CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.03)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
XStream before 1.4.15 contains a Server-Side Request Forgery (SSRF) vulnerability activated during unmarshalling. A remote attacker can request data from internal resources not publicly available by manipulating the processed input stream.
In OpenAsset Digital Asset Management (DAM) version 12.0.19 and earlier, access controls are missing on the /Stream/ProjectsCSV endpoint, allowing unauthenticated attackers to access potentially sensitive project information stored by the application.
OpenAsset Digital Asset Management (DAM) through version 12.0.19 does not properly sanitize user-supplied input in multiple parameters and endpoints, allowing for reflected cross-site scripting (XSS) attacks.
OpenAsset Digital Asset Management (DAM) through version 12.0.19 fails to properly sanitize user-supplied input in multiple parameters and endpoints, allowing stored cross-site scripting (XSS) attacks.
Vulnerability in Firefox for Android related to the Remote Debugging via USB feature, which was enabled on Android versions prior to 6.0. Untrusted apps could connect to the feature and operate with browser privileges to read and interact with web content.
OneCRL was non-functional in the new Firefox for Android due to a missing service initialization. This could result in a failure to enforce some certificate revocations. Note: This issue only affected Firefox for Android. Other operating systems are unaffected. Affects Firefox < 83.
When a user downloaded a file in Firefox for Android, if a cookie is set, it would be re-sent during a subsequent file download on the same domain, regardless of private or non-private browsing modes. Affects Firefox < 83.
When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on targeted websites. This vulnerability affects Firefox < 83.
A memory initialization issue was addressed. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 High Sierra, Security Update 2020-006 Mojave, iOS 14.2 and iPadOS 14.2, watchOS 5.3.9, macOS Catalina 10.15.7 Supplemental Update, macOS Catalina 10.15.7 Update. A malicious application may be able to disclose kernel memory.
Typ GeneralName w X.509 jest używany do reprezentowania różnych typów nazw, w tym EDIPartyName. Funkcja GENERAL_NAME_cmp w OpenSSL porównuje instancje GENERAL_NAME, ale w przypadku EDIPARTYNAME może prowadzić do dereferencji wskaźnika NULL i awarii, co może skutkować atakiem typu denial of service.
Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Affected versions: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.
A Cross-Site Scripting (XSS) vulnerability was discovered in SeedDMS 6.0.13 via the folderid parameter in views/bootstrap/class.DropFolderChooser.php. An attacker can inject malicious JavaScript code that executes in the victim's browser.
MISP version 2.4.135 has an XSS vulnerability in the authkey comment field in the genericField.ctp file.
The iconv function in the GNU C Library (glibc) 2.30 to 2.32, when converting UCS4 text containing an irreversible character, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service.
Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.
W jądrze Linuxa przed wersją 5.6.8 odkryto problem związany z funkcją do_madvise w pliku mm/madvise.c. Występuje warunek wyścigu pomiędzy operacjami coredump a implementacją IORING_OP_MADVISE.
In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker can inject malicious JavaScript code, leading to stored/blind XSS in the admin panel.
In Crafter CMS Crafter Studio 3.0.1 an IDOR vulnerability exists which allows unauthenticated attackers to view and modify administrative data.
An SSRF vulnerability in PDF generation in MicroStrategy 10.4, 2019 before Update 6, and 2020 before Update 2 allows authenticated users to access internal network resources or leak files from the local system via HTML containers embedded in a dossier/dashboard document. Version 10.4 will not receive a fix as it reaches end-of-life on 31/12/2020.
W Modicon M221 (wszystkie wersje) występuje podatność CWE-200, która umożliwia ujawnienie niepoufnych informacji. Atakujący może wykorzystać tę lukę, przechwytując ruch między oprogramowaniem EcoStruxure Machine - Basic a kontrolerem Modicon M221.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS