CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The vulnerability in the vCardParser class of Kenwood DNR1007XR leads to a heap-based buffer overflow. An attacker with physical access, without authentication, can exploit the lack of input validation to execute arbitrary code as root.
Vulnerability in Kenwood DNR1007XR in the udhcpd service is due to incorrect permissions set on a resource. A local attacker can exploit this flaw to escalate privileges and execute code in the context of root.
The vulnerability in the tchdr_bytestream_read function of Kenwood DNR1007XR causes an out-of-bounds write. An attacker with physical access, without authentication, can exploit the lack of data validation to execute arbitrary code as root.
Vulnerability in Kenwood DNR1007XR in the JKGenService is due to lack of proper validation of a user-supplied string before using it to execute a system call. A local attacker can exploit this flaw to escalate privileges and execute arbitrary code in the context of root.
The vulnerability in the firmware update process of Kenwood DNR1007XR allows the use of symbolic links to move files to arbitrary locations. An attacker with physical access, without authentication, can execute arbitrary code as root.
OSNEXUS QuantaStor has a remote code execution vulnerability due to missing authentication in the configuration of Kapacitor. Authentication is not required to exploit this vulnerability.
Vulnerability in NoMachine in the getstat service is due to lack of proper validation of a user-supplied string before using it to execute a system call. A remote authenticated attacker can exploit this flaw to execute arbitrary code in the context of the service account.
Vulnerability in Parallels RAS Client in the RDP Backend Service is due to an exposed dangerous function. A local attacker can exploit this flaw to escalate privileges and execute arbitrary code in the context of SYSTEM.
Vulnerability in Parallels RAS Client in the RDP Backend Service is due to an exposed dangerous function. A local attacker can exploit this flaw to escalate privileges and execute arbitrary code in the context of SYSTEM.
Vulnerability in Adminer in the multi_query method is due to an incorrect check of a function return value. A remote authenticated attacker can exploit this flaw to execute arbitrary code in the context of the web server.
Vulnerability in Hugging Face PyTorch Image Models during checkpoint parsing is due to lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. A remote attacker can exploit this flaw to execute code in the context of the current process, requiring user interaction.
Vulnerability in Parallels RAS Client in the RDP Backend Service is due to an exposed dangerous function. A local attacker can exploit this flaw to escalate privileges and execute arbitrary code in the context of SYSTEM.
Vulnerability in Comfast CF-N1-S version 2.6.0.1 in the sprintf function of the file /cgi-bin/mbox-config?method=SET§ion=ptest_sn is due to command injection via the sn argument. A remote attacker can exploit this flaw to execute arbitrary system commands.
The vulnerability in SourceCodester CET Automated Grading System with AI Predictive Analytics version 1.0 concerns improper authorization in the add_grade function in /index.php. Manipulation of the student_id argument allows unauthorized access, and the attack can be initiated remotely.
Vulnerability in SourceCodester Simple Online Food Ordering System version 1.0 in the file /admin/ajax.php?action=delete_category is due to SQL injection via the ID argument. A remote attacker can exploit this flaw to manipulate the database.
The vulnerability in SourceCodester Simple Online Food Ordering System version 1.0 concerns SQL injection in an unknown function of the file /admin/ajax.php?action=save_category. Manipulation of the ID argument allows remote attack, and the exploit is publicly available.
The jsoup library through version 1.23.2 contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder. A remote attacker can supply a deeply nested XML document with uniquely-namespaced elements, causing quadratic time and memory complexity, leading to JVM heap exhaustion and application termination.
A Server-Side Request Forgery (SSRF) vulnerability in Apache InLong (from 2.0.0 before 2.4.0) allows any authenticated user (no admin role required) to cause the InLong Manager server to make outbound HTTP requests or TCP connections to arbitrary internal hosts and ports.
A Relative Path Traversal vulnerability in Apache InLong (from 2.0.0 before 2.4.0) allows arbitrary file read from the Agent host filesystem.
A vulnerability in Apache InLong (from 2.0.0 before 2.4.0) allows any user who can authenticate to the manager to create, modify, and delete Data Node definitions.