX RX1400, ROX RX1500, ROX RX1501, ROX RX1510, ROX RX1511, ROX RX1512, ROX RX1524, ROX RX1536, and ROX RX5000 in versions below V2.16.0. The software-upgrade Url parameter in the web interface is vulnerable to command injection due to missing server side input sanitation.
Zidentyfikowano podatność w urządzeniach SIMATIC CN 4100 (wszystkie wersje < V2.5) związaną z niewłaściwymi kontrolami dostępu w plikach konfiguracyjnych, co prowadzi do eskalacji uprawnień. Atakujący mógłby uzyskać dostęp administratora, co skutkuje pełną kontrolą nad urządzeniem.
Due to a programming error in function module and report, the IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an arbitrary operating system command into an unprotected parameter in a common (default) extension. On successful exploitation, the attacker can read or modify the system data as well as shut down the system.
Wykryto podatność w kontrolerze stref przechowywania ShareFile zarządzanym przez klienta, która, jeśli zostanie wykorzystana, może umożliwić nieautoryzowanemu atakującemu zdalne przejęcie kontroli nad tym kontrolerem.
Delta Electronics InfraSuite Device Master versions prior to 1.0.7 contain classes that cannot be deserialized, which could allow an attacker to remotely execute arbitrary code.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS