CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.08)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
W wersjach Dolby UDC od 4.5 do 4.13 odkryto problem, który może prowadzić do awarii procesu dekodera DD+ podczas przetwarzania źle sformatowanego strumienia bitowego DD+. Błąd w obliczeniach długości zapisu może spowodować przepełnienie, co skutkuje zbyt małym przydzielonym buforem i nieskuteczną kontrolą dostępu do pamięci.
W TruffleHog w wersji 3.90.2 występuje podatność na wykonanie dowolnego kodu związana z funkcjonalnością git. Specjalnie przygotowane repozytorium może prowadzić do wykonania złośliwego kodu.
W aplikacji Bhabishya-123 E-commerce w wersji 1.0 występuje podatność na atak typu SQL Injection w punkcie końcowym signup.inc.php. Aplikacja bezpośrednio włącza niesanitizowane dane wejściowe użytkowników do zapytań SQL, co pozwala nieautoryzowanym atakującym na ominięcie uwierzytelnienia i uzyskanie pełnego dostępu.
In warmcat libwebsockets, there is an out-of-bounds write vulnerability in unfilter_scanline when the LWS_WITH_UPNG flag is enabled during compilation and the HTML display stack is used. This can lead to writing past a heap allocated buffer, possibly causing a crash when the user visits an attacker-controlled website with a crafted PNG file.
Out-of-bounds Read in lws_upng_emit_next_line in warmcat libwebsockets allows, when the LWS_WITH_UPNG flag is enabled during compilation and the HTML display stack is used, to read past a heap allocated buffer possibly causing a crash, when the user visits an attacker controlled website that contains a crafted PNG file with a big height dimension.
Stack-based Buffer Overflow in lws_adns_parse_label in warmcat libwebsockets allows, when the LWS_WITH_SYS_ASYNC_DNS flag is enabled during compilation, to overflow the label_stack, when the attacker is able to sniff a DNS request in order to craft a response with a matching id containing a label longer than the maximum.
Use After Free in WebSocket server implementation in lws_handshake_server in warmcat libwebsockets may allow an attacker, in specific configurations where the user provides a callback function that handles LWS_CALLBACK_HTTP_CONFIRM_UPGRADE, to achieve denial of service.
A lack of rate limiting in the One-Time Password (OTP) verification endpoint of SigningHub v8.6.8 allows attackers to bypass verification via a bruteforce attack.
Lack of rate limiting in the /Home/UploadStreamDocument component of SigningHub v8.6.8 allows attackers to cause a Denial of Service (DoS) by uploading an excessive number of files.
Incorrect access control in SigningHub v8.6.8 allows attackers to arbitrarily add user accounts without rate limiting, leading to resource exhaustion and Denial of Service (DoS).
Cross-site Scripting (XSS) stored vulnerability in Tawk Live Chat. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by uploading a malicious PDF with JavaScript payload through the chatbot. The PDF is stored by the application and subsequently displayed without proper sanitisation when other users access it.
Tileservice module is affected by information leak vulnerability, successful exploitation may affect service confidentiality.
A SQL Injection vulnerability has been found in Epsilon RH by Grupo Castilla, allowing an attacker to retrieve, create, update, and delete database data via a POST request using the parameter 'sEstadoUsr' in '/epsilonnetws/WSAvisos.asmx'.
Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, allowing an attacker to execute arbitrary code by sending specially crafted packets.
Photo module is affected by information leak vulnerability, successful exploitation of this vulnerability may affect service confidentiality.
Some Honor products are affected by information leak vulnerability, successful exploitation of this vulnerability may affect service confidentiality.
An unrestricted upload of file with dangerous type vulnerability in the upload file function of Galaxy Software Services Corporation Vitals ESP Forum Module through 1.3 version allows remote authenticated users to execute arbitrary system commands via a malicious file.
ETERNUS SF dostarczany przez Fsas Technologies Inc. zawiera lukę związaną z nieprawidłowymi domyślnymi uprawnieniami. Użytkownik o niskich uprawnieniach mający dostęp do serwera zarządzania może uzyskać dane uwierzytelniające do bazy danych, co potencjalnie umożliwia wykonanie poleceń systemowych z uprawnieniami administratora.
System zarządzania dokumentami opracowany przez Excellent Infotek posiada podatność na nieautoryzowane przesyłanie plików, co pozwala nieautoryzowanym zdalnym atakującym na przesyłanie i uruchamianie złośliwych skryptów typu web shell, umożliwiając tym samym wykonanie dowolnego kodu na serwerze.
A security flaw was discovered in LogicalDOC Community Edition up to 9.2.1 affecting /frontend.jsp in the Add Contact Page component. Manipulation of First Name/Last Name/Company/Address/Phone/Mobile arguments results in cross site scripting, and the exploit has been publicly released.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS