CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
FIBARO System Home Center w wersji 5.021 zawiera podatność na zdalne włączenie pliku w nieudokumentowanym API proxy, co pozwala atakującym na włączenie dowolnych skryptów po stronie klienta. Atakujący mogą wykorzystać parametr GET 'url' do wstrzyknięcia złośliwego JavaScriptu, co może prowadzić do przejęcia sesji użytkownika lub manipulacji treścią strony.
Klient Forcepoint One DLP w wersji 23.04.5642 (i prawdopodobnie nowszych) zawiera ograniczoną wersję Pythona 2.5.4, która uniemożliwia korzystanie z biblioteki ctypes. Ograniczenia te mogą być jednak obejście.
W serii OpenBlocks w wersjach przed FW5.0.8 występuje problem z ominięciem uwierzytelniania, który może pozwolić atakującemu na ominięcie uwierzytelnienia administratora i zmianę hasła.
Wtyczka BuddyPress Xprofile Custom Field Types dla WordPressa jest podatna na nieautoryzowane usuwanie plików z powodu niewystarczającej walidacji ścieżek plików w funkcji 'delete_field' we wszystkich wersjach do i włącznie z 1.2.8. Umożliwia to uwierzytelnionym atakującym, posiadającym dostęp na poziomie Subskrybenta i wyżej, usuwanie dowolnych plików na serwerze.
The iccDEV library in versions 2.3.1 and below has undefined behavior in the CIccCLUT::Init function, which initializes and sets the size of a CLUT. This issue is fixed in version 2.3.1.1.
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below have a Heap-based Buffer Overflow in its CIccMBB::Validate function which checks tag data validity. This issue is fixed in version 2.3.1.1.
The iccDEV library in versions 2.3.1.1 and below contains Use After Free, Heap-based Buffer Overflow, Integer Overflow or Wraparound, and Out-of-bounds Write vulnerabilities in the CIccSparseMatrix::CIccSparseMatrix function. This issue is fixed in version 2.3.1.2.
The iccDEV library in versions 2.3.1.1 and earlier is prone to Undefined Behavior (UB) and Out of Memory errors. This issue is fixed in version 2.3.1.2.
An uncontrolled DLL loading path vulnerability exists in AsusSoftwareManagerAgent. A local attacker may influence the application to load a DLL from an attacker-controlled location, potentially resulting in arbitrary code execution.
The iccDEV library in versions 2.3.1 and below contains overflows and underflows in the CIccXmlArrayType::ParseTextCountNum() function. This vulnerability affects users processing ICC color profiles. The issue is fixed in version 2.3.1.1.
W seninf występuje możliwe uszkodzenie pamięci spowodowane warunkiem wyścigu. Może to prowadzić do lokalnego podniesienia uprawnień, jeśli złośliwy aktor już uzyskał uprawnienia systemowe. Interakcja użytkownika nie jest potrzebna do wykorzystania tej podatności.
In the mminfra component, a vulnerability was found involving an out-of-bounds write due to a missing bounds check. This could lead to local privilege escalation if an attacker has already obtained System privilege. No user interaction is required for exploitation.
In c2ps, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation.
In the battery module, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local privilege escalation if an attacker has already obtained System privilege. User interaction is not required for exploitation.
In the battery module, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local privilege escalation if an attacker already has System privilege. User interaction is not required for exploitation.
In the imgsys component, an out-of-bounds write vulnerability exists due to improper input validation. This could lead to local privilege escalation if an attacker already has System privileges. User interaction is required for exploitation.
In KeyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation.
W systemie wyświetlania występuje możliwe uszkodzenie pamięci z powodu użycia po zwolnieniu. Może to prowadzić do lokalnego podniesienia uprawnień, jeśli złośliwy aktor już uzyskał uprawnienia systemowe.
In the display module, there is a possible memory corruption due to use-after-free. This could lead to local privilege escalation if a malicious actor has already obtained System privilege. User interaction is not needed for exploitation.
In the display module, a use-after-free vulnerability exists due to a race condition. This could lead to local privilege escalation if an attacker has already obtained System privilege. User interaction is not required for exploitation.