CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Budibase is a low-code platform that prior to version 3.39.0 had a vulnerability in the /api/public/v1/roles/assign endpoint. It allows users with builder roles to promote themselves to global admin, leading to tenant-wide privilege escalation.
Budibase is an open-source low-code platform. In versions prior to 3.38.2, there was no role check in the SCIM router, allowing any authenticated user to perform CRUD operations on users and groups in the tenants.
Dalfox, an XSS scanning tool, prior to version 2.13.0, allowed arbitrary shell command execution by unauthorized users when the server was run in REST API mode. The issue stemmed from the deserialization of attacker-supplied JSON data, enabling command execution on the host.
Nx Console, the user interface for Nx and Lerna, had a malicious version 18.95.0 available for about 18 minutes in Visual Studio Marketplace and about 36 minutes in OpenVSX. Users should upgrade to version 18.100.0, which is not compromised.
In versions prior to 4.2.2, free5GC's NEF mounts the nnef-pfdmanagement route group without OAuth2/bearer-token authorization. A network attacker can use a forged token to access PFD application data and manage change-notification subscriptions.
In versions prior to 4.2.2, free5GC's SMF does not implement OAuth2/bearer-token authorization for the UPI management route group, allowing attackers to access UPI endpoints without an authorization header.
In versions prior to 4.2.2, free5GC's NEF did not require OAuth2/bearer-token authorization for the nnef-oam route group. A network attacker could access the OAM route without an authorization header, resulting in a 200 OK response.
In versions prior to 4.2.2, free5GC's NEF did not require OAuth2/bearer-token authorization for the 3gpp-traffic-influence API. A network attacker could create, read, patch, and delete traffic-influence subscriptions without proper authorization headers.
free5GC is an open-source implementation of the 5G core network. Prior to version 4.2.2, free5GC's NEF did not require OAuth2/bearer-token authorization for the PFD management API, allowing attackers to manipulate PFD transaction state using a forged token.
Webmin before 2.640 does not safely construct a filename for saving of an attachment within the mailboxes component. This occurs in mailboxes/detachall.cgi.
go-git to rozszerzalna biblioteka implementacji Gita napisana w czystym Go. W wersjach przed 5.19.1 i 6.0.0-alpha.4, transport SSH w go-git konstruuje polecenie zdalnego wykonania, otaczając ścieżkę repozytorium pojedynczymi cudzysłowami, nie escape'ując wbudowanych pojedynczych cudzysłowów. Ścieżka repozytorium zawierająca pojedynczy cudzysłów może więc wydostać się z cytowanego regionu w poleceniu exec i zostać dodana jako dodatkowe tokeny powłoki.
IBM Aspera High-Speed Transfer Endpoint w wersjach od 3.7.4 do 4.4.7 Fix Pack 1 oraz IBM Aspera High-Speed Transfer Server w tych samych wersjach są podatne na przepełnienie bufora w komponencie asperahttpd. Ta podatność może być wykorzystana do wywołania odmowy usługi oraz potencjalnie prowadzić do obejścia uwierzytelniania lub zdalnego wykonania kodu.
IBM Aspera HSTS for CP4I versions 1.5.1 through 1.5.19 is affected by an authentication bypass vulnerability. A transfer client may exploit this vulnerability to access files in the server's local storage that they should not have access to when specific restriction settings are not in place.
IBM Langflow OSS w wersjach od 1.0.0 do 1.9.1 może umożliwiać zdalne wykonanie kodu z powodu niewłaściwej walidacji linków symbolicznych podczas ekstrakcji archiwów.
A vulnerability has been identified in the Linux kernel within the rxe_rcv function, which improperly validates the packet length before calculating the payload size. An attacker could exploit this to trigger an underflow error, potentially leading to security issues.
In the Linux kernel, a potential integer overflow in the rxgk_extract_token() function when checking the length of the ticket has been fixed. Instead of rounding up the value to be tested, the size of the available data is rounded down.
A vulnerability related to the re-decryption of RESPONSE packets has been fixed in the Linux kernel. If a RESPONSE packet encounters a temporary failure during processing, it may end up in a partially decrypted state and be requeued for retry.
A vulnerability was found in the Linux kernel's smb2_open_file() function in the SMB client. Failure to zero out @err_iov and @err_buftype pointers before retrying SMB2_open() can lead to a use-after-free (UAF) or double free when @data is not NULL.
In the Linux kernel RDMA/iwcm subsystem, a vulnerability causes workqueue list corruption. The issue stems from the incorrect assumption that queue_work() would not enqueue work if already pending, while each iwcm_work object has a unique work_struct. This allows multiple entries to be processed in a single handler run, freed to the free list, and reused, leading to list corruption.
In Slican telephone exchanges, it is possible to manage the control panel remotely. An unauthenticated attacker can connect to the modem via a telephone with a specific caller ID, allowing them to bypass admin authentication and gain full access to the service protocol and configuration panel.