CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A code injection exists in treekill on Windows that allows remote code execution when an attacker can control the input into the command. This enables execution of arbitrary code in the context of the affected process.
IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as 'admin', and then execute code as root or SYSTEM via TM1 scripting. IBM X-Force ID: 172094.
The vulnerability in class.upload.php (versions up to 1.0.3 and 2.x up to 2.0.4), used in the K2 extension for Joomla! and other products, omits .pht from the set of dangerous file extensions, similar to CVE-2019-19576.
Seria PLC Omron CS i CJ posiada podatność na nieograniczony dostęp do zewnętrznego mechanizmu blokady. Umożliwia to potencjalnym atakującym dostęp do systemu bez odpowiednich uprawnień.
Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote code execution. (As of 2020.1.114, a default setting prevents the exploit. In 2019.3.1023, but not earlier versions, a non-default setting can prevent exploitation.)
pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns.
W libsixel w wersji 1.8.2 odkryto problem związany z przepełnieniem bufora na stercie w funkcji load_pnm w pliku frompnm.c, spowodowanym przepełnieniem całkowitym.
W libsixel w wersji 1.8.2 odkryto problem związany z przepełnieniem całkowitym w funkcji sixel_decode_raw_impl w pliku fromsixel.c.
W wersji 1.8.2 biblioteki libsixel odkryto problem związany z przepełnieniem całkowitym w funkcji sixel_encode_body w pliku tosixel.c.
W wersji 1.8.2 biblioteki libsixel odkryto problem związany z przepełnieniem bufora w stercie w funkcji sixel_decode_raw_impl w pliku fromsixel.c.
OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.
This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions.
This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions.
This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating QTS to their latest versions.
This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, QNAP recommend updating Photo Station to their latest versions.
lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service or possibly have unspecified other impact.
Vulnerability in class.upload.php (versions before 1.0.3 and 2.x before 2.0.4) omits .phar from the list of dangerous file extensions. This library is used in the K2 extension for Joomla! and other products.
Crestron DMC-STRO 1.0 devices allow remote command execution as root via shell metacharacters in the ping function.
Versions of Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, and 13.0.197.13 and below have incorrect access control.
In GNU libidn2 before 2.1.1, the idn2_to_ascii_4i function in lib/lookup.c has a heap-based buffer overflow. The vulnerability is triggered by a long domain string.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS