CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.03)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Unrestricted File Upload exists in BigTree CMS before version 4.2.17. An attacker can upload an 'xxx.php[space]' file, allowing them to bypass a safety check and execute arbitrary code.
A code injection vulnerability exists in SAP TREX / Business Warehouse Accelerator (BWA). The issue is documented in SAP Security Note 2419592.
All versions of Schneider Electric's homeLYnk Controller prior to version 1.5.0 contain a command injection vulnerability.
A use-after-free vulnerability exists in AnimationController::endAnimationUpdate in Google Chrome, potentially leading to unauthorized memory access.
Klient w OpenSSH przed wersją 7.2 niewłaściwie obsługuje nieudane generowanie ciasteczek dla nieufnego przekazywania X11 i polega na lokalnym serwerze X11 w podejmowaniu decyzji o kontroli dostępu. To pozwala zdalnym klientom X11 na wywołanie mechanizmu awaryjnego i uzyskanie uprawnień do zaufanego przekazywania X11, wykorzystując problemy konfiguracyjne na tym serwerze X11.
The EjbObjectInputStream class in Apache TomEE before 1.7.4 and 7.x before 7.0.0-M3 allows remote attackers to execute arbitrary code via a crafted serialized object.
The Intellinet NFC-30ir IP Camera has a vendor backdoor that can allow a remote attacker access to a vendor-supplied CGI script in the web directory.
In Fiyo CMS versions 2.x through 2.0.7, attackers may upload a webshell via the content parameter to '/dapur/apps/app_theme/libs/save_file.php', allowing code execution.
Ninka before 1.3.2 might allow remote attackers to obtain sensitive information, manipulate license compliance scan results, or cause a denial of service (process hang) via a crafted filename.
The JIRA Workflow Designer Plugin in Atlassian JIRA Server before version 6.3.0 improperly uses an XML parser and deserializer, allowing remote attackers to execute arbitrary code, read arbitrary files, or cause a denial of service via a crafted serialized Java object.
The Curve25519 code in Botan before version 1.11.31 may allow attackers to have unspecified impact on systems without a native 128-bit integer type, as demonstrated on 32-bit ARM systems compiled by Clang.
A stack-based buffer overflow in SAP NetWeaver versions 7.0 through 7.5 allows remote attackers to cause a denial of service by sending a crafted packet to the SAPSTARTSRV port.
Botan versions 1.11.x before 1.11.22 improperly handle wildcard matching against hostnames, which might allow remote attackers to have unspecified impact via a valid X.509 certificate.
Web2py versions before 2.14.6 do not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-force attacks.
CloudView NMS before version 2.10a has a format string issue that can be exploited over SNMP.
Sierra Wireless GX 440 devices with ALEOS firmware version 4.3.2 store passwords in cleartext.
Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 use guessable session tokens, which are in the URL.
Sierra Wireless GX 440 devices with ALEOS firmware version 4.3.2 do not require authentication for Embedded_Ace_Get_Task.cgi requests.
Sierra Wireless GX 440 devices with ALEOS firmware version 4.3.2 have weak passwords for admin, rauser, sconsole, and user accounts.
Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 allow command injection via the Embedded_Ace_Set_Task.cgi script.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS