CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.01)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
blackbox_exporter v0.23.0 was discovered to contain an access control issue in its probe interface. This vulnerability allows attackers to detect intranet ports and services, as well as download resources. NOTE: this is disputed by third parties because authentication can be configured.
The Service Location Protocol (SLP) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor.
Ataki na walidację sesji w Apache Superset w wersjach do 2.0.1 mogą wystąpić, gdy instalacje nie zmieniły domyślnego klucza SECRET_KEY zgodnie z instrukcjami instalacji. Taki stan pozwala atakującemu na uwierzytelnienie się i dostęp do nieautoryzowanych zasobów.
The vulnerability in the Starlette Python framework before version 0.25.0 allows an unauthenticated remote attacker to specify an arbitrary number of form fields or files, causing excessive memory usage and denial of service (DoS) of the HTTP service.
Ta podatność pozwala zdalnym atakującym na ominięcie uwierzytelnienia w dotkniętych instalacjach PaperCut NG w wersji 22.0.5 (Build 63914). Problem wynika z niewłaściwej implementacji algorytmu uwierzytelniania w klasie SecurityRequestFilter.
W M-Files Server przed wersją 23.4.12528.1 wystąpiła podatność, która pozwalała na zdalne wywoływanie operacji przez użytkownika, co mogło prowadzić do odmowy usługi z powodu niekontrolowanego zużycia pamięci.
Netflix Lemur before version 1.3.2 used insufficiently random values when generating default credentials. This vulnerability may allow an attacker to guess the credentials and gain access to resources managed by Lemur.
The Linux kernel's udmabuf device driver contains a vulnerability due to lack of proper validation of user-supplied data in a fault handler, which can result in memory access past the end of an array. This may allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel.
W systemie zarządzania wykroczeniami drogowymi Campcodes Online Traffic Offense Management System w wersji 1.0 odkryto krytyczną podatność. Problem dotyczy nieznanej funkcjonalności pliku /classes/Login.php, gdzie manipulacja argumentem hasła prowadzi do wstrzyknięcia SQL.
Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
W Ego Studio SuperClean w wersjach 1.1.9 i 1.1.5 znaleziono problem, który pozwala atakującemu uzyskać uprawnienia poprzez pole update_info w pliku _default_.xml.
A vulnerability in ncurses before version 6.4 20230408 allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file located in $HOME/.terminfo or accessed via the TERMINFO or TERM environment variable, when used by a setuid application.
An issue found in D-Link DSL-3782 v.1.03 allows remote authenticated users to execute arbitrary code as root via the network settings page.
Wtyczka WP Data Access dla WordPressa jest podatna na eskalację uprawnień w wersjach do 5.3.7 włącznie. Brak odpowiednich kontroli autoryzacji w funkcji multiple_roles_update umożliwia uwierzytelnionym atakującym, posiadającym minimalne uprawnienia, takie jak subskrybent, modyfikację swojej roli użytkownika.
A use-after-free vulnerability in the Linux kernel traffic control index filter (tcindex) allows local privilege escalation. The tcindex_delete function does not properly deactivate filters in case of perfect hashes, leading to double freeing. A local attacker can escalate privileges to root.
A vulnerability in the Windows Common Log File System (CLFS) driver allows elevation of privilege. The flaw enables a local attacker to gain higher privileges on the system.
A vulnerability in the Windows CNG Key Isolation Service allows elevation of privilege. The flaw enables a local attacker to gain higher privileges on the system.
A use-after-free flaw was found in btsdio_remove in drivers/bluetooth/btsdio.c in the Linux Kernel. A call to btsdio_remove with an unfinished job may cause a race problem leading to a UAF on hdev devices.
An out-of-bounds write issue in Apple kernels was addressed with improved input validation. The issue is fixed in macOS Monterey 12.6.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1, iOS 15.7.5 and iPadOS 15.7.5, macOS Big Sur 11.7.6. An app may be able to execute arbitrary code with kernel privileges, and Apple is aware of a report that this issue may have been actively exploited.
A use after free issue in Safari and Apple systems was addressed with improved memory management. The issue is fixed in Safari 16.4.1, iOS 15.7.5 and iPadOS 15.7.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1. Processing maliciously crafted web content may lead to arbitrary code execution, and Apple is aware of a report that this issue may have been actively exploited.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS