CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Due to improper restrictions on XML entities, multiple vulnerabilities exist in the command line interface of ArubaOS. A successful exploit could allow an authenticated attacker to retrieve files from the local system or cause the application to consume system resources, resulting in a denial of service condition.
A vulnerability was found in the Linux Kernel in the function nilfs_new_inode of file fs/nilfs2/inode.c (BPF component). The manipulation leads to use after free. The attack can be launched remotely.
A vulnerability was found in the Linux Kernel in the function nilfs_attach_log_writer of file fs/nilfs2/segment.c (BPF component). The manipulation leads to a memory leak. The attack may be initiated remotely.
A vulnerability classified as problematic has been found in the Linux Kernel in the function j1939_session_destroy of file net/can/j1939/transport.c. The manipulation leads to a memory leak.
A vulnerability was found in the Linux Kernel in the function vsock_connect of file net/vmw_vsock/af_vsock.c. The manipulation leads to a memory leak. The complexity of an attack is rather high. The exploitation appears to be difficult.
A vulnerability was found in the Linux Kernel in the function find_prog_by_sec_insn of file tools/lib/bpf/libbpf.c (BPF component). The manipulation leads to a null pointer dereference.
A vulnerability classified as problematic has been found in the Linux Kernel, affecting the kcm_tx_work function in the file net/kcm/kcmsock.c within the kcm component. The manipulation leads to a race condition. Applying a patch is recommended to fix this issue.
When curl is used to retrieve and parse cookies from a HTTP(S) server, it accepts cookies using control codes that when later are sent back to a HTTP server might make the server return 400 responses. Effectively allowing a "sister site" to deny service to all siblings.
A flaw was found in unzip due to improper handling of Unicode strings, leading to a null pointer dereference. An attacker can supply a specially crafted zip file, causing a crash or code execution.
In JetBrains IntelliJ IDEA before 2022.2 local code execution via a Vagrant executable was possible. This vulnerability allowed execution of malicious code in the user's context.
Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: General/Core Client) affects versions 8.0.28 and prior. It allows an unauthenticated attacker with access to the infrastructure where MySQL Shell runs to compromise it, requiring interaction from a person other than the attacker.
W PackageKit znaleziono lukę, która dotyczy sposobu, w jaki niektóre metody interfejsu Transaction badają pliki. Problem ten pozwala lokalnemu użytkownikowi na zmierzenie czasu wykonania tych metod i ustalenie, czy plik należący do roota lub innych użytkowników istnieje.
The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are used. This occurs because of use of Algorithm 4 ("Double-Hash Port Selection Algorithm") of RFC 6056.
W jądrze Linuksa znaleziono błąd w implementacji reguł audytu, który powoduje, że niektóre wywołania systemowe mogą nie być poprawnie rejestrowane przez subsystem audytu.
W OpenSSH przed wersją 8.9 odkryto problem związany z uwierzytelnianiem kluczem publicznym przy użyciu przekazywania agenta. Jeśli atakujący zmodyfikował serwer, aby wspierał opcję uwierzytelniania None, użytkownik nie może określić, czy uwierzytelnienie FIDO potwierdza chęć połączenia z serwerem, czy też pozwala temu serwerowi na połączenie z innym serwerem w imieniu użytkownika.
Podatność CVE-2020-8562 dotyczy mechanizmu w Kubernetes, który ma na celu zapobieganie dostępowi do sieci lokalnych i localhost przez połączenia proxy. W wyniku błędu w walidacji odpowiedzi DNS, użytkownik może ominąć te ograniczenia i uzyskać dostęp do prywatnych sieci w kontrolerze.
After the initial setup process, some steps of setup.php are reachable not only by super-administrators but also by unauthenticated users. A malicious actor can pass step checks and potentially change the configuration of the Zabbix Frontend.
A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attacker to download arbitrary files on the device via specially crafted update packages.
Spoofing vulnerability in Microsoft Edge for iOS. An attacker can spoof trusted content, potentially leading to display of false information to the user.
Spoofing vulnerability in Microsoft Edge (Chromium-based). An attacker can spoof trusted content, potentially leading to display of false information to the user.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS