CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.01)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution.
On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error may trigger a kernel panic and cause system reload.
AOMedia versions 3.0.0 to 3.5.0 contain a bug that allows invalid memory read access via the component assign_frame_buffer_p in av1/common/av1_common_int.h.
Version 2.11.0 of the Xmlsoft Libxml2 library was found to contain an out-of-bounds read vulnerability in the xmlSAX2StartElement() function. This allows attackers to cause a Denial of Service (DoS) by supplying a crafted XML file.
Nokia Service Router Operating System (SR OS) version 22.10 and SR Linux, when error-handling update-fault-tolerance is not enabled, mishandle BGP path attributes.
MyBB before 1.8.36 allows Code Injection by users with certain high privileges. Templates in Admin CP intentionally use eval, and there was some validation of the input to eval, but type juggling interfered with this when using PCRE within PHP.
FRRouting FRR versions 7.5.1 through 9.0 and Pica8 PICOS version 4.3.3.2 are vulnerable to a denial of service attack. A remote attacker can exploit a crafted BGP update with a corrupted attribute 23 (Tunnel Encapsulation).
In OpenBGPD before 8.1, incorrect handling of BGP update data may cause the system to incorrectly reset a session by a potentially distant remote actor.
In SpringBlade V3.6.0 when executing SQL query, the parameters submitted by the user are not wrapped in quotation marks, which leads to SQL injection.
Dell PowerScale OneFS w wersjach 8.2.2.x-9.5.0.x zawiera lukę w zarządzaniu uprawnieniami. Zdalny atakujący z niskimi uprawnieniami może wykorzystać tę lukę do eskalacji uprawnień.
In Cerebrate 1.14, a vulnerability in UserSettingsController allows authenticated users to change user settings of other users.
An issue was discovered in FRRouting FRR 9.0, where bgpd/bgp_open.c does not check for an overly large length of the rcv software version.
An issue was discovered in FRRouting FRR through 9.0 that allows reading the initial byte of the ORF header in an ahead-of-stream situation.
An issue was discovered in FRRouting FRR through 9.0 related to an out-of-bounds read in bgp_attr_aigp_valid in bgpd/bgp_attr.c. There is no check for the availability of two bytes during AIGP validation.
An issue was discovered in FRRouting FRR through 9.0, where bgpd/bgp_packet.c processes NLRIs if the attribute length is zero.
The Volty CMS Blog theme up to version v4.0.1 was found to contain a SQL injection vulnerability via the id parameter at /tvcmsblog/single.
A memory leak flaw was found in nft_set_catchall_flush in the Linux Kernel, which may allow a local attacker to cause double-deactivations of catchall elements, resulting in a memory leak.
An issue in Pagekit version 1.0.18 allows a remote attacker to execute arbitrary code via the downloadAction and updateAction functions in UpdateController.php.
Buffer Overflow vulnerability in O-RAN Software Community ric-plt-lib-rmr v.4.9.0 allows a remote attacker to cause a denial of service via the packet size component.
Buffer Overflow vulnerability in O-RAN Software Community ric-plt-lib-rmr v.4.9.0 allows a remote attacker to cause a denial of service via a crafted packet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS