CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Crash in sharkd in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service.
The UMTS FP protocol dissector in versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 can crash, leading to denial of service.
RDP protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service.
Crash in the Wireshark dissection engine in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service.
A crash in the C12.22 protocol dissector in versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service.
Tektronix K12xx file parser crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service.
ERF file parser crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service.
The Catapult DCT2000 file parser in versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 can crash, leading to denial of service.
The Bluetooth Attribute Protocol dissector in versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 can crash, leading to denial of service.
The CMS protocol dissector in versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 can crash, leading to denial of service.
A crash in the RRC protocol dissector in versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service.
A crash in the C12.22 protocol dissector in versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service.
A vulnerability in chenhg5 cc-connect up to 1.4.1 in the shellExecCommand function of core/engine.go in the Management API allows remote OS command injection via the exec argument. The exploit is publicly available.
A vulnerability in chenhg5 cc-connect up to 1.4.1 in the Authenticate function of core/webhook.go allows remote code injection via the exec argument. The exploit is publicly available.
This CVE has been rejected or withdrawn by its CVE Numbering Authority.
This CVE has been rejected or withdrawn by its CVE Numbering Authority.
This CVE has been rejected or withdrawn by its CVE Numbering Authority.
This CVE has been rejected or withdrawn by its CVE Numbering Authority.
This CVE has been rejected or withdrawn by its CVE Numbering Authority.
In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the all_projects parameter is set to false. A non-admin user with the reader role can list alarms from all projects, exposing sensitive data. Additionally, OpenStack Watcher does not enforce authorization on its webhook trigger endpoint, allowing authenticated users to start EVENT audits.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS