CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability was found in the Linux kernel's MPTCP (MultiPath TCP) subsystem related to the in-kernel path manager. The function setting the 'fullmesh' flag on endpoints was too permissive, allowing this flag to be set on implicit endpoints, which triggered a kernel warning and could lead to system instability.
A vulnerability was found in the Linux kernel's MPTCP implementation, related to improper handling of disconnect during TCP Fast Open. The bug can cause data stream corruption and trigger a warning in the __mptcp_clean_una function.
A use-after-free vulnerability was found in the Linux kernel's PPS (Pulse Per Second) subsystem. The bug occurs during device removal when pps_device_destruct() frees memory before file operations on open descriptors complete, leading to system crashes.
A soft lockup vulnerability was found in the Linux kernel during OOM (Out-Of-Memory) handling in cgroup. The issue occurs when a very large number of processes (e.g., 56,000) are in the OOM cgroup, causing traversal to take too long and blocking the system.
In the Linux kernel's rdma/cxgb4 driver, an integer overflow vulnerability was found on 32-bit systems. The user-controlled 'gl->tot_len' variable can cause wrapping in addition, leading to a potential security flaw.
Urządzenia TP-Link TL-WR845N z oprogramowaniem układowym TL-WR845N(UN)_V4_200909 i TL-WR845N(UN)_V4_190219 zawierają twardo zakodowane hasło dla konta root, które można uzyskać poprzez analizę pobranego oprogramowania lub atak brute force przy fizycznym dostępie do routera. Problem został rozwiązany w wersjach oprogramowania 250401 lub nowszych.
Podatność w diagnostyce monitorowania zdrowia przełączników Cisco Nexus 3000 i 9000 w trybie NX-OS może pozwolić nieautoryzowanemu, sąsiedniemu atakującemu na nieoczekiwane przeładowanie urządzenia, co prowadzi do stanu odmowy usługi (DoS). Problem wynika z nieprawidłowego przetwarzania określonych ramek Ethernet.
W rozszerzeniu quarkus-resteasy znaleziono błąd, który powoduje wycieki pamięci przy żądaniach klientów z niskimi limitami czasowymi. W przypadku przekroczenia limitu czasu żądania, bufor nie jest poprawnie zwalniany, co prowadzi do zwiększonego zużycia pamięci i ostatecznego awarii aplikacji z powodu błędu OutOfMemoryError.
A Server-Side Request Forgery (SSRF) vulnerability exists in the sort.php component of Emlog Pro v2.5.4. It allows an attacker to scan local and internal ports by supplying a crafted URL.
A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to inject malicious scripts or HTML via the title field in the article category section.
A cross-site scripting (XSS) vulnerability was found in Emlog Pro version 2.5.4. It allows an attacker to inject malicious JavaScript or HTML code into the article header via the admin panel at /admin/article.php.
A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to inject malicious JavaScript or HTML via the postStrVar function in article_save.php.
A remote code execution (RCE) vulnerability was discovered in SeaCMS v13.3 in the admin_files.php component. Attackers can exploit this flaw to execute arbitrary code on the server.
A remote code execution (RCE) vulnerability was discovered in SeaCMS v13.3 within the admin_ip.php component. Attackers can exploit this flaw to execute arbitrary code on the server.
SeaCMS 13.3 was discovered to contain an arbitrary file read vulnerability in the file_get_contents function at admin_safe_file.php.
SeaCMS 13.3 was discovered to contain an arbitrary file read vulnerability in the file_get_contents function at admin_safe.php.
A remote code execution (RCE) vulnerability was discovered in SeaCMS v13.3 within the admin_smtp.php component. Attackers can exploit this flaw to execute arbitrary code on the server.
A remote code execution (RCE) vulnerability was discovered in SeaCMS v13.3 within the admin_template.php component. Attackers can exploit this flaw to execute arbitrary code on the server.
A remote code execution (RCE) vulnerability was discovered in SeaCMS v13.3 within the admin_ping.php component. Attackers can exploit this flaw to execute arbitrary code on the server.
A remote code execution (RCE) vulnerability was discovered in SeaCMS v13.3 in the admin_notify.php component. An attacker can exploit this flaw to execute arbitrary code on the server.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS