CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The WooCommerce WordPress plugin before version 8.6 fails to prevent users with at least the contributor role from leaking products they should not have access to, such as private, draft, and trashed products.
A vulnerability in ZKTeko BioTime version 8.5.4 and earlier allows a remote attacker to obtain sensitive information through the Authentication & Authorization component.
A vulnerability has been identified in the Linux kernel related to null pointer dereference in the ALSA usb-audio module. This issue has been resolved by adding a null check before dereferencing the cs_desc pointer.
In the Linux kernel, the USB Type-C driver (tipd) function tps6598x_block_read triggers a WARN_ON when given an excessive length, potentially causing a system panic if panic-on-warn is enabled.
The Subscribe To Comments Reloaded WordPress plugin (by WPKube) up to version 220725 has a vulnerability that inserts sensitive information into log files, potentially leading to data leakage.
The ConvertKit WordPress plugin up to version 2.4.5 has a vulnerability that inserts sensitive information into log files, potentially leading to data leakage.
A user enumeration vulnerability was found in Portainer CE 2.19.4. During the authentication process, a difference in response time allows a remote unauthenticated attacker to determine if a username is valid.
A NullPointerException was discovered in Time4J Base v5.9.3 in the FormatUtils::useDefaultWeekmodel(Locale) method. Note: multiple third parties dispute the existence of this vulnerability, citing insufficient evidence.
An information disclosure vulnerability in the Azure Identity Library for .NET. Technical details are not provided in the description.
A NullPointerException was discovered in JGraphT Core version 1.5.2 within the compare method of the ToleranceDoubleComparator class. However, multiple third parties dispute the existence of this vulnerability, suggesting the report may be based on an insufficiently robust tool.
There is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
In the Linux kernel, a bug was found in wakeup_kswapd() called with an invalid zone index (-1) on NUMA systems without local memory on a node, causing a page fault and system crash.
W Mbed TLS w wersji 3.5.x przed 3.6.0 odkryto problem związany z negocjacją wersji TLS po stronie serwera. Może on przejść do implementacji TLS 1.2, nawet jeśli została ona wyłączona, co prowadzi do nieskończonej pętli w przypadku klienta TLS 1.2 próbującego połączyć się z serwerem obsługującym tylko TLS 1.3.
W Mbed TLS w wersjach 3.5.x przed 3.6.0 odkryto problem, który występuje podczas resetowania kontekstu SSL za pomocą API mbedtls_ssl_session_reset(). Maksymalna wersja TLS do negocjacji nie była przywracana do skonfigurowanej, co pozwalało atakującemu na zablokowanie nawiązywania połączeń TLS 1.3.
A Cross Site Scripting (XSS) vulnerability in CA17 TeamsACS version 1.0.1 allows a remote attacker to execute arbitrary code via a crafted script in the errmsg parameter.
A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name assigned the default certificate instead of a mapped certificate, the SSL context is erroneously cached in the server name map, leading to memory exhaustion. Attackers can send TLS client hello messages with fake server names, triggering a JVM out-of-memory error.
A Cross Site Scripting (XSS) vulnerability in Insurance Management System version 1.0.0 and earlier allows a remote attacker to execute arbitrary JavaScript code in the victim's browser via the "First Name" input field.
A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. The leak occurs when the Vert.x HTTP client establishes connections to different hosts, and can be accelerated by an attacker with intimate runtime knowledge. A server accepting arbitrary internet addresses could serve as an attack vector by connecting to these addresses, thereby accelerating the memory leak.
A Cross-Site Scripting (XSS) vulnerability exists in dcat-admin version 2.1.3 and earlier. A remote attacker can inject a malicious script via the user login box to execute arbitrary code.
A flaw in GnuTLS can cause an application crash when verifying a specially crafted .pem bundle using the 'certtool --verify-chain' command.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS