CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A CSRF vulnerability in Subrion CMS v4.2.1 allows an unauthenticated attacker to send a crafted request to an administrator, resulting in the creation of an arbitrary administrator account.
A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending transactions of a high gas price from one account that all fully spend the full balance of the account to a victim Geth node, which can purge all of pending transactions in a victim node's memory pool and then occupy the memory pool to prevent new transactions from entering the pool, resulting in a denial of service (DoS).
A design flaw in Go-Ethereum 1.10.12 and older versions allows an attacker node to send 5120 future transactions with a high gas price in one message, which can purge all pending transactions in a victim node's memory pool, causing a denial of service (DoS).
Wykryto podatność w funkcji cgroup_release_agent_write jądra Linux w pliku kernel/cgroup/cgroup-v1.c. W określonych okolicznościach, flaw ta pozwala na wykorzystanie funkcji release_agent cgroups v1 do eskalacji uprawnień oraz nieoczekiwanego obejścia izolacji przestrzeni nazw.
The Arm Mali GPU Kernel Driver allows a non-privileged user to achieve write access to read-only memory pages. This affects Midgard r26p0 through r31p0, Bifrost r0p0 through r35p0, and Valhall r19p0 through r35p0.
Remote Code Execution (RCE) vulnerability in Zepl Notebooks before October 25, 2021. An authenticated user can create a notebook with malicious code and execute it remotely.
The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 before fix pack 5 incorrectly imports users from LDAP. This allows a remote attacker to prevent a legitimate user from authenticating by attempting to sign in as a user that exists in LDAP.
Extensis Portfolio v4.0 was discovered to contain hardcoded credentials which allows attackers to gain administrator privileges.
An unrestricted file upload vulnerability in the Backup/Restore Archive component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via a crafted ZIP file.
Extensis Portfolio v4.0 was discovered to contain an authenticated unrestricted file upload vulnerability via the AdminFileTransferServlet component. This allows an attacker with a valid account to upload arbitrary files to the server.
An unrestricted file upload vulnerability in the FileTransferServlet component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via a crafted file.
Extensis Portfolio v4.0 was discovered to contain an authenticated unrestricted file upload vulnerability via the Catalog Asset Upload function. This allows an attacker with a valid account to upload arbitrary files to the server.
W wersjach Trusted Firmware M od 1.4.x do 1.4.1 występuje problem z przepełnieniem bufora w partycji aktualizacji oprogramowania. W modelu IPC, wywołanie psa_fwu_write z SPE lub NSPE może nadpisywać lokalizacje pamięci stosu.
Pluxml version 5.8.7 was found to allow attackers to execute arbitrary code by injecting crafted PHP code into static pages.
A Remote Code Execution (RCE) vulnerability exists in Algorithmia MSOL (SaaS) before October 10, 2021. After registration and authentication, a user can create a specially crafted algorithm to execute arbitrary code.
An integer overflow vulnerability was discovered in the TP-LINK TL-WR840N(ES) router firmware version V6.20_180709, specifically in the dm_checkString function. This flaw allows an attacker to cause a Denial of Service (DoS) via a crafted HTTP request.
WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access. This vulnerability impacts Fireware OS before 12.7.2_U1, 12.x before 12.1.3_U3, and 12.2.x through 12.5.x before 12.5.7_U3.
Netmaker, a platform for creating and managing virtual overlay networks using WireGuard, contained a hard-coded cryptographic key in versions prior to 0.8.5, 0.9.4, and 0.10.0. This can be exploited to run admin commands on a remote server if the attacker knows the address and username of the admin.
An out-of-bounds (OOB) memory write flaw was found in the NFSD in the Linux kernel. Missing sanity may lead to a write beyond bmval[bmlen-1] in nfsd4_decode_bitmap4 in fs/nfsd/nfs4xdr.c.
A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypass the source port UDP randomization.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS