CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attacker to remotely compromise the storage zones controller.
The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file.
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.
In MISP before version 2.4.148, the file app/Lib/Export/OpendataExport.php mishandles the parameter data used in a shell_exec call.
A vulnerability in Apache HTTP Server allows a remote attacker to redirect requests via mod_proxy to an origin server of their choice using a crafted URI path. Affects versions 2.4.48 and earlier.
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
Remote code execution vulnerability in Open Management Infrastructure (OMI). Allows a remote unauthenticated attacker to execute arbitrary code.
W wersjach SAP NetWeaver (Visual Composer 7.0 RT) 7.30, 7.31, 7.40, 7.50, brak ograniczeń pozwala uwierzytelnionemu atakującemu jako użytkownikowi niebędącemu administratorem na przesłanie złośliwego pliku przez sieć i wywołanie jego przetwarzania. To może prowadzić do uruchomienia poleceń systemu operacyjnego z uprawnieniami procesu Java Server.
In Kooboo CMS 2.1.1.0, it is possible to upload a remote shell (e.g., aspx) to the server and then call upon it to receive a reverse shell from the victim server. The files are uploaded to /Content/Template/root/reverse-shell.aspx and can be simply triggered by browsing that URL.
Kooboo CMS 2.1.1.0 is vulnerable to insecure file upload. The server does not verify file extensions, allowing an attacker to upload files with .aspx extension.
An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.
Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication.
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance.
A bug in the SM2 decryption implementation in OpenSSL causes the first call to EVP_PKEY_decrypt() to return a buffer size smaller than actually required, leading to a buffer overflow of up to 62 bytes on the second call. An attacker can exploit this to alter data or cause application crashes.
MISP version 2.4.148, in certain configurations, allows SQL injection via the $conditions['org'] value in the app/Model/Log.php file.
Realtek Jungle SDK versions v2.x through v3.4.14B includes an HTTP web server exposing a management interface (webs or boa) that is affected by multiple stack buffer overflows and arbitrary command execution flaws. The issues occur in functions such as formRebootCheck, formWsc, formWlanMultipleAP, formWlSiteSurvey, formStaticDHCP, and formSysCmd due to unsafe copying of parameters like submit-url, ifname, hostname, peerPin, and sysCmd. Successful exploitation allows remote attackers to achieve arbitrary code execution on the device.
Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affected by multiple memory corruption vulnerabilities and an arbitrary command injection vulnerability that can be exploited by remote unauthenticated attackers.
Sunhillo SureLine before 8.7.0.1.1 allows Unauthenticated OS Command Injection via shell metacharacters in ipAddr or dnsAddr /cgi/networkDiag.cgi.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS