CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.01)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Infoblox NIOS through 8.5.1 has a faulty component that accepts malicious input without sanitization, resulting in shell access.
An issue in skalenetwork sgxwallet v.1.9.0 and below allows an attacker to cause a denial of service via the trustedGenerateEcdsaKey component.
CVE-2023-36198 describes a buffer overflow vulnerability in version 1.9.0 of the sgxwallet by skalenetwork, allowing an attacker to cause a denial of service via the trustedBlsSignMessage function.
A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. An attacker may impersonate an agent and hide the true status of a monitored machine if the fake agent is added to the verifier list by a legitimate user.
In Tenda AC23 v16.03.07.45_cn, the formSetIPv6status and formGetWanParameter functions do not authenticate user input parameters, resulting in a post-authentication stack overflow vulnerability.
In Tenda AC23 v16.03.07.45_cn, the sub_4781A4 function does not validate the parameters entered by the user, resulting in a post-authentication stack overflow vulnerability.
Version 22.6.529.216 of the Phicomm K2 device contains a command injection vulnerability via the luci.sys.call function.
A vulnerability was found in the NeoMind Fusion Platform up to version 20230731, allowing cross site scripting (XSS) attacks through manipulation of the link argument in the /fusion/portal/action/Link file. The attack can be executed remotely.
Tenda AX3 v16.03.12.11 has a stack buffer overflow vulnerability detected at function form_fast_setting_wifi_set. This vulnerability allows attackers to cause a Denial of Service (DoS) via the ssid parameter.
The get_parentControl_list_Info function does not verify the parameters entered by the user, leading to a post-authentication heap overflow vulnerability in Tenda AC23 v16.03.07.45_cn.
The sub_451784 function does not validate the parameters entered by the user, resulting in a stack overflow vulnerability in Tenda AC23 v16.03.07.45_cn.
The compare_parentcontrol_time function does not authenticate user input parameters, resulting in a post-authentication stack overflow vulnerability in Tenda AC23 v16.03.07.45_cn.
Tenda AC23 version Vv16.03.07.45_cn is vulnerable to buffer overflow in the sub_450A4C function.
CVE-2023-41167 vulnerability in @webiny/react-rich-text-renderer before version 5.37.2 allows XSS attacks by content managers. The issue arises from using the dangerouslySetInnerHTML prop without HTML sanitization, allowing for the injection of malicious scripts.
Version 5.2.1 of giflib contains a segmentation fault in the getarg.c component, which may lead to unexpected application behavior.
In JetBrains TeamCity versions before 2023.05.3, reflected XSS was possible during user registration.
In JetBrains TeamCity versions before 2023.05.3, reflected XSS was possible during copying Build Step.
In JetBrains TeamCity versions before 2023.05.3, stored XSS was possible during Cloud Profiles configuration.
Mattermost fails to restrict which parameters' values it takes from the request during signup, allowing an attacker to register users as inactive. This blocks them from later accessing Mattermost without the system admin activating their accounts.
Out-of-bounds read issue in M-Files Server versions below 23.8.12892.6 and LTS Service Release Versions before 23.2 LTS SR3 allows unauthenticated user to read restricted amount of bytes from memory.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS