CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A deserialization vulnerability in Afterlogic Aurora Files v9.7.3 allows attackers to execute arbitrary code by supplying a crafted .sabredav file.
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
The AjaxNewsTicker plugin version 1.0.5 contains a vulnerability that allows a remote attacker to execute arbitrary code via a crafted payload in the 'reque' parameter. The issue stems from insufficient input validation.
W podatności CVE-2023-43314 występuje przepełnienie bufora w oprogramowaniu układowym Zyxel PMG2005-T20B w wersji V1.00(ABNK.2)b11_C0. Może to pozwolić nieautoryzowanemu atakującemu na spowodowanie stanu odmowy usługi poprzez odpowiednio skonstruowany identyfikator uid.
A CSRF vulnerability in phpkobo AjaxNewTicker version 1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload in the txt parameter of the index.php component.
CVE-2023-4934 describes an Authorization Bypass Through User-Controlled Key vulnerability in Usta AYBS, allowing for Authentication Abuse and Authentication Bypass.
Dreamer CMS version 4.1.3 contains an arbitrary file read vulnerability in the /admin/TemplateController.java component. An attacker can exploit this flaw to read sensitive files from the server.
A CSRF vulnerability in admin_manager.php of Seacms up to v12.8 allows attackers to arbitrarily add an admin account without authorization.
An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the `h->nets` array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.
The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7, iOS 16.7 and iPadOS 16.7, macOS Ventura 13.6. A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.
W module MyPrestaModules dla Prestashop w wersji 6.2.9 oraz module UpdateProducts w wersji 3.6.9 odkryto podatność na ujawnienie informacji PHPInfo poprzez plik send.php.
Podatność CVE-2023-5042 dotyczy ujawnienia wrażliwych informacji z powodu niebezpiecznych uprawnień do folderów. Dotyczy to produktów Acronis Cyber Protect Home Office (Windows) przed wersją 40713 oraz Acronis True Image OEM (Windows) przed wersją 42575.
A flaw in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. An attacker could bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.
File upload vulnerability in Dolibarr ERP CRM version 17.0.1 and earlier allows a remote attacker to execute arbitrary code and obtain sensitive information by bypassing extension filtering and renaming functions.
A vulnerability in Dolibarr ERP CRM version 17.0.1 and earlier allows a remote privileged attacker to execute arbitrary code via a crafted command or script.
A SQL injection vulnerability in Nagios XI 5.11.1 and below allows authenticated attackers with privileges to manage host escalations in the Core Configuration Manager to execute arbitrary SQL commands via the host escalation notification settings.
A SQL injection vulnerability in Nagios XI v5.11.1 and below allows authenticated attackers with announcement banner configuration privileges to execute arbitrary SQL commands via the ID parameter sent to the update_banner_message() function.
A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security and Worry-Free Business Security Services could allow an attacker to manipulate the module to execute arbitrary commands on an affected installation. Note that an attacker must first obtain administrative console access on the target system in order to exploit this vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS