CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
W jednym z komponentów CGI Orpak SiteOmat występuje przepełnienie bufora stosu, co umożliwia zdalne wykonanie kodu. Podatność dotyczy wszystkich wersji przed 25 września 2017 roku.
Wszystkie wersje Orpak SiteOmat przed 2017-09-25 zawierają podatność na wstrzykiwanie SQL w formularzu logowania. Proces walidacji uwierzytelnienia zawiera niebezpieczne zapytanie SELECT, co umożliwia obejście uwierzytelnienia.
W kodzie źródłowym SiteOmat znaleziono lukę umożliwiającą ominięcie uwierzytelniania. Wszystkie wersje SiteOmat BOS przed zgłoszeniem tego exploit są podatne na tę lukę.
Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit this vulnerability to install arbitrary plugins, which permits remote code execution on systems running a vulnerable version of Crowd or Crowd Data Center. All versions of Crowd from version 2.1.0 before 3.0.5, from version 3.1.0 before 3.1.6, from version 3.2.0 before 3.2.8, from version 3.3.0 before 3.3.5, and from version 3.4.0 before 3.4.4 are affected by this vulnerability.
Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.
SQLite3 from version 3.6.0 to 3.27.2 inclusive is vulnerable to a heap out-of-bounds read in the rtreenode() function when handling invalid rtree tables.
mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml.
Adobe XD versions 16.0 and earlier have a path traversal vulnerability. Successful exploitation could lead to arbitrary code execution.
Adobe XD versions 16.0 and earlier have a path traversal vulnerability. Successful exploitation could lead to arbitrary code execution.
A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered.
Citrix Workspace App before 1904 for Windows has an incorrect access control vulnerability, potentially allowing unauthorized access to resources.
A remote code execution vulnerability in Remote Desktop Services allows an unauthenticated attacker to execute code by sending specially crafted requests to the target system via RDP.
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format, e.g., JSON.
The LG N1A1 NAS device is vulnerable to remote command execution via HTTP POST requests with specific parameters, allowing arbitrary code execution.
A buffer overflow vulnerability in the WhatsApp VOIP stack allows remote code execution via specially crafted RTCP packets sent to a target phone number.
A vulnerability in Pulse Connect Secure allows an unauthenticated remote attacker to read arbitrary files by sending a specially crafted URI.
An authentication bypass issue was discovered in Open XDMoD through version 7.5.0, which can lead to account takeover. A weak password reset mechanism allows an attacker to perform a brute-force attack on the MD5 rid value, requiring only 600 guesses if they know the victim initiated a password reset process in the past few minutes.
The ZyXEL P660HN-T1A router has a command injection vulnerability in the Remote System Log forwarding function, accessible by an unauthenticated user via the remote_host parameter on the ViewLog.asp page.
Podatność CVE-2019-10952 dotyczy kontrolerów CompactLogix 5370 oraz GuardLogix 5370, które są narażone na atak polegający na wysłaniu spreparowanego żądania HTTP/HTTPS. Może to prowadzić do niedostępności serwera webowego oraz zdalnego wykonania kodu z powodu przepełnienia bufora na stosie.
Multiple wireless presentation devices (including Crestron AM-100, Barco wePresent, Extron ShareLink) have a command injection vulnerability in the file_transfer.cgi HTTP endpoint, allowing a remote unauthenticated attacker to execute OS commands as root.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS