CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.01)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in the Health & Safety (HS) application of NASA's Core Flight System (cFS) allows the application to crash via segmentation fault when processing a routine Housekeeping Telemetry request, leading to denial of service.
Frogman prior to version 1.6.2 stored API tokens as raw hex strings and authenticated the X-Frogman-Token header by comparing it with the stored raw value. This allowed reading active tokens, including admin tokens, from the database and reusing them.
In BigBlueButton prior to version 3.0.21, a vulnerability was found where checksum validation could be bypassed when a presentationUploadExternalUrl parameter was supplied to API request handling. This allows a user to send valid requests to some endpoints without a checksum.
BigBlueButton prior to version 3.0.21 generated conference session tokens with insufficiently secure randomness, allowing a session user to predict other users' tokens and impersonate them.
In Emlog version 2.6.13 and earlier, the article publishing interface stores a path-traversal template parameter from api_controller.php without validation, and log_controller.php later checks file_exists and calls include View::getView($template), allowing an authenticated author to include an arbitrary local .php file when an article is viewed.
In Emlog version 2.6.13 and earlier, the 'keyword' parameter in the admin user search module is processed with addslashes but not HTML-escaped before being rendered into the value attribute in admin/views/user.php, allowing reflected XSS in an administrator's backend session.
In Manyfold versions 0.96.0 through 0.140.0, authenticated users can rename uploaded files using path traversal sequences. The file app/models/model_file.rb uses user-controlled filenames in File.join(model.path, filename) without proper sanitization, allowing files to be moved or written outside the configured library directory.
An issue was discovered in DD-WRT before version 45724 in router/upnp/src/ssdp.c. An unsafe strcpy in UPnP handling allows an unauthenticated remote attacker to overflow an internal fixed buffer via an M-SEARCH request. Exploitation requires UPnP to be enabled (disabled by default, listening only on internal interfaces).
A potential insecure permissions vulnerability was found in Legion Zone and Lenovo App Store Windows applications, distributed exclusively in the Chinese market. If installed on a non-system partition, a local user could execute arbitrary code.
An SSRF vulnerability in stoatchat before 0.14.0 allows unauthenticated attackers to bypass DNS-based IP blocklists. The url_is_blacklisted function only inspects the first resolved address, while the HTTP client iterates all cached addresses.
In text-generation-inference up to version 3.3.7, a server-side request forgery (SSRF) vulnerability exists in the OpenAI-compatible multimodal chat completions endpoint. An unauthenticated network attacker can force the server to issue arbitrary HTTP GET requests by supplying a crafted image_url value in chat message content.
A vulnerability in Axelor Open Platform versions 8.x prior to 8.2.2 allows authenticated non-admin users to escalate privileges by bypassing field restrictions during nested relational save operations. Attackers can modify sensitive User record fields such as roles and groups by submitting changes through a related entity's save path, leading to admin role assignment.
A vulnerability in zrok (versions 0.4.23 through 2.0.3) allows an attacker to write files outside the selected local destination root via attacker-controlled WebDAV or zrok drive paths like /../outside.txt. The issue is fixed in version 2.0.3.
In HAPI FHIR before version 6.9.7, the FHIRPathEngine passes user-controlled regular expressions from matches(), matchesFull(), and replaceMatches() to Java regex operations without effective timeouts, allowing catastrophic backtracking and denial of service (DoS).
The @tmlmobilidade/utils library in the Gestor de Oferta application has a prototype pollution vulnerability in the setValueAtPath() function. The issue is due to unsafe path segments not being blocked, which can lead to object prototype modification.
The Lenovo XClarity Integrator for Windows Admin Center plugin version 5.1.1 and below is vulnerable to PowerShell command injection when establishing remote PowerShell sessions. This flaw allows an attacker to execute arbitrary PowerShell commands on the WAC Gateway.
A vulnerability in the XML::Bare library for Perl (versions up to 0.53) causes an infinite loop when parsing malformed XML attributes. The parserc_parse function fails to advance the attribute-parse state cursor for certain malformed forms, leading to a hang.
A vulnerability in the HTML::Bare library for Perl (versions up to 0.04) causes an infinite loop when parsing malformed HTML attributes. The parserc_parse function fails to advance the attribute-parse state cursor on certain malformed forms, leading to a hang.
A vulnerability in Lenovo App Store, distributed exclusively in the Chinese market, could allow a local authenticated user to execute arbitrary code with elevated privileges.
A potential path traversal vulnerability was reported in Lenovo App Store, distributed exclusively in the Chinese market. This flaw could allow a local authenticated user to execute arbitrary code.