CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Calendar app for Nextcloud discloses some internal paths of the website when the SMTP server is unavailable. It is recommended to update the Calendar app to version 3.5.5 or 4.2.3.
Nextcloud Mail is a mail app in Nextcloud that is vulnerable to a blind SSRF attack. This attack allows sending GET requests to services running on the same web server.
Craft is a CMS for creating custom digital experiences on the web. The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload.
The Object module in Liferay Portal versions 7.4.3.4 to 7.4.3.60 and Liferay DXP 7.4 before update 61 does not segment object definitions by virtual instance in searches. This allows remote authenticated users in one virtual instance to view object definitions from a second virtual instance.
The Object module in Liferay Portal versions 7.4.3.4 to 7.4.3.48 and Liferay DXP 7.4 before update 49 does not properly isolate objects in different virtual instances. This allows remote authenticated users in one virtual instance to view objects in a different virtual instance via the OAuth 2 scope administration page.
Jenkins SAML Single Sign On (SSO) Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for connections to miniOrange or the configured IdP to retrieve SAML metadata.
A vulnerability was found in Turante Sandbox Theme up to 1.5.2. It has been classified as problematic. This affects the function sandbox_body_class of the file functions.php. The manipulation of the argument page leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.6.1 is able to address this issue.
A memory leak vulnerability in the Mali GPU Kernel Driver (Midgard, Bifrost, Valhall, Avalon) allows a non-privileged user to perform valid GPU processing operations that expose sensitive kernel metadata.
A vulnerability classified as problematic was found in SourceCodester Best POS Management System 1.0. An unknown function in the file index.php?page=add-category is affected. Manipulation of the argument Name with the input "><img src=x onerror=prompt(document.domain);> leads to cross-site scripting. The attack can be launched remotely.
In JetBrains IntelliJ IDEA before 2022.2 local code execution via a Vagrant executable was possible. This vulnerability allowed execution of malicious code in the user's context.
Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: General/Core Client) affects versions 8.0.28 and prior. It allows an unauthenticated attacker with access to the infrastructure where MySQL Shell runs to compromise it, requiring interaction from a person other than the attacker.
W OpenSSH przed wersją 8.9 odkryto problem związany z uwierzytelnianiem kluczem publicznym przy użyciu przekazywania agenta. Jeśli atakujący zmodyfikował serwer, aby wspierał opcję uwierzytelniania None, użytkownik nie może określić, czy uwierzytelnienie FIDO potwierdza chęć połączenia z serwerem, czy też pozwala temu serwerowi na połączenie z innym serwerem w imieniu użytkownika.
Podatność CVE-2020-8562 dotyczy mechanizmu w Kubernetes, który ma na celu zapobieganie dostępowi do sieci lokalnych i localhost przez połączenia proxy. W wyniku błędu w walidacji odpowiedzi DNS, użytkownik może ominąć te ograniczenia i uzyskać dostęp do prywatnych sieci w kontrolerze.
After the initial setup process, some steps of setup.php are reachable not only by super-administrators but also by unauthenticated users. A malicious actor can pass step checks and potentially change the configuration of the Zabbix Frontend.
A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attacker to download arbitrary files on the device via specially crafted update packages.
Spoofing vulnerability in Microsoft Edge for iOS. An attacker can spoof trusted content, potentially leading to display of false information to the user.
Spoofing vulnerability in Microsoft Edge (Chromium-based). An attacker can spoof trusted content, potentially leading to display of false information to the user.
Information Disclosure Vulnerability in Azure RTOS. Details are not provided in the description, but the vulnerability may lead to data leakage.
Information Disclosure Vulnerability in Azure RTOS. Details are not provided in the description, but the vulnerability may lead to data leakage.
Information Disclosure Vulnerability in Azure Sphere. Details are not provided in the description, but the vulnerability may lead to data leakage.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS