CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Nieprawidłowa walidacja danych wejściowych w ARM® Trusted Firmware używanym w AMD Zynq™ UltraScale+™ MPSoC/RFSoC może umożliwić uprzywilejowanemu atakującemu wykonanie odczytów poza dozwolonym zakresem, co może prowadzić do wycieku danych oraz odmowy usługi.
A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface in Zimbra Collaboration (ZCS) 9.0 and 10.0. An attacker can send an email with a crafted calendar header containing an XSS payload, which executes in the victim's session.
A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack against a user of the interface. It is due to insufficient validation of user-supplied input, and an attacker could inject malicious code into specific pages of the interface.
The contextual menu for links could provide an opportunity for cross-site scripting attacks. This vulnerability affects Firefox for iOS < 129.
Long pressing on a download link could potentially provide a means for cross-site scripting. This vulnerability affects Firefox for iOS < 129.
Long pressing on a download link could potentially allow Javascript commands to be executed within the browser. This vulnerability affects Firefox for iOS < 129.
A reflected XSS vulnerability exists in Microweber 2.0.15 and earlier in the '/search' endpoint. An unauthenticated remote attacker can inject arbitrary web script or HTML via the 'keywords' parameter.
A vulnerability in Horizon Business Services Inc. Caterease versions 16.0.1.1663 through 24.0.1.2405 and possibly later allows a local attacker to perform a password brute force attack due to improper restriction of excessive authentication attempts.
Vim before v9.1.0648 has a double-free vulnerability in dialog_changed(). When abandoning a buffer, Vim may ask the user what to do. If the buffer had no name and the user chooses to save, Vim creates a new Untitled file, but setting the buffer name leads to a double-free, possibly causing heap-use-after-free and crash.
Dell Inventory Collector versions prior to 12.3.0.6 contain a Path Traversal vulnerability. A local authenticated malicious user could potentially exploit this vulnerability to achieve arbitrary code execution on the system.
A Cross Site Scripting (XSS) vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the 'page' parameter in php-lfis/admin/index.php.
A Cross Site Scripting (XSS) vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the first, last, and middle name fields on the User Profile page.
In the Linux kernel, a NULL pointer dereference vulnerability was found in the GFS2 filesystem's gfs2_log_flush function. The issue occurs when glock operations race with an unmount, causing access to a freed sd_jdesc object.
An incorrect access control vulnerability in the Himalaya Xiaoya nano smart speaker (rom_version 1.6.96) allows a remote attacker to have an unspecified impact. The flaw enables unauthorized access to the device.
A vulnerability was found in the Linux kernel's CXL subsystem related to automatic pmem region assembly. During CXL endpoint port probing, an attempt to auto-assemble a pmem region caused a NULL pointer dereference because the required cxl_nvd object was not yet registered. The fix changes the registration order and adds a port parameter to cxl_find_nvdimm_bridge() to query the common ancestor.
In the Linux kernel, in the NVMe over Fabrics subsystem, the use of tags for register read/write commands was changed. Previously, with many simultaneous commands, tags in the admin queue could be exhausted, potentially causing a kernel hang during a reset. The fix uses reserved tags for these operations, which is safe for the disable and enable controller paths.
A Cross-Site Request Forgery (CSRF) vulnerability was found in ProcessWire version 3.0.229, allowing a remote attacker to insert a comment. The supplier disputes this, stating the product intentionally accepts anonymous, unauthenticated comments and that submitted comments are held for moderator review by default.
Podatność CVE-2024-5625 dotyczy niewłaściwego ograniczenia odniesienia do zewnętrznych jednostek XML w konsoli zarządzania Apinizer firmy PruvaSoft, co pozwala na eksplozję jednostek zewnętrznych podczas serializacji danych.
Podatność CVE-2024-5620 w konsoli zarządzania Apinizer firmy PruvaSoft umożliwia obejście uwierzytelniania poprzez alternatywną ścieżkę lub kanał. Problem ten dotyczy wersji przed 2024.05.1.
W SDK Pythona dla Sentry.io (sentry-sdk) w wersjach poniżej 2.8.0 występuje błąd, który pozwala na przekazywanie zmiennych środowiskowych do procesów podrzędnych, mimo ustawienia `env={}`. Problem ten został naprawiony w wersji 2.8.0 SDK.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS