CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application.
System Recenzenta Online w wersji 1.0 zawiera podatność na wstrzykiwanie SQL poprzez obejście uwierzytelniania, co może prowadzić do przesyłania powłoki odwrotnej.
A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.
In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. There is no known practical attack exploiting this vulnerability.
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution.
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution.
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI normalization, which may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may theoretically allow bypass of URL based access control or remote code execution (RCE).
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 and BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2, the iControl REST interface has an unauthenticated remote command execution vulnerability.
A flaw was found in gnutls. A use-after-free issue in client_send_params in lib/ext/pre_shared_key.c may lead to memory corruption and other potential consequences.
A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to memory corruption and other consequences.
Unsigned code execution vulnerability in Azure Sphere. An attacker could exploit this flaw to run unauthorized code.
Remote code execution vulnerability in Windows DNS Server. An attacker could exploit it to execute code on the DNS server.
Remote code execution vulnerability in Windows DNS Server. An attacker could exploit it to execute code on the DNS server.
Remote code execution vulnerability in Windows DNS Server. An attacker could exploit this flaw to execute arbitrary code in the context of the service.
Remote code execution vulnerability in Windows DNS Server. An attacker could exploit this flaw to execute arbitrary code in the context of the service.
Remote code execution vulnerability in Windows DNS Server. An attacker could exploit it to execute code on the DNS server.
Remote code execution vulnerability in Windows Hyper-V. An attacker could exploit this flaw to execute arbitrary code on the host.
A PHP object injection vulnerability in profile.php of qcubed (all versions including 3.1.1) unserializes untrusted data from the POST variable "strProfileData", allowing an unauthenticated attacker to execute arbitrary code via a crafted POST request.
A SQL injection vulnerability in qcubed (all versions up to 3.1.1) in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request.
Rockwell Automation Studio 5000 Logix Designer w wersjach 21 i nowszych oraz RSLogix 5000 w wersjach od 16 do 20 są podatne na atak, który pozwala nieautoryzowanemu użytkownikowi obejść mechanizm weryfikacji komunikacji z kontrolerami Logix. Atakujący może uwierzytelnić się z użyciem urządzeń CompactLogix i ControlLogix.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS