CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In the Linux kernel, a vulnerability exists in the ipv4 ip_tunnel_init_flow() function where code paths call it without holding the RCU read lock, triggering a suspicious RCU usage warning. The fix involves using l3mdev_master_upper_ifindex_by_index() which acquires the RCU read lock before calling the _rcu version.
The mediapool feature in Redaxo Core CMS version 5.17.1 is vulnerable to Cross-Site Scripting (XSS). A remote attacker can exploit this vulnerability to escalate privileges within the system.
In the Linux kernel, a vulnerability was resolved in HID: core by zero-initializing the report buffer. The report buffer is used by various drivers, and its non-zero initialization could lead to kernel memory leak via a specially crafted report.
In the Linux kernel, the enetc driver has a null pointer dereference vulnerability. The issue occurs when enetc_pf_set_vf_mac() is called before vf_state memory is allocated, leading to a system crash.
In the Linux kernel, the media av7110 driver has a Spectre-related vulnerability in dvb_ca_ioctl involving potential access to the av7110->ci_slot array. The fix addresses this vulnerability.
Podatność CVE-2024-11319 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w django CMS, co pozwala na ataki typu Cross-Site Scripting (XSS). Problem ten występuje w wersjach django-cms: 3.11.7, 3.11.8, 4.1.2 oraz 4.1.3.
Improper delimiter neutralization vulnerability in Cesanta Mongoose Web Server v7.14 allows triggering an infinite loop bug if the input string contains unexpected characters.
Out-of-range pointer offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space.
Improper delimiter neutralization vulnerability in Cesanta Mongoose Web Server v7.14 allows triggering an out-of-bound memory write if the PEM certificate contains unexpected characters.
A flaw was found within the parsing of SMB2 requests that have a transform header in the kernel ksmbd module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this to disclose sensitive information on affected installations of Linux. Only systems with ksmbd enabled are vulnerable to this CVE.
A vulnerability in the OAuth-server causes OAuth2 client secrets to be logged when the log level is set to Debug or higher for OIDC/GitHub/GitLab/Google login options.
A vulnerability in UltiMaker Cura versions 4.41, 5.8.1 and earlier allows a local attacker to execute arbitrary code via the Inter-process communication (IPC) mechanism between the Cura application and CuraEngine processes, localhost network stack, printing settings, and G-code processing and transmission components, as well as Ultimaker 3D Printers.
A vulnerability in kodbox version 1.52.04 and earlier allows a remote attacker to obtain sensitive information via the captcha feature in the password reset function.
A vulnerability in payload inspection for Ethernet Industrial Protocol (ENIP) traffic in Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured rules for ENIP traffic. This is due to incomplete processing during deep packet inspection. An attacker could exploit this by sending a crafted ENIP packet, potentially bypassing access control and intrusion policies.
An XSS issue was discovered in MDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message with JavaScript in an img tag, which could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window.
A flaw was found within the parsing of extended attributes in the kernel ksmbd module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this to disclose sensitive information on affected installations of Linux. Only systems with ksmbd enabled are vulnerable to this CVE.
W podatności CVE-2024-9477 występuje niewłaściwa neutralizacja danych wejściowych podczas generowania stron internetowych w oprogramowaniu AirTies Air4443, co umożliwia ataki typu Cross-Site Scripting (XSS). Problem ten dotyczy oprogramowania Air4443 do 14 października 2024 roku.
A missing authentication for critical function vulnerability exists in multiple Fortinet products (FortiManager, FortiOS, FortiPAM, FortiPortal, FortiProxy, FortiSwitchManager). An attacker can execute unauthorized code or commands via specially crafted packets.
A session fixation vulnerability in Fortinet FortiOS 7.4.0 through 7.4.3, FortiOS 7.2.0 through 7.2.7, FortiOS 7.0.0 through 7.0.13 allows attacker to execute unauthorized code or commands via phishing SAML authentication link.
NTLM Hash Disclosure Spoofing Vulnerability allows for the disclosure of NTLM hashes. An attacker could exploit this to impersonate a user or system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS