CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a <details> tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.
An Improper Isolation or Compartmentalization vulnerability in the kernel of Juniper Networks Junos OS allows a local attacker with high privileges to compromise the integrity of the device. A local attacker with access to the shell is able to inject arbitrary code which can compromise an affected device. This issue is not exploitable from the Junos CLI. This issue affects Junos OS: All versions before 21.2R3-S9, 21.4 versions before 21.4R3-S10, 22.2 versions before 22.2R3-S6, 22.4 versions before 22.4R3-S6, 23.2 versions before 23.2R2-S3, 23.4 versions before 23.4R2-S4, 24.2 versions before 24.2R1-S2, 24.2R2.
In the Linux kernel, a vulnerability was found in migrate_device_finalize() where a folio to be freed is incorrectly added to the LRU list. This triggers memcg warnings and may cause unnecessary system overhead.
In the Linux kernel, a vulnerability in BPF was found where the freeze_mutex was held during the entire mmap operation, potentially leading to deadlocks. The fix reduces the lock hold time to only the necessary write permission checks.
W jądrze Linuxa zidentyfikowano podatność związaną z brakiem sprawdzenia nullowości wskaźnika cstream w funkcji sof_ipc_msg_data(). Niewłaściwe założenie, że cstream nie jest NULL, gdy wskaźnik stream jest NULL, może prowadzić do dereferencji wskaźnika NULL.
A vulnerability in the Linux kernel's acct(2) system call can cause a NULL pointer dereference when writing to a file that triggers an internal lookup (e.g., /sys/power/resume) after the process has exited and called exit_fs().
W jądrze Linuxa zidentyfikowano podatność, która została naprawiona. W wyniku błędu w funkcji `sst_nor_write_data()` tylko jeden bajt danych jest zapisywany, niezależnie od liczby bajtów przekazanych do tej funkcji, co prowadzi do awarii jądra podczas operacji zapisu.
A stored cross-site scripting (XSS) vulnerability in OpenMRS v2.4.3 Build 0ff0ed allows attackers to inject malicious JavaScript or HTML into the personName.middleName parameter at /openmrs/admin/patients/shortPatientForm.form, leading to script execution in the victim's browser.
Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally.
A vulnerability in Windows NTFS involves insertion of sensitive information into a log file. An attacker with physical access can exploit this to disclose information.
A vulnerability in Windows NTLM allows external control of file name or path. An unauthorized attacker can perform spoofing over a network.
Podatność w aplikacji Tap&Sign przed wersją 1.025 polega na przechowywaniu wrażliwych informacji w zmiennych środowiskowych w postaci niezaszyfrowanej oraz na słabym mechanizmie odzyskiwania hasła, co umożliwia wykorzystanie tych luk do nieautoryzowanego dostępu.
In the Linux kernel, a vulnerability in the mac80211 subsystem allows deactivating all links via the debugfs interface, triggering a WARN_ON that indicates an internal bug.
In the Linux kernel, a vulnerability in the UBIFS filesystem causes a null pointer dereference when dumping the TNC tree after clearing the slab cache. The pointer c->zroot.znode becomes NULL, leading to a system crash.
In the Linux kernel's remoteproc subsystem, a bug was found where ida_free is called for an ID that was not previously allocated by ida_alloc. The issue occurs in the rproc_alloc function when an error happens before ida_alloc is called, and then in the release path (rproc_type_release) an attempt is made to free an unallocated ID, triggering a kernel warning.
W systemie zarządzania rezerwacjami AtaksAPP występuje podatność na atak typu Cross-Site Scripting (XSS) z powodu niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych. Problem dotyczy wersji przed 4.2.3.
Scanning certain QR codes that included text with a website URL could allow the URL to be opened without presenting the user with a confirmation alert first. This vulnerability was fixed in Firefox for iOS 136.
Websites redirecting to a non-HTTP scheme URL could allow a website address to be spoofed for a malicious page. This vulnerability was fixed in Firefox for iOS 136.
Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7. Some showed evidence of memory corruption, potentially exploitable to run arbitrary code. Fixed in Firefox 136, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.
A web page could trick a user into setting that site as the default handler for a custom URL protocol. Fixed in Firefox 136, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS