CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Flarum, an open source forum software, is vulnerable to a Blind Server-Side Request Forgery (SSRF) attack and file disclosure on the server, even with a basic user account. By exploiting the vulnerability, an attacker can manipulate the application to execute unintended actions.
A critical vulnerability was found in MicroWorld eScan Anti-Virus 7.0.32 on Linux, affecting an unknown part of the file runasroot. Manipulation leads to incorrect execution-assigned permissions.
A flaw was found in btrfs_get_root_ref in the btrfs filesystem in the Linux Kernel due to a double decrement of the reference count. This issue may allow a local attacker with user privilege to crash the system or may lead to leaked internal kernel information.
A use-after-free flaw was found in the vmxnet3 Ethernet NIC driver in the Linux Kernel, which could allow a local attacker to crash the system due to a double-free during vmxnet3_rq_cleanup_all, potentially leading to a kernel information leak.
Dell Storage Integration Tools for VMware and Dell Storage vSphere Client Plugin versions prior to 6.1.1 and Replay Manager for VMware versions prior to 3.1.2 contain an information disclosure vulnerability. A local low-privileged malicious user could potentially exploit this vulnerability to retrieve an encryption key that could aid in further attacks.
The Jenkins Blue Ocean Plugin version 1.27.5 and earlier contains a cross-site request forgery (CSRF) vulnerability that allows attackers to connect to an attacker-specified URL, capturing GitHub credentials associated with an attacker-specified job.
Jenkins NodeJS Plugin version 1.6.0 and earlier does not properly mask credentials specified in the Npm config file in Pipeline build logs, which may lead to the exposure of sensitive data.
Jenkins Config File Provider Plugin version 952.va_544a_6234b_46 and earlier does not mask credentials specified in configuration files when they're written to the build log.
The Jenkins Folders Plugin version 6.846.v23698686f0f6 and earlier contains a cross-site request forgery (CSRF) vulnerability that allows attackers to copy folders.
In MIT Kerberos 5 (krb5) version 1.21 before 1.21.2, there is a double free vulnerability that can be triggered by an authenticated user if an authorization-data handling failure occurs. Incorrect data is copied from one ticket to another.
Dell PowerScale OneFS w wersjach 8.2.x-9.5.x zawiera podatność na ujawnienie wrażliwych informacji osobom nieuprawnionym. Autoryzowany lokalny atakujący może potencjalnie wykorzystać tę podatność, co może prowadzić do eskalacji uprawnień.
Dell PowerScale OneFS w wersji 9.5.0.x zawiera lukę umożliwiającą obejście mechanizmu ochrony. Zdalny atakujący bez uprawnień może wykorzystać tę lukę, co może prowadzić do odmowy usługi, ujawnienia informacji oraz zdalnego wykonania kodu.
Dell PowerScale OneFS w wersjach 8.2.x - 9.5.0.x zawiera podatność na podniesienie uprawnień. Atakujący z niskimi uprawnieniami lokalnymi może wykorzystać tę podatność, co może prowadzić do odmowy usługi, wykonania kodu oraz ujawnienia informacji.
Wtyczka YARPP dla WordPressa w wersjach przed 5.30.3 nie waliduje i nie ucieka niektórych atrybutów shortcode przed ich użyciem w zapytaniach SQL, co może umożliwić uwierzytelnionym użytkownikom, takim jak subskrybenci, przeprowadzenie ataków SQL Injection.
The lol-html library can cause panics when processing certain HTML inputs. Anyone processing arbitrary third-party HTML with the library is affected.
The WP Remote Users Sync plugin for WordPress is vulnerable to Server Side Request Forgery via the 'notify_ping_remote' AJAX function in versions up to and including 1.2.12. This allows authenticated attackers with subscriber-level permissions or above to make web requests to arbitrary locations, potentially querying and modifying information from internal services.
The Broadcom RAID Controller web interface is vulnerable due to exposure of sensitive password information in the URL as a URL search parameter.
The Broadcom RAID Controller web interface is vulnerable to exposure of private keys used for CIM stored with insecure file permissions.
The Broadcom RAID Controller Web server (nginx) is serving private server-side files without any authentication on Linux.
The Broadcom RAID Controller Web server (nginx) is serving private files without any authentication.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS