CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to execute arbitrary code, elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause denial of service (DoS). See the Details section of the advisory for more information.
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to execute arbitrary code, elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause denial of service (DoS). See the Details section of the advisory for more information.
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to execute arbitrary code, elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause denial of service (DoS). See the Details section of the advisory for more information.
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to execute arbitrary code, elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause denial of service (DoS). See the Details section of the advisory for more information.
SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 oraz SAP Web Dispatcher są podatne na smuggling żądań i konkatenację żądań. Nieautoryzowany atakujący może dodać dowolne dane do żądania ofiary, co pozwala mu na wykonywanie funkcji w imieniu ofiary lub zanieczyszczenie pośrednich pamięci podręcznych Web.
Podatność w superjson przed wersją 1.8.1 pozwala na wykonanie dowolnego kodu na serwerze przy użyciu wejścia superjson bez wcześniejszej autoryzacji. Wymagana jest jedynie implementacja przynajmniej jednego punktu końcowego, który korzysta z superjson podczas przetwarzania żądań.
An IDOR vulnerability in PrinterLogic Web Stack versions 19.1.1.13 SP9 and below allows an unauthenticated attacker to reassign drivers for any printer.
An SSRF vulnerability in PrinterLogic Web Stack versions 19.1.1.13 SP9 and below allows an attacker to use user-controlled input to craft a URL, enabling server-side requests to internal network resources.
Multiple Tenda devices are vulnerable to authentication bypass, allowing an attacker to obtain sensitive information. This vulnerability can be combined with authenticated command injection to achieve remote code execution (RCE).
Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.
A vulnerability in Oracle Access Manager (component: OpenSSO Agent) in versions 11.1.2.3.0, 12.2.1.3.0, and 12.2.1.4.0 allows an unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. CVSS 3.1 Base Score 9.8.
The JDBCAppender in Log4j 1.2.x accepts SQL statements as a configuration parameter, allowing attackers to manipulate SQL by entering crafted strings into input fields or headers of an application. This can lead to unintended SQL queries being executed.
Corenlp jest podatny na niewłaściwe ograniczenie odniesienia do zewnętrznych jednostek XML. Może to prowadzić do nieautoryzowanego dostępu do danych lub wykonania niebezpiecznych operacji.
The EAP-pwd implementations in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks due to cache access patterns. This issue exists because of an incomplete fix for CVE-2019-9495.
The SAE protocol implementations in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks due to cache access patterns. This issue exists because of an incomplete fix for CVE-2019-9494.
NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root.
The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (glibc) through 2.34 copies its hostname argument on the stack without validating its length. This may result in a buffer overflow, potentially leading to a denial of service or, if an application is not built with a stack protector enabled, arbitrary code execution.
The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.
My Cloud OS 5 był podatny na lukę typu przepełnienie stosu w usłudze FTP, która mogła być wykorzystana przez nieautoryzowanych atakujących w sieci. Luka została załatana poprzez dodanie zabezpieczeń przeciwko problemom z przepełnieniem stosu.
JPress v4.2.0 is vulnerable to remote code execution via the doUploadAndInstall function in the _AddonController. An attacker can upload a malicious file, leading to full server compromise.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS