CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Remote code execution vulnerability in Microsoft Exchange Server. Allows an attacker to execute arbitrary code on the server.
Microsoft Exchange Server contains a remote code execution vulnerability. This vulnerability can be exploited by an attacker to execute arbitrary code on the server.
Remote code execution vulnerability in Microsoft Exchange Server. Allows an attacker to execute arbitrary code on the server.
SerComm AG Combo VD625 devices running AGSOT_2.1.0 are vulnerable to CRLF injection in the download function via the Content-Disposition header. This allows an attacker to inject arbitrary HTTP headers.
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA_9_12_380 and later.
Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later.
Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html. The fixed version is FTA_9_12_380 and later.
SQL injection vulnerability in PNPSCADA 2.200816204020 exists in the 'interf' parameter in /browse.jsp. It allows an attacker to inject malicious SQL code.
Zidentyfikowano podatność w panelach HMI Comfort SIMATIC (w tym warianty SIPLUS) oraz w różnych modelach SINAMICS, które mają włączoną usługę telnet. Urządzenia te nie wymagają uwierzytelnienia dla tej usługi, co może umożliwić zdalnemu atakującemu uzyskanie pełnego dostępu do urządzenia.
Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. The vulnerability could be exploited to allow Remote Code Execution on the OBR server.
A SQL injection vulnerability in SonicWall SSLVPN SMA100 allows a remote unauthenticated attacker to perform SQL queries to access usernames, passwords, and other session-related information. This affects SMA100 build version 10.x.
D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system_mgr.cgi component, which can lead to remote arbitrary code execution.
An issue was discovered on D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20. A buffer overflow in the web interface allows attackers to achieve pre-authentication remote code execution.
WinSCP before 5.17.10 allows remote attackers to execute arbitrary programs when the URL handler encounters a crafted URL that loads session settings. This is exploitable, for example, in a default installation in which WinSCP is the handler for sftp:// URLs.
Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.
The default setting of MISP 2.4.136 did not require providing the previous password when changing a password, which may lead to unauthorized changes.
Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.
Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.
Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS