CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Use-after-free in Vim prior to version 9.0.0579.
Stack-based buffer overflow in Vim prior to version 9.0.0577.
There exists an unchecked length field in U-Boot that can lead to memory corruption. The DFU implementation in U-Boot does not bound the length field in USB DFU download setup packets, allowing an attacker to send a packet with a length greater than 4096 bytes.
A stack buffer overflow vulnerability in the UEFI DXE driver on some Acer products could lead to arbitrary code execution. An attacker could exploit this to escalate privileges from ring 3 to ring 0 and hijack control flow during UEFI DXE execution.
ICEcoder v8.1 is vulnerable to a directory traversal attack. This allows an attacker to access files outside the intended directory.
Use-after-free in Vim prior to version 9.0.0530.
A Path Traversal vulnerability in the Hypermedia REST APIs module in Liferay Portal 7.4.0 through 7.4.2 allows remote attackers to access files outside of com.liferay.headless.discovery.web/META-INF/resources via the `parameter` parameter.
The Identity and Directory Management System developed by Çekino Bilgi Teknolojileri before version 2.1.25 has an unauthenticated Path traversal vulnerability. This has been fixed in version 2.1.25.
By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak, potentially exhausting memory and causing named to crash.
By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak, potentially exhausting memory and causing named to crash.
The issue was addressed with improved bounds checks. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS 15.7, iOS 16, macOS Big Sur 11.7. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited.
Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could allow an Apex One server administrator to instruct affected clients to download an unverified rollback package, which could lead to remote code execution. An attacker must first obtain Apex One server administration console access to exploit this vulnerability.
SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j_id88, UserForm:j_id90, and UserForm:j_id92 parameters at /SVFE2/pages/feegroups/country_group.jsf. An attacker can exploit this flaw to manipulate database queries.
ProcessMaker before version 3.5.4 was found to have insecure permissions in the user profile page. This vulnerability allows attackers to escalate normal users to administrators.
Directory Traversal vulnerability in Zentao Demo15 allows remote attackers to read sensitive information by manipulating the URL. Attackers can access system configuration files.
SmartVista SVFE2 version 2.2.22 contains a SQL injection vulnerability via the voiceAudit:j_id97 parameter at /SVFE2/pages/audit/voiceaudit.jsf. An attacker can exploit this flaw to manipulate database queries.
W repozytorium GitHub budibase/budibase przed wersją 1.3.20 występuje niewłaściwe zarządzanie zasobami kodu dynamicznie zarządzanego. Może to prowadzić do nieautoryzowanego dostępu lub wykonania niebezpiecznego kodu.
Multiple remote code execution (RCE) vulnerabilities were discovered in Syncovery 9 for Linux version 9.47x and below via the Job_ExecuteBefore and Job_ExecuteAfter parameters in post_profilesettings.php.
Bolt CMS version 5.1.12 and below contains a vulnerability that allows an authenticated user with ROLE_EDITOR privileges to upload and rename a malicious file, leading to remote code execution.
.NET Core and Visual Studio contain a vulnerability that can lead to a Denial of Service (DoS) attack. Exploiting this flaw may cause applications to stop responding to requests.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS