CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In the Linux kernel, a use-after-free (UAF) vulnerability was found in the amdgpu driver during GPU recovery. The race condition between the timeout callback and the TDR work queue allows access to the job's pasid field after the job has been freed.
In the Linux kernel, the tpm2-sessions module has an out-of-range indexing vulnerability in the 'name_size' field. Lack of range validation can lead to memory corruption when using unknown TPM_ALG_ID values.
In the Linux kernel's openvswitch module, a vulnerability was found due to missing validation of the middle attribute in the push_nsh() action. An attacker can send a crafted Netlink packet that bypasses validation and causes a slab-out-of-bounds read during action execution.
In the Linux kernel, a vulnerability was found in the SCSI target subsystem where a NULL pointer dereference occurs in the error path when allocation of t_task_cdb fails. The fix resets the NULL pointer to the default fixed-size buffer.
In the Linux kernel's HFS+ filesystem, a vulnerability was found due to a missing hfs_bnode_get() call in __hfs_bnode_create(). When sync() and link() are called concurrently, two threads may attempt to create the same B-tree node, leading to a double-free and triggering a BUG_ON assertion.
In the Linux kernel, the bnxt_en driver has a vulnerability in the XDP_TX path. Incorrect clearing of event flags can cause the driver to not ring the TX doorbell, leading to RX ring stall and packet loss.
An authentication bypass vulnerability exists in Semantic machines version 5.4.8. Attackers can send a crafted HTTP request to various API endpoints to gain unauthorized access.
Zidentyfikowano podatność w instalacji/odinstalacji aplikacji Nessus Agent Tray na systemach Windows, która może prowadzić do eskalacji uprawnień.
Podatność CVE-2025-13447 dotyczy zdalnego wykonania kodu poprzez wstrzyknięcie poleceń systemowych w API Progress LoadMaster. Umożliwia to uwierzytelnionemu atakującemu z uprawnieniami 'Zarządzanie użytkownikami' wykonanie dowolnych poleceń na urządzeniu LoadMaster, wykorzystując niesanitizowane dane wejściowe w parametrach API.
Podatność CVE-2025-13444 dotyczy zdalnego wykonania kodu poprzez wstrzyknięcie poleceń systemowych w API urządzenia Progress LoadMaster. Umożliwia to uwierzytelnionemu atakującemu z uprawnieniami 'Zarządzanie użytkownikami' wykonanie dowolnych poleceń na urządzeniu LoadMaster poprzez wykorzystanie niesanitarnych danych wejściowych w parametrach API.
Memory safety bugs were found in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146, and Thunderbird 146. Some of these bugs showed evidence of memory corruption and could potentially be exploited to run arbitrary code with sufficient effort.
Podatność typu denial-of-service w komponencie Service Workers w DOM. Została naprawiona w wersjach Firefox 147 i Thunderbird 147.
A use-after-free vulnerability was found in the IPC component of Firefox and Thunderbird. It is fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.
An integer overflow in the Graphics component of Firefox and Thunderbird allows a sandbox escape. The vulnerability is fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.
A sandbox escape vulnerability exists in the Graphics: CanvasWebGL component due to incorrect boundary conditions. This flaw was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.
This vulnerability allows bypassing security mechanisms in the DOM component of Firefox and Thunderbird. The flaw is fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.
A Cross-Site Scripting (XSS) vulnerability was found in the Lemonsoft WordPress add-on due to improper input neutralization during web page generation. This issue affects the add-on version 2025.7.1.
Wersje ManageEngine PAM360 przed 8202, Password Manager Pro przed 13221 oraz Access Manager Plus przed 4401 mają lukę w autoryzacji w funkcji inicjowania zdalnej sesji. Problem ten może prowadzić do nieautoryzowanego dostępu do systemów.
W wersjach Progress Flowmon ADS przed 12.5.4 i 13.0.1 występuje podatność na wstrzykiwanie SQL, która pozwala uwierzytelnionym użytkownikom na wykonywanie niezamierzonych zapytań i poleceń SQL.
A deserialization flaw in TYPO3's mail-file spool allows local users with write access to the spool directory to craft a malicious file that is deserialized during the mailer:spool:send command, enabling arbitrary PHP code execution on the web server. This affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22, and 14.0.0-14.0.1.