CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SvelteKit versions 2.49.0 through 2.49.4 contain a vulnerability in the experimental form remote function, which uses a binary data format for submitted form data. A specially crafted payload can cause the server to allocate a large amount of memory, leading to DoS via memory exhaustion. The vulnerability is fixed in version 2.49.5.
Svelte devalue library versions 5.1.0 through 5.6.1 are vulnerable to a denial of service (DoS) attack via excessive CPU and memory consumption when parsing specially crafted input. The issue stems from missing input validation before base64 decoding during ArrayBuffer hydration.
Svelte devalue library versions 5.3.0 through 5.6.1 contain a denial of service vulnerability. Malformed inputs can cause excessive CPU and memory consumption during devalue.parse, affecting systems that parse untrusted data.
Docmost, an open-source collaborative wiki and documentation software, versions 0.21.0 through before 0.24.0, is vulnerable to Arbitrary File Write via the Zip Import feature (ZipSlip). The lack of filename validation in file.utils.ts allows an attacker to write files to arbitrary locations on the server.
Podatność w oprogramowaniu PAN-OS firmy Palo Alto Networks pozwala nieautoryzowanemu atakującemu na spowodowanie odmowy usługi (DoS) dla zapory sieciowej. Powtarzające się próby wywołania tego problemu prowadzą do przejścia zapory w tryb konserwacji.
Podatność CVE-2025-13845 to błąd typu Use After Free, który może prowadzić do zdalnego wykonania kodu, gdy użytkownik końcowy zaimportuje złośliwy plik projektu (plik SSD) do Rapsody.
A Null Pointer Dereference vulnerability exists in the referer header check of the web portal of TP-Link TL-WR841N v14, caused by improper input validation. A remote, unauthenticated attacker can exploit this flaw and cause Denial of Service on the web portal service. This issue affects TL-WR841N v14 before version 250908.
A stack overflow in the dump_ttxt_sample function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet.
A logic error in key-based pairing may lead to an ID disclosure. This vulnerability allows remote (proximal/adjacent) disclosure of user conversations and location without requiring additional privileges or user interaction.
Pimcore is an open source data and experience management platform. Prior to versions 12.3.1 and 11.5.14, the http_error_log file stores the $_COOKIE and $_SERVER variables, which means sensitive information such as database passwords, cookie session data, and other details can be accessed or recovered through the Pimcore backend.
LaSuite Doc to platforma do współpracy w zakresie notatek, wiki i dokumentacji. W wersjach od 3.8.0 do 4.3.0 występuje podatność typu Stored Cross-Site Scripting (XSS) w funkcji interlinkowania, która pozwala na wstrzyknięcie złośliwego kodu przez atakującego z uprawnieniami do edycji dokumentów.
Roxy-WI to interfejs webowy do zarządzania serwerami Haproxy, Nginx, Apache i Keepalived. Przed wersją 8.2.8.2 występowała podatność na wstrzykiwanie poleceń w funkcjonalności przeglądania logów, która pozwalała uwierzytelnionym użytkownikom na wykonywanie dowolnych poleceń systemowych.
A stack overflow vulnerability was discovered in the mac parameter of the sub_65B5C function in Tenda AX-1806 firmware version 1.0.0.1. This flaw allows attackers to cause a Denial of Service (DoS) via a crafted request.
An out-of-bounds read in the GSF demuxer filter component of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .gsf file.
A buffer overflow in the vobsub_get_subpic_duration() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet.
GPAC v2.4.0 was found to contain an out-of-bounds read in the oggdmx_parse_tags function. The issue occurs during processing of OGG data.
GLPI is a free asset and IT management software package. From version 11.0.0 to 11.0.2 (before 11.0.3), an unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in version 11.0.3.
DPanel to otwartoźródłowy panel zarządzania serwerem napisany w Go. W wersjach przed 1.9.2 występuje podatność na usuwanie dowolnych plików w interfejsie /api/common/attach/delete, umożliwiająca uwierzytelnionym użytkownikom usuwanie plików na serwerze poprzez przejście ścieżki.
The Ludashi driver before version 5.1025 has a local information disclosure vulnerability due to missing access control in the IOCTL handler. An unprivileged user can read arbitrary physical memory, including kernel structures, pointers, and security tokens.
Omnispace Agora Project before version 25.10 contains a file upload vulnerability that allows authenticated users, and under certain conditions also guest users, to upload files via the UploadTmpFile action.