CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in NVIDIA Triton Inference Server for Linux allows an attacker to cause uncontrolled resource consumption. Successful exploitation could lead to denial of service (DoS).
A vulnerability in the NVIDIA Triton Inference Server for Linux allows an attacker to use an expired file descriptor. Successful exploitation could lead to denial of service (DoS).
NVIDIA Triton Inference Server for Linux contains a stack-based buffer overflow vulnerability. Successful exploitation could lead to denial of service.
NVIDIA Triton Inference Server for Linux contains a vulnerability that allows an attacker to cause uncontrolled resource consumption. Successful exploitation of this flaw may lead to denial of service (DoS).
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. In 3.4.4, DOMPurify allowed selectedcontent by default, allowing browsers to re-clone an XSS payload after sanitization so that unsanitized markup inside <selectedcontent> is returned. This issue is fixed in version 3.4.5.
A vulnerability in Symfony allows XML External Entity (XXE) injection when processing XML via the Crawler::addXmlContent() method. Setting DOMDocument::$validateOnParse = true before loadXML() re-enables external entity resolution, allowing an attacker to read local files using file:// entities.
A vulnerability in Symfony SendmailTransport in -t mode appends recipient addresses to the sendmail command line without a -- end-of-options separator, allowing an address starting with - to be interpreted as a sendmail option. Fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 §5.5, which mandates that all WebSocket control frames (e.g., PING, PONG, CLOSE) contain a payload of 125 bytes or less. A remote, unauthenticated attacker can exploit this by sending a non-compliant, oversized control frame, causing an internal processing crash and resulting in a remote denial of service (DoS) for applications utilizing libsoup WebSockets.
A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The decompression loop processes data in chunks without enforcing an upper boundary limit on the output buffer size, allowing unbounded memory allocation. A remote, unauthenticated attacker can send a small, highly compressed payload (decompression bomb), causing an Out-of-Memory (OOM) crash and Denial of Service (DoS).
A post-authentication improper control of generation of code (Code Injection) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC). Under specific conditions, it could allow a remote authenticated attacker with administrator privileges to execute arbitrary OS commands.
A protection mechanism failure in Visual Studio allows an unauthorized attacker to execute code locally. The vulnerability can be exploited through local access to the system.
A vulnerability in .NET due to improper verification of cryptographic signature allows an unauthorized attacker to bypass a security feature over a network.
ASP.NET Core has an authentication bypass vulnerability due to assumed-immutable data. This allows an authorized attacker to elevate privileges over a network.
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to remotely cause a denial of service (DoS).
An improper access control vulnerability in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network. The flaw can be exploited remotely by an authenticated user.
Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
A vulnerability in the Yaml component of the Symfony framework allows a ReDoS (Regular Expression Denial of Service) attack via crafted YAML input. The `cleanup()` method in the `Parser` class uses regular expressions with overlapping quantifiers, which can cause parsing to hang for an arbitrarily long time.
A vulnerability in the Symfony Yaml component allows a YAML bomb attack via recursive expansion of collection aliases. A small untrusted YAML input can be expanded into a multi-gigabyte structure, exhausting memory.
A vulnerability in Symfony allows a DoS attack via deeply nested YAML structures. The lack of recursion depth limit in the parser causes PHP stack exhaustion and worker crash.
In Symfony prior to 7.4.12 and 8.0.12, method-scoped #[IsGranted], #[IsSignatureValid], and #[IsCsrfTokenValid] attributes configured for GET only are skipped for HEAD requests, allowing protected controllers to execute and potentially leak headers or perform side effects.