CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An issue was discovered in MISP before version 2.4.121 where ACLs for discussion threads were mishandled in app/Controller/ThreadsController.php and app/Model/Thread.php.
An issue was discovered in MISP before version 2.4.121, which did not canonicalize usernames when trying to block a brute-force series of invalid requests.
An issue was discovered in MISP before version 2.4.121 that mishandled time skew between the web server and the database, potentially leading to ineffective protection against brute-force attacks.
In PHP, the EXIF extension parsing EXIF information from an image (e.g., via exif_read_data()) in versions 7.2.x below 7.2.26, 7.3.x below 7.3.13, and 7.4.0 can read past the allocated buffer, potentially leading to information disclosure or crash.
In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to the mail() function, if the header is supplied in lowercase, it can result in double-freeing certain memory locations.
In RubyGem excon before version 0.71.0, a race condition exists around persistent connections. An interrupted connection (e.g., due to a timeout) leaves data on the socket, which is read by subsequent requests, returning content from the previous response. The race condition window is narrow, making intentional exploitation difficult.
In MISP 2.4.118 in app/Controller/TagsController.php, users can bypass intended restrictions on tagging data.
Out of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
The Quick Tabs module for Drupal has an XSS vulnerability in versions 6.x-2.x before 6.x-2.1, 6.x-3.x before 6.x-3.1, and 7.x-3.x before 7.x-3.3. This allows an attacker to inject client-side scripts.
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).
In tesseract 2.03 and 2.04, an attacker can rewrite an arbitrary user file by guessing the PID and creating a link to the user's file. The vulnerability stems from insufficient protection of temporary file operations.
A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This can result in an XSS attack.
A vulnerability in the HTTP traffic filtering component of Cisco Firepower Threat Defense, FirePOWER Services for ASA, and Firepower Management Center Software could allow an unauthenticated, remote attacker to bypass filtering protections. This is due to improper handling of HTTP requests, including over HTTPS, with maliciously crafted headers. An attacker could send malicious requests to bypass filtering and deliver malicious content to protected systems.
A vulnerability in the normalization functionality of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower Management Center Software could allow an unauthenticated, remote attacker to bypass filtering protections. The issue is due to insufficient normalization of a text-based payload. An attacker could exploit this by sending traffic with specifically obfuscated payloads through an affected device.
A vulnerability in the protocol detection component of Cisco Firepower Threat Defense, FirePOWER Services for ASA, and Firepower Management Center Software could allow an unauthenticated, remote attacker to bypass filtering protections. This is due to improper detection of initial protocol use on a nonstandard port. An attacker could send traffic on a nonstandard port to bypass filtering and deliver malicious requests to protected systems.
A vulnerability in the stream reassembly component of Cisco Firepower Threat Defense Software, FirePOWER Services Software for ASA, and Firepower Management Center Software could allow an unauthenticated, remote attacker to bypass filtering protections. The issue is due to improper reassembly of traffic streams. An attacker could exploit this by sending crafted streams through an affected device, potentially delivering malicious requests to protected systems.
Na urządzeniach Hyundai Pay Kasse HK-1000 odkryto kanał boczny związany z wyświetlaczem OLED opartym na wierszach. Zużycie energii przez każdy cykl wyświetlacza zależy od liczby podświetlonych pikseli, co umożliwia częściowe odzyskanie zawartości wyświetlacza.
A heap-based buffer over-read exists in the terminfo library of ncurses before version 6.1-20191012 in the fmt_entry function in tinfo/comp_hash.c.
A heap-based buffer over-read exists in the terminfo library of ncurses before version 6.1-20191012 in the _nc_find_entry function in tinfo/comp_hash.c.
The "managed-keys" feature in BIND allows automatic maintenance of keys used by trust anchors. Due to an error in this feature, a BIND server using managed-keys can exit due to an assertion failure if, during key rollover, a trust anchor's keys are replaced with keys using an unsupported algorithm. Affected versions: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P1, 9.12.0 -> 9.12.3-P1, and versions 9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2018-5745.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS