CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
W podatności CVE-2024-1153 występuje niewłaściwa neutralizacja specjalnych elementów używanych w poleceniach SQL, co prowadzi do ataku typu SQL Injection w aplikacjach Talya Informatics Travel APPS. Problem dotyczy wersji przed v17.0.68.
A heap buffer overflow vulnerability in Libde265 v1.0.15 allows attackers to crash the application via a crafted payload to the __interceptor_memcpy function.
A heap buffer overflow exists in Libde265 v1.0.15 in the display444as420 function in sdl.cc. An attacker can crash the application via a crafted payload.
Podatność CVE-2024-4604 dotyczy mechanizmu SSO (Single Sign On) w Magarsus Consultancy, umożliwiając manipulację ukrytymi polami, co prowadzi do przekierowania URL do nieufnych witryn. Problem ten występuje w wersjach od 1.0 do przed 1.1.
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was configured to use AD for user management by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.
Podatność w aplikacji zdrowotnej Mia-Med firmy Mia Technology Inc. polega na użyciu uszkodzonego lub ryzykownego algorytmu kryptograficznego, co umożliwia fałszowanie podpisów z powodu niewłaściwej walidacji. Problem dotyczy wersji aplikacji przed 1.0.14.
Podatność CVE-2024-4754 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w oprogramowaniu Next4Biz CRM i BPM, co pozwala na ataki typu Stored XSS. Problem ten dotyczy wersji Business Process Management (BPM) od 6.6.4.4 do przed 6.6.4.5.
A Cross Site Scripting (XSS) vulnerability in Tessi Docubase Document Management product 5.x allows a remote attacker to execute arbitrary code via the "sectionContent" parameter in the functionality of adding notes to an uploaded file.
A Cross Site Scripting (XSS) vulnerability in Tessi Docubase Document Management product version 5.x allows a remote attacker to execute arbitrary code via the filename parameter.
A Cross Site Scripting (XSS) vulnerability in Tessi Docubase Document Management product version 5.x allows a remote attacker to execute arbitrary code via the idactivity parameter.
A Cross Site Scripting (XSS) vulnerability in Tessi Docubase Document Management product version 5.x allows a remote attacker to execute arbitrary code via the 'page' parameter.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Live Composer Team Page Builder: Live Composer (live-composer-page-builder) allows DOM-Based XSS. This issue affects Page Builder: Live Composer from n/a through 2.1.22.
In the Linux kernel, the dma-buf/sw-sync module's sync_print_obj() calls spin_unlock_irq(), which enables interrupts in a context where they should not be enabled. This triggers inconsistent lock state warnings (lockdep).
In the Linux kernel, BPF programs attached to tracepoints can trigger locking rule violations by performing map_delete on sockmap/sockhash. The existing verifier allowed-program-type check for updating sockmap/sockhash was extended to also cover deleting from a map. From now on only BPF programs which were previously allowed to update sockmap/sockhash can delete from these map types.
In the Linux kernel, the ntfs3 filesystem was fixed to check the 'folio' pointer for NULL, as it can be NULL when bmap is called. This prevents a NULL pointer dereference.
In the Linux kernel's drm/msm/dpu driver, dpu_core_irq_callback_handler() compares a callback function pointer to NULL but then calls it unconditionally. This bug leads to a NULL pointer call and potential kernel crash.
A shift-out-of-bounds vulnerability exists in the Linux kernel's dctcp_update_alpha() function. It occurs because the module parameter dctcp_shift_g is not properly validated, allowing an excessively large value that causes undefined behavior. The fix limits the maximum value of this parameter.
In the Linux kernel, tls_init() lacks a write memory barrier, which may cause a NULL dereference in tls_{setsockopt,getsockopt} due to store-store reordering. Fixed by using rcu_assign_pointer() after initializing ctx->sk_proto.
A vulnerability in the Linux kernel's __inet_accept function was found, where an overly strict socket state check triggers a kernel warning (splat) when accept() is called on a socket in FIN_WAIT1 state. This occurs when shutdown() is invoked before the socket enters the listener state, leading to an invalid state and potential disruption of network services.
In the Linux kernel, the netfilter tproxy function nf_tproxy_laddr4() can dereference NULL because __in_dev_get_rcu() may return NULL. A check for this case was added.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS