CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A cookie management issue was addressed with improved state management. Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.
Problem został rozwiązany poprzez poprawione kontrole. Wystąpienie tej podatności w Safari oraz systemach iOS i macOS mogło prowadzić do wykonania dowolnego kodu przez złośliwie przygotowane treści internetowe.
A buffer overflow vulnerability was discovered in the 'fromSetSysTime' function of Tenda AC6 v2.0 router with firmware v15.03.06.50. An attacker could exploit this flaw to execute arbitrary code or cause a denial of service.
Podatność na przesyłanie plików w Xi'an Daxi Information technology OfficeWeb365 w wersjach 8.6.1.0 i 7.18.23.0 umożliwia zdalnemu atakującemu wykonanie dowolnego kodu za pomocą komponentu pw/savedraw.
A KMSAN warning about uninitialized value in decode_getfattr_attrs() in the Linux kernel's NFS subsystem was found. The fattr->mdsthreshold field is not initialized, which can lead to incorrect behavior.
In the Linux kernel, the dvbdev media driver has a risk of out-of-bounds memory access. Lack of explicit boundary checks in dvb_register_device() and dvb_device_open() can lead to memory issues, especially when dynamic minors are not used.
In the Linux kernel's s5p-jpeg driver (for hardware JPEG encoder), missing checks could lead to buffer overflows when the 'word' value was less than 2. The fix adds extra checks to prevent this.
A vulnerability has been identified in the Linux kernel's iwlwifi module, concerning response handling in the iwl_mvm_send_recovery_cmd() function. The issue involves a lack of response packet size validation and the failure to free the response buffer.
In the Linux kernel, the stmmac network driver has a vulnerability related to unbalanced DMA mapping/unmapping for non-paged SKB data in TSO context. Incorrect assignment of the DMA buffer address to the wrong tx_skbuff_dma array entry causes premature unmapping before the DMA engine finishes using it. This can lead to corrupted data transmission or IOMMU faults.
A vulnerability has been identified in the Linux kernel within the qdisc_tree_reduce_backlog function, which may lead to a use-after-free (UAF) due to incorrect assumptions about qdiscs with major handle ffff:. This issue has been resolved in an update.
In the Linux kernel, in the DRM driver for MediaTek, a potential NULL pointer dereference in mtk_crtc_destroy() was fixed. If mbox_request_channel() fails, the cmdq_client.chan pointer is set to NULL, and cmdq_pkt_create() is not called. During cleanup, the pointer must be checked for NULL before calling cmdq_pkt_destroy() to avoid a NULL pointer dereference.
Versa Director by default uses a common password across all PostgreSQL instances and configures the database to listen on all network interfaces. This allows an unauthenticated attacker to access and administer the database or read local filesystem contents, potentially leading to privilege escalation.
Podatność typu Cross-Site Request Forgery (CSRF) w wtyczce wp-buy WP Popup Window Maker easy-popup-lightbox-maker umożliwia wykonanie ataku typu Stored XSS. Problem dotyczy wersji WP Popup Window Maker od n/a do 2.0 włącznie.
Podatność typu Cross-Site Request Forgery (CSRF) w wtyczce Exclusive Content Password Protect umożliwia przesłanie powłoki sieciowej na serwer WWW. Problem dotyczy wersji wtyczki od n/a do 1.1.0 włącznie.
Podatność typu Cross-Site Request Forgery (CSRF) w HuangYe WuDeng Hacklog DownloadManager umożliwia przesłanie powłoki sieciowej na serwer WWW. Problem dotyczy wersji Hacklog DownloadManager od n/a do 2.1.4 włącznie.
W podatności CVE-2024-52388 występuje problem Cross-Site Request Forgery (CSRF) w bibliotece hebrewdates, który umożliwia przeprowadzenie ataku Stored XSS. Dotyczy to wersji hebrewdates od n/a do 2.1.0.
Wtyczka Woopy Plugins SmartLink Dynamic URLs w wersjach od n/a do 1.1.0 zawiera podatność typu Cross-Site Request Forgery (CSRF), która umożliwia przeprowadzenie ataku typu Stored XSS. Problem ten dotyczy funkcjonalności smartlink-dinamic-urls.
Podatność typu Cross-Site Request Forgery (CSRF) w wtyczce litefeel Flash Show And Hide Box umożliwia przeprowadzenie ataku typu Stored XSS. Problem ten dotyczy wersji wtyczki od n/a do 1.6 włącznie.
Podatność typu Cross-Site Request Forgery (CSRF) w microkid Custom Author URL author-slug umożliwia przeprowadzenie ataku Stored XSS. Problem ten dotyczy wersji Custom Author URL od n/a do 2.0.1 włącznie.
W podatności CVE-2024-51654 występuje problem Cross-Site Request Forgery (CSRF) w aplikacji Eric Allen APK Downloader, który umożliwia przeprowadzenie ataku Stored XSS. Dotyczy to wersji APK Downloader od n/a do 1.0.0 włącznie.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS