CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
GitPHP by xiphux is vulnerable to OS Command Injections, which may lead to unauthorized command execution on the server.
In Pivotal Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, an org.springframework.amqp.core.Message may be unsafely deserialized when being converted into a string. A malicious payload could be crafted to exploit this and enable a remote code execution attack.
The receive_msg function in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving BDAT commands.
Ametys before 4.0.3 requires authentication only for URIs containing a /cms/ substring, allowing remote attackers to bypass intended access restrictions via a direct request to /plugins/core-ui/servercomm/messages.xml.
The web server on DBL DBLTek devices allows remote attackers to execute arbitrary OS commands by obtaining the admin password via a frame.html?content=/dev/mtdblock/5 request, and then using this password for the HTTP Basic Authentication needed for a change_password.csp request, which supports a "<%%25call system.exec:" string in the passwd parameter.
In libxml2 before version 2.9.5, there is an issue with handling parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name.
An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices regarding the storage of backup files. These files contain sensitive information insecurely, as passwords are stored without encryption and without salt for hashing.
The MIT Kerberos 5 (krb5) library up to version 1.15.2 mishandles Distinguished Name (DN) fields, allowing remote attackers to execute arbitrary code or cause application crashes via buffer overflow.
The UMA product with software versions V200R001 and V300R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters. An attacker could craft specific packets to exploit these vulnerabilities to gain elevated privileges.
The UMA product with software versions V200R001 and V300R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters. An attacker could craft specific packets to exploit these vulnerabilities to gain elevated privileges.
The UMA product with software version V200R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters. An attacker could craft specific packets to exploit these vulnerabilities to gain elevated privileges.
The UMA product with software version V200R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters. An attacker could craft specific packets to exploit these vulnerabilities to gain elevated privileges.
The UMA product with software V200R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters. An attacker could craft specific packets to exploit these vulnerabilities to gain elevated privileges.
The UMA product with software version V200R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters. An attacker could craft specific packets to exploit these vulnerabilities to gain elevated privileges.
The UMA product with software versions V200R001 and V300R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters. An attacker could craft specific packets to exploit these vulnerabilities to gain elevated privileges.
The UMA product with software versions V200R001 and V300R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters. An attacker could craft specific packets to exploit these vulnerabilities to gain elevated privileges.
The UMA product with software versions V200R001 and V300R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters. An attacker could craft specific packets to exploit these vulnerabilities to gain elevated privileges.
VCM5010 with software versions earlier than V100R002C50SPC100 has an authentication bypass vulnerability and an arbitrary file upload vulnerability. An unauthenticated attacker can bypass the login process, while an authenticated attacker can upload unvalidated files to the system.
CVE-2017-13071 allows a remote attacker to execute arbitrary commands on QNAP Video Station versions 5.1.3 (for QTS 4.3.3), 5.2.0 (for QTS 4.3.4), and earlier.
Client-side enforcement using JavaScript on the Cohu 3960HD camera allows an attacker to manipulate options sent to the camera, potentially leading to malfunction or code execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS