CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Autel MaxiCharger AC Elite Home EV chargers have an integer underflow vulnerability in WebSocket OCPP message handling, allowing an unauthenticated remote attacker to execute arbitrary code on the device.
GitLab CE/EE versions 10.1.0 through 19.0.5, 19.1 through 19.1.3, and 19.2 through 19.2.1 have insufficient access controls on internal request handling, potentially allowing an authenticated Developer user to access unauthorized information.
The NTIOLib_X64.sys driver in MSI Center fails to properly validate command origins, allowing a local attacker to escalate privileges to SYSTEM and execute arbitrary code.
The redfish-* plugins in Linuxfabrik monitoring-plugins up to version 6.0.0 build request URLs by concatenating a base URL with @odata.id links from responses, allowing a malicious or compromised BMC to redirect authenticated Redfish requests and disclose X-Auth-Token or HTTP Basic credentials.
MCP Ruby SDK before version 0.23.0 in StreamableHTTPTransport reads the entire JSON-RPC POST body without size limits, allowing an unauthenticated remote attacker to exhaust process memory.
MCP Ruby SDK before version 0.23.0 does not bind a session ID to its owner, allowing an attacker with a stolen session ID to send tools/call requests in the victim's session.
DriveLock has a directory traversal vulnerability in its web service on port 6067, allowing an unauthenticated remote attacker to disclose sensitive information due to lack of path validation.
DriveLock has an SQL injection vulnerability in its web service on port 4568, allowing an authenticated remote attacker to escalate privileges due to lack of input validation in SQL queries.
DriveLock has a directory traversal vulnerability in its web service on port 4568, allowing an unauthenticated remote attacker to disclose sensitive information due to lack of path validation.
Vulnerability in ATEN Unizon RpcProvider allows a remote attacker to cause a denial-of-service (DoS) without authentication. Lack of authentication before accessing RpcProvider functionality enables system overload.
Vulnerability in GStreamer qtdemux allows a remote attacker to execute arbitrary code via a stack-based buffer overflow when parsing UncompressedFrameConfigBox structures. User interaction with the library is required.
Vulnerability in pgvector before version 0.8.6 allows a database user to write data out-of-bounds when building an IVFFlat index, potentially leading to arbitrary code execution. Only 32-bit systems are affected.
Vulnerability in GitLab CE/EE (versions 11.8 through 19.0.4, 19.1.0-19.1.2, 19.2.0-19.2.0) allows an unauthenticated user to cause a denial-of-service (DoS) due to insufficient resource throttling when processing merge request discussions.
Vulnerability in G DATA Total Security Backup Service allows a local attacker to escalate privileges via a symbolic link following attack. The attacker can delete a file and gain SYSTEM privileges.
Vulnerability in GitLab CE/EE (versions 18.0 through 19.0.4, 19.1.0-19.1.2, 19.2.0-19.2.0) allows an authenticated user to modify another user's CI/CD configuration due to improper validation of attributes when processing pipeline schedules.
Vulnerability in Heimdall Data Database Proxy in the generateFileContent function allows an authenticated remote attacker to execute arbitrary code via CRLF injection. The attacker can gain root privileges.
Vulnerability in Flyto2 Core before version 2.26.7 allows an attacker to perform SSRF requests to internal or metadata endpoints via HTTP modules that fetch attacker-controlled URLs without validation.
Vulnerability in Flyto2 Core before version 2.26.6 allows environment variable expansion ${env.VAR} without an allowlist, bypassing the default denylist policy and exfiltrating secrets through allowed modules.
Vulnerability in Flyto2 Core before version 2.26.6 allows the llm.chat module to read provider keys (e.g., OPENAI_API_KEY) from the environment and send them in the Authorization header to an attacker-controlled server, leading to key leakage.
In Flyto2 Core prior to version 2.26.7, HTTP modules validate only the initial URL and then follow redirects without per-hop Location revalidation. This allows a public URL to redirect into internal address space and return the internal response body.