CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In the Linux kernel, the qedf driver for Fibre Channel adapters did not initialize delayed work (stag work) for all virtual ports (vports). This caused a warning in the workqueue system and issues with only 32 out of 64 NPIV ports appearing online. The fix initializes this work for all vports.
In the Linux kernel, a reference count issue was found in the qedf (QLogic Fibre Channel) driver when a LOGO request is received during a Task Management Function (TMF). This leads to hung I/O operations and a hung task warning. The fix addresses the reference count problem.
W OpenJPEG znaleziono lukę, która może prowadzić do wyczerpania zasobów w funkcji opj_t1_decode_cblks w pliku tcd.c. Wykorzystanie specjalnie przygotowanego pliku graficznego może spowodować odmowę usługi.
A flaw was found in OpenJPEG where maliciously constructed pictures can cause the program to enter a large loop and continuously print warning messages on the terminal.
In the Linux kernel, the mtk-vcodec driver has a potential NULL pointer dereference in SCP. The return value of devm_kzalloc() needs to be checked to avoid this issue. Similar to CVE-2022-3113.
A vulnerability was found in OpenJPEG similar to CVE-2019-6988, which allows an attacker to bypass existing protections and cause an application crash through a maliciously crafted file.
A vulnerability in Undertow requires enabling the learning-push handler in the server's config, which is disabled by default. With the default maxAge value of -1, the handler is vulnerable, but if someone overwrites that config, the server is not subject to the attack. The attacker needs to be able to reach the server with a normal HTTP request.
Podatność w ExtremePacs Extreme XDS pozwala na ominięcie autoryzacji poprzez klucz kontrolowany przez użytkownika, co umożliwia zbieranie danych dostarczonych przez użytkowników. Problem dotyczy wersji Extreme XDS przed 3928.
Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Reader (RtsUer.sys) before 10.0.22000.31274 allows for the leakage of kernel memory from both the stack and the heap.
Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Reader (RtsUer.sys) before 10.0.22000.31274 leaks driver logs containing addresses of kernel mode objects, weakening KASLR.
In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in June 2024.
A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated user with Administrator credentials to execute arbitrary commands as root on the underlying operating system. This is due to insufficient validation of arguments passed to specific configuration CLI commands.
CPython 3.9 and earlier does not disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols(), which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used. This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in practice.
W podatności CVE-2024-1153 występuje niewłaściwa neutralizacja specjalnych elementów używanych w poleceniach SQL, co prowadzi do ataku typu SQL Injection w aplikacjach Talya Informatics Travel APPS. Problem dotyczy wersji przed v17.0.68.
Podatność CVE-2024-4604 dotyczy mechanizmu SSO (Single Sign On) w Magarsus Consultancy, umożliwiając manipulację ukrytymi polami, co prowadzi do przekierowania URL do nieufnych witryn. Problem ten występuje w wersjach od 1.0 do przed 1.1.
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was configured to use AD for user management by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.
Podatność w aplikacji zdrowotnej Mia-Med firmy Mia Technology Inc. polega na użyciu uszkodzonego lub ryzykownego algorytmu kryptograficznego, co umożliwia fałszowanie podpisów z powodu niewłaściwej walidacji. Problem dotyczy wersji aplikacji przed 1.0.14.
Podatność CVE-2024-4754 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w oprogramowaniu Next4Biz CRM i BPM, co pozwala na ataki typu Stored XSS. Problem ten dotyczy wersji Business Process Management (BPM) od 6.6.4.4 do przed 6.6.4.5.
A Cross Site Scripting (XSS) vulnerability in Tessi Docubase Document Management product 5.x allows a remote attacker to execute arbitrary code via the "sectionContent" parameter in the functionality of adding notes to an uploaded file.
A Cross Site Scripting (XSS) vulnerability in Tessi Docubase Document Management product version 5.x allows a remote attacker to execute arbitrary code via the filename parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS