CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.01)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A memory leak flaw was found in nft_set_catchall_flush in the Linux Kernel, which may allow a local attacker to cause double-deactivations of catchall elements, resulting in a memory leak.
An issue in Pagekit version 1.0.18 allows a remote attacker to execute arbitrary code via the downloadAction and updateAction functions in UpdateController.php.
Buffer Overflow vulnerability in O-RAN Software Community ric-plt-lib-rmr v.4.9.0 allows a remote attacker to cause a denial of service via the packet size component.
Buffer Overflow vulnerability in O-RAN Software Community ric-plt-lib-rmr v.4.9.0 allows a remote attacker to cause a denial of service via a crafted packet.
Buffer Overflow vulnerability in VirusTotal yara v.4.3.2 allows a remote attacker to execute arbitrary code via the yr_execute_cod function in the exe.c component.
Versions of pf4j up to 3.9.0 contain a vulnerability that allows a remote attacker to obtain sensitive information and execute arbitrary code via the expandIfZip method in the extract function.
Versions of pf4j up to 3.9.0 contain a vulnerability that allows a remote attacker to obtain sensitive information and execute arbitrary code via the loadpluginPath parameter.
Versions of pf4j up to 3.9.0 have a vulnerability that allows a remote attacker to obtain sensitive information and execute arbitrary code via the zippluginPath parameter.
Version 3.1.2 of Perfree PerfreeBlog contains a vulnerability that allows a remote attacker to execute arbitrary code via a crafted plugin listed in admin/plugin/access/list.
Buffer Overflow vulnerability in Libming v.0.4.8 allows a remote attacker to cause a denial of service via a crafted .swf file to the makeswf function.
An issue in ansible semaphore v.2.8.90 allows a remote attacker to execute arbitrary code via a crafted payload to the extra variables parameter.
An issue was discovered in TechView LA-5570 Wireless Gateway version 1.0.19_T53, allowing physical attackers to gain escalated privileges via a telnet connection.
An issue was discovered in TECHView LA5570 Wireless Gateway version 1.0.19_T53, allowing physical attackers to gain escalated privileges via the UART interface.
In jupyter-server, improper cross-site credential checks on `/files/` URLs could allow exposure of certain file contents or accessing files when opening untrusted files. This issue has been addressed in version `2.7.2`.
The vulnerability in jupyter-server allows for an Open Redirect attack, enabling redirection of users to arbitrary sites after logging into a Jupyter server. Maliciously crafted login links can lead to unauthorized redirects.
Version up to 4.0.0 of the volty tvcmsvideotab theme was found to contain a SQL injection vulnerability via the component TvcmsVideoTabConfirmDeleteModuleFrontController::run().
Cross Site Scripting vulnerability in Badaso v.2.9.7 allows a remote attacker to execute arbitrary code via a crafted payload to the title parameter in the new book and edit book function.
SmartNode SN200 version 3.21.2-23021 allows unauthenticated OS Command Injection.
A stored cross-site scripting (XSS) vulnerability in the Create function of Zenario CMS v9.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Menu navigation text field.
Spinnaker, an open source multi-cloud continuous delivery platform, has a logging issue where GitHub status is always logged in full. This may lead to the exposure of GitHub tokens in the logging system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS