CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.01)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Thunderbird allowed the use of the Text Direction Override Unicode Character in filenames. As a result, an email attachment could be incorrectly displayed as a document file, while in fact it was an executable file.
Improper neutralization of commands in the OTRS system allows an authenticated attacker with admin privileges to execute code locally. This issue affects OTRS: from 7.0.X before 7.0.45, from 8.0.X before 8.0.35; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.
A critical vulnerability was found in Pointware EasyInventory 1.0.12.0, affecting some unknown processing of the file C:\Program Files (x86)\EasyInventory\Easy2W.exe. The manipulation leads to unquoted search path.
A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation.
A vulnerability in the Linux kernel's net/sched: sch_qfq component allows for out-of-bounds writes, potentially leading to local privilege escalation.
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.
A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability.
OpenDDS, an open-source C++ implementation of the Data Distribution Service (DDS), crashes while parsing a malformed PID_PROPERTY_LIST in a DATA submessage during participant discovery. Attackers can remotely crash OpenDDS processes by sending a DATA submessage containing the malformed parameter to the known multicast port.
An out-of-bounds write vulnerability on Windows operating systems causes the Ivanti AntiVirus Product to crash. Update to Ivanti AV Product version 7.9.1.285 or above.
An access control issue in WebBoss.io CMS v3.7.0.1 allows attackers to access the Website Backup Tool via a crafted GET request.
Server Side Request Forgery (SSRF) vulnerability in Deskpro Support Desk v2021.21.6 allows attackers to execute arbitrary code via a crafted URL. The flaw stems from insufficient filtering of outgoing server requests.
There is an SQL Injection vulnerability in the GitHub repository pimcore/pimcore prior to version 10.6.4.
An issue has been discovered in GitLab EE affecting all versions starting from 12.8 before 15.11.11, all versions starting from 16.0 before 16.0.7, all versions starting from 16.1 before 16.1.2. An attacker could change the name or path of a public top-level group in certain situations.
A format string vulnerability has been identified in ASUS RT-AX56U V2 and RT-AC86U. This issue is caused by directly using input as a format string when calling syslog in the logmessage_normal function of the do_detwan_cgi module.
Galaxy Software Services Vitals ESP is vulnerable to using a hard-coded encryption key. An unauthenticated remote attacker can generate a valid token parameter and exploit this vulnerability to access system to operate processes and access data.
W wersjach 10.9 i niższych Esri ArcGIS Enterprise Sites występuje podatność typu Cross-Site Scripting (XSS), która może pozwolić zdalnemu, uwierzytelnionemu atakującemu na stworzenie spreparowanego linku. Kliknięcie w ten link przez ofiarę może skutkować wykonaniem dowolnego kodu JavaScript w przeglądarce ofiary.
The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file downloads in versions up to and including 4.6.6. This allows unauthenticated attackers to download the contents of arbitrary files on the server, which may contain sensitive information.
A critical vulnerability has been found in the Xiamen Four Letter Video Surveillance Management System up to version 20230712. The issue affects improper processing in the UserInfoAction.class library of the Login component, leading to unauthorized access.
W wersjach 11.1 i niższych Esri Portal for ArcGIS Sites występuje podatność na przechowywane Cross-Site Scripting (XSS), która może pozwolić zdalnemu, uwierzytelnionemu atakującemu z wysokimi uprawnieniami na stworzenie spreparowanego linku, który jest przechowywany w konfiguracji witryny. Po otwarciu przez ofiarę, przechowywany ładunek może wykonać dowolny kod JavaScript w przeglądarce ofiary.
A Cross-Site Request Forgery (CSRF) in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS