CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A flaw was found in Avahi-daemon where DNS transaction IDs are initialized randomly only once at startup and then incremented sequentially. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs.
A flaw in Avahi-daemon uses fixed source ports for wide-area DNS queries, making it easier for attackers to inject malicious DNS responses.
Podatność CVE-2024-7130 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w oprogramowaniu Kion Computer KION Exchange Programs, co umożliwia ataki typu Reflected XSS.
Podatność CVE-2024-7016 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w systemie Smart Doctor firmy Smarttek Informatics, co prowadzi do możliwości wystąpienia ataku typu Stored XSS, wymagającego uprawnień administratora.
A SQL injection vulnerability was discovered in SemCms v4.8 in the SEMCMS_SeoAndTag.php component. An attacker can exploit the ldgid parameter to execute arbitrary SQL code.
W podatności CVE-2024-11406 występuje niewłaściwa neutralizacja danych wejściowych podczas generowania stron internetowych w django CMS, co pozwala na ataki typu Stored XSS. Problem dotyczy pól atrybutów w django CMS w wersjach przed 4.0.
Podatność CVE-2024-11404 dotyczy django Filer, umożliwiając nieograniczone przesyłanie plików o niebezpiecznych typach oraz niewłaściwe neutralizowanie tagów HTML związanych z skryptami, co prowadzi do podatności na XSS. Problem ten występuje w wersjach od 3 do przed 3.3.
A cookie management issue was addressed with improved state management. Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.
In the Linux kernel, in the DRM driver for MediaTek, a potential NULL pointer dereference in mtk_crtc_destroy() was fixed. If mbox_request_channel() fails, the cmdq_client.chan pointer is set to NULL, and cmdq_pkt_create() is not called. During cleanup, the pointer must be checked for NULL before calling cmdq_pkt_destroy() to avoid a NULL pointer dereference.
The mediapool feature in Redaxo Core CMS version 5.17.1 is vulnerable to Cross-Site Scripting (XSS). A remote attacker can exploit this vulnerability to escalate privileges within the system.
In the Linux kernel, a vulnerability was resolved in HID: core by zero-initializing the report buffer. The report buffer is used by various drivers, and its non-zero initialization could lead to kernel memory leak via a specially crafted report.
In the Linux kernel, the enetc driver has a null pointer dereference vulnerability. The issue occurs when enetc_pf_set_vf_mac() is called before vf_state memory is allocated, leading to a system crash.
Podatność CVE-2024-11319 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w django CMS, co pozwala na ataki typu Cross-Site Scripting (XSS). Problem ten występuje w wersjach django-cms: 3.11.7, 3.11.8, 4.1.2 oraz 4.1.3.
Improper delimiter neutralization vulnerability in Cesanta Mongoose Web Server v7.14 allows triggering an infinite loop bug if the input string contains unexpected characters.
Out-of-range pointer offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space.
Improper delimiter neutralization vulnerability in Cesanta Mongoose Web Server v7.14 allows triggering an out-of-bound memory write if the PEM certificate contains unexpected characters.
A vulnerability in the OAuth-server causes OAuth2 client secrets to be logged when the log level is set to Debug or higher for OIDC/GitHub/GitLab/Google login options.
A vulnerability in UltiMaker Cura versions 4.41, 5.8.1 and earlier allows a local attacker to execute arbitrary code via the Inter-process communication (IPC) mechanism between the Cura application and CuraEngine processes, localhost network stack, printing settings, and G-code processing and transmission components, as well as Ultimaker 3D Printers.
A vulnerability in kodbox version 1.52.04 and earlier allows a remote attacker to obtain sensitive information via the captcha feature in the password reset function.
A vulnerability in payload inspection for Ethernet Industrial Protocol (ENIP) traffic in Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured rules for ENIP traffic. This is due to incomplete processing during deep packet inspection. An attacker could exploit this by sending a crafted ENIP packet, potentially bypassing access control and intrusion policies.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS