CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A Cross Site Scripting (XSS) vulnerability in Stimulsoft Dashboard.JS before version 2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload in the search bar component.
When a user scans a QR code with the QR Code Scanner feature, they are not prompted before being navigated to the page specified in the code. This may surprise the user and potentially direct them to unwanted content. This vulnerability affects Firefox for iOS < 129.
A Cross Site Scripting (XSS) vulnerability in Stimulsoft Dashboard.JS before version 2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload in the ReportName field.
A path traversal vulnerability was found in the CPIO utility. During extraction, the archiver could follow symlinks outside of the intended directory, allowing files to be written in arbitrary directories through symlinks.
A race condition was found in the Linux kernel's net/bluetooth in the sniff_{min,max}_interval_set() function. This can result in a Bluetooth sniffing exception issue, possibly leading to denial of service.
A race condition was found in the Linux kernel's net/bluetooth in {conn,adv}_{min,max}_interval_set() function. This can result in I2cap connection or broadcast abnormality, possibly leading to denial of service.
A race condition was found in the Linux kernel's net/bluetooth device driver in the conn_info_{min,max}_age_set() function. This can result in an integrity overflow issue, possibly leading to bluetooth connection abnormality or denial of service.
libexpat w wersji do 2.5.0 umożliwia rekurencyjne rozszerzanie encji XML, jeśli XML_DTD nie jest zdefiniowane w czasie kompilacji. Może to prowadzić do problemów z wydajnością i potencjalnych ataków DoS.
A vulnerability in Solar-Log Base 15 Firmware 6.0.1 Build 161 allows privilege escalation via stored XSS in the switch group function. An attacker can gain installer or PM rights and then administrative access to the web portal.
An integer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. The issue occurs when these functions are called with a very long message, leading to incorrect calculation of the buffer size and undefined behavior. This affects glibc 2.37 and newer.
W Mbed TLS w wersjach 2.x przed 2.28.7 oraz 3.x przed 3.5.2 odkryto problem związany z czasowym kanałem bocznym w operacjach prywatnych RSA. Taki kanał boczny może umożliwić lokalnemu atakującemu odzyskanie tekstu jawnego.
Uncontrolled resource consumption vulnerability in SE-elektronic GmbH E-DDC3.3 affecting versions 03.07.03 and higher. An attacker could interrupt the availability of the administration panel by sending multiple ICMP packets.
Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack. Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly due to a NULL pointer dereference.
An issue in the official Plone Docker image version 5.2.13 (5221) allows remote code execution due to improper validation of HOST headers.
An integer overflow or wraparound vulnerability in the md/raid/raid5 module of the Linux kernel on x86 and ARM platforms allows forced integer overflow. The issue affects RAID modules.
A NULL pointer dereference vulnerability in the Bluetooth (rfcomm) module of the Linux kernel on x86 and ARM platforms allows buffer overflow. The issue affects the file /net/bluetooth/rfcomm/core.C and exists since kernel v2.6.12-rc2.
Since version 5.2.0, when using deferrable mode with a Kubernetes configuration file for authentication, the Airflow worker serializes this file as a dictionary and stores it in metadata without encryption. In versions 2.3.0-2.6.0, the dictionary is also logged as plain text in the triggerer service. This allows anyone with access to metadata or logs to obtain the configuration file and access the Kubernetes cluster.
In the Linux kernel through 6.7.1, there is a use-after-free in cec_queue_msg_fh, related to drivers/media/cec/core/cec-adap.c and drivers/media/cec/core/cec-api.c.
In the Linux kernel, in the ext4 filesystem (file super.c), there is a use-after-free flaw in __ext4_remount. This occurs when freeing old quota file names before a potential failure, leading to an information leak.
A critical path traversal vulnerability exists in D-Link DIR-859 1.06B01 in the /hedwig.cgi file of the HTTP POST Request Handler. Manipulation of the 'service' argument allows remote attack, and the exploit has been publicly disclosed.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS