CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Netty (io.netty:netty-codec-http2) before version 4.1.60.Final contains a vulnerability enabling request smuggling. When an HTTP/2 request is converted to HTTP/1.1 by `Http2StreamFrameToHttpObjectCodec` and forwarded to a remote peer, the Content-Length header is not validated by `Http2MultiplexHandler`, allowing an attacker to smuggle additional requests within the body.
A stored cross-site scripting (XSS) vulnerability in Maxum Rumpus 8.2.13 and 8.2.14 allows attackers to inject malicious scripts via folder names. Insufficient input validation leads to persistent script storage on the server.
A NULL pointer dereference flaw in the Linux kernel's GPU Nouveau driver before version 5.12-rc1 occurs when a user calls ioctl DRM_IOCTL_NOUVEAU_CHANNEL_ALLOC, allowing a local user to crash the system.
Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to read or write certain local files.
In the Zstandard command-line utility, from v1.4.1 to v1.4.9, due to an incomplete fix for CVE-2021-24031, output files are created with default permissions and then restricted immediately afterwards. Output files could momentarily be readable or writable to unintended parties.
A reflected cross-site scripting (XSS) vulnerability exists in qcubed (all versions including 3.1.1) in profile.php via the stQuery parameter. It allows unauthenticated attackers to steal sessions of authenticated users.
Pug is a template engine for Node.js. In versions before 3.0.1, if a remote attacker could control the `pretty` option of the Pug compiler (e.g., by spreading a user-provided object into template inputs), they could achieve remote code execution on the Node.js backend. This is fixed in version 3.0.1, with a backported fix for pug-code-gen in version 2.0.3.
Remote code execution vulnerability in Microsoft Exchange Server. An attacker can exploit this flaw to execute arbitrary code on the server.
An issue was discovered in app/Model/SharingGroupServer.php in MISP 2.4.139, where the implementation of Sharing Groups sometimes provided view access to unintended actors via the 'all org' flag.
The iconv function in the GNU C Library (glibc) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance the input state, which could lead to an infinite loop in applications, resulting in a denial of service, a different vulnerability from CVE-2016-10228.
The mongodb-client-encryption module version 1.2.0 for Node.js does not correctly validate the KMS server's certificate. In combination with a privileged network position MITM attack, it could allow interception of traffic between the Node.js driver and the KMS service, rendering field level encryption ineffective.
The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure.
An issue was discovered in netplex json-smart-v1 through 2015-10-23 and json-smart-v2 through 2.4. An exception is thrown from a function, but it is not caught, as demonstrated by NumberFormatException. When it is not caught, it may cause programs using the library to crash or expose sensitive information.
Yeastar NeoGate TG400 devices running firmware version 91.3.0.3 are affected by a directory traversal vulnerability. An authenticated user can decrypt the firmware and read sensitive information, such as passwords or decryption keys.
W urządzeniach PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 oraz PM800 występuje podatność typu CWE-352: Cross-Site Request Forgery. Może to spowodować, że użytkownik wykona niezamierzoną akcję na docelowym urządzeniu podczas korzystania z interfejsu webowego HTTP.
Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS) in /usr/local/nagiosxi/html/admin/sshterm.php due to improper input sanitization. A crafted URL can steal admin session cookies or be chained with other bugs for one-click RCE.
The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server.
Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
CASAP Automated Enrollment System 1.0 is vulnerable to cross-site scripting (XSS) in users.php. An attacker can steal a user's session cookie and redirect them to a malicious website.
Netty is an open-source, asynchronous event-driven network application framework. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an insecure temp file. When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS