CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The svg_optimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents. This can lead to an XML Entity Expansion attack.
A directory traversal was identified in Paessler PRTG before 23.4.88.1429 that made it possible to read local files.
The femanager extension 7 before 7.2.2 for TYPO3 has Incorrect Access Control: it lacks a check for permissions for the invitation component.
A directory traversal vulnerability in DataEase before 1.18.10 allows a remote attacker to obtain sensitive information via a crafted request to the StaticResourceController.java component.
An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor, and Modem (including Exynos 9810, 9610, 9820, 980, 850, 1080, 2100, 2200, 1280, 1380, 1330, 9110, W920, Modem 5123, Modem 5300, and Auto T5123). In the Shannon SM Task, improper handling of a loop with an unreachable exit condition cannot guarantee termination of a required service via a malformed SM message.
An issue was discovered in the ProofreadPage extension for MediaWiki through 1.39.3. It leaks information about a suppressed user via the API and config variables.
A flaw has been found in GPAC up to f1219cde. Affected by this vulnerability is the function gf_node_get_field_count of the file scenegraph/base_scenegraph.c of the component MP4Box. Executing a manipulation can lead to reachable assertion. It is possible to launch the attack on the local host. The exploit has been published and may be used.
A vulnerability was detected in GPAC up to f1219cde. Affected is the function gf_node_unregister of the file scenegraph/base_scenegraph.c of the component MP4Box. Performing a manipulation results in reachable assertion. Attacking locally is a requirement. The exploit is now public and may be used.
A security vulnerability was detected in Matthias-Wandel jhead up to 3.3. It affects the ProcessGpsInfo function in gpsinfo.c of the WebP EXIF Handler component. Manipulation of the TAG_GPS_LAT/TAG_GPS_LONG arguments leads to a heap-based buffer overflow. The attack requires local access and the exploit has been publicly disclosed.
A weakness has been identified in Matthias-Wandel jhead up to 3.3. This affects the function Get16u of the file exif.c of the component EXIF Parsing. This manipulation causes out-of-bounds read. The attack requires local access. The exploit has been made available to the public and could be used for attacks.
An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. Special:CheckUserLog shows usernames that have been hidden.
HotelDruid before 3.0.6 has insufficient file upload sanitation in the backup/restore function. This may allow uploading dangerous files.
The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certain TrustCor root certificates from the root store. This issue exists because of an incorrect fix for CVE-2022-23491.
An issue was discovered in ILIAS 6.23, 7 before 7.22, and 8.1. An attacker can execute arbitrary code via ZIP upload.
An issue was discovered in Softing OPC UA C++ SDK through 6.20 and Softing Secure Integration Server through 1.22. By using FileType renames, it is possible to bypass limitations on assignment of a directory path to FileDirectory OPC UA objects and a file path to File OPC UA objects.
A bodyclass XSS issue was discovered in Paessler PRTG before version 23.3.86.1520. The vulnerability allows injection of malicious script into the application interface.
Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the record length parameter.
An issue in Portable Puzzle Collection before 20230116.5782e29 allows attackers to cause a Denial of Service (DoS) via creating an excessive amount of save states.
Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the "M" command.
Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the game description parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS