CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Catapult DCT2000 file parser in versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 can crash, leading to denial of service.
The Bluetooth Attribute Protocol dissector in versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 can crash, leading to denial of service.
The CMS protocol dissector in versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 can crash, leading to denial of service.
A crash in the RRC protocol dissector in versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service.
A crash in the C12.22 protocol dissector in versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service.
A vulnerability in chenhg5 cc-connect up to 1.4.1 in the shellExecCommand function of core/engine.go in the Management API allows remote OS command injection via the exec argument. The exploit is publicly available.
A vulnerability in chenhg5 cc-connect up to 1.4.1 in the Authenticate function of core/webhook.go allows remote code injection via the exec argument. The exploit is publicly available.
This CVE has been rejected or withdrawn by its CVE Numbering Authority.
This CVE has been rejected or withdrawn by its CVE Numbering Authority.
This CVE has been rejected or withdrawn by its CVE Numbering Authority.
This CVE has been rejected or withdrawn by its CVE Numbering Authority.
This CVE has been rejected or withdrawn by its CVE Numbering Authority.
In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the all_projects parameter is set to false. A non-admin user with the reader role can list alarms from all projects, exposing sensitive data. Additionally, OpenStack Watcher does not enforce authorization on its webhook trigger endpoint, allowing authenticated users to start EVENT audits.
LMDeploy deserializes disaggregated-serving peer messages with pickle. The handle_zmq_recv coroutine in lmdeploy/pytorch/disagg/conn/engine_conn.py reads peer-to-peer cache-free requests with recv_pyobj(), which deserializes the received bytes with pickle.loads(), and the isinstance check against DistServeCacheFreeRequest runs only after deserialization has already completed. The peer that supplies those bytes is caller-controlled: p2p_connect passes remote_engine_endpoint_info.zmq_address from the request body to connect() on the ZMQ PULL socket, and the POST /distserve/p2p_initialize and /distserve/p2p_connect endpoints in lmdeploy/serve/openai/api_server.py apply no authentication unless the server is started with api_keys, which defaults to None. A remote attacker can direct an engine to pull from a ZMQ endpoint under their control and execute arbitrary code in the engine process. Deployments that do not enable disaggregated serving are not affected, because the receive loop is only started once the migration backend accepts the connection.
PythonTools in Agno (libs/agno/agno/tools/python.py) contains a path traversal vulnerability that allows attackers to read, write, or execute arbitrary files by supplying parent-directory traversal sequences in the file_name argument to read_file, save_to_file, or run_python_file actions. The attack can be performed via direct tool invocation or via prompt injection in agent-processed content.
In TRENDnet TEW-755AP up to 20260702, the log_email_server function in /cgi-bin/email.cgi of the ssi component is vulnerable to command injection. The attack can be performed remotely, and the exploit is publicly available.
A vulnerability was identified in TRENDnet TEW-755AP up to 20260702. Affected by this issue is some unknown functionality of the file /cgi-bin/wan.cgi of the component ssi. Such manipulation of the argument cameo.wan.wan_pppoe_password_00 leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used.
A vulnerability was found in TRENDnet TEW-755AP up to 20260702. Affected is the function FUN_401000 of the file /sbin/mycli. The manipulation of the argument ssid results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used.
In Splunk On-Call (VictorOps) app versions below 1.0.43 on Splunkbase, a user without the "admin" or "power" Splunk roles could read a partially masked API key from the App Key Value Store (KV Store). This is possible because the app does not fully mask the API key before storing it in a KV Store collection that the user can read.
In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored data without checking whether the content is of the expected type.