CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in Keystone, an open source headless CMS for Node.js, allows public access to the `adminMeta` GraphQL query when `ui.isAccessAllowed` is set to `undefined`. This differs from the default behavior of the AdminUI middleware, which requires a session if a session strategy is defined.
Versions of llama_index up to 0.7.13 contain a vulnerability that allows a remote attacker to execute arbitrary code via the `exec` parameter in the PandasQueryEngine function.
An issue in pandas-ai versions 0.9.1 and earlier allows a remote attacker to execute arbitrary code via the _is_jailbreak function.
Versions of langchain langchain-ai up to 0.0.232 contain a vulnerability that allows a remote attacker to execute arbitrary code via a crafted script in the PythonAstREPLTool._run component.
A missing authorization check allows an arbitrary authenticated user to perform certain operations through the API of CLA-assistant. This enables access to CLA information, including details of signatories and custom fields configured by the requester.
SQL Injection vulnerability in eVotingSystem-PHP v.1.0 allows a remote attacker to execute arbitrary code and obtain sensitive information via the user input fields.
File Upload vulnerability in Wolf-leo EasyAdmin8 v.1.0 allows a remote attacker to execute arbitrary code via the upload type function.
An issue in Python cpython v.3.7 allows an attacker to obtain sensitive information via the _asyncio._swap_current_task component. However, the vendor disputes this vulnerability, stating it only affects some 3.12 pre-releases.
Versions of Harrison Chase langchain up to 0.0.194 contain a vulnerability that allows a remote attacker to execute arbitrary code via the from_math_prompt and from_colored_object_prompt functions.
An issue in Alluxio v.2.9.3 and before allows an attacker to execute arbitrary code via a crafted script to the username parameter of lluxio.util.CommonUtils.getUnixGroups(java.lang.String).
Version 0.0.231 of LangChain contains a vulnerability that allows a remote attacker to execute arbitrary code via the prompt parameter.
Buffer Overflow vulnerability in faad2 v.2.10.1 allows a remote attacker to execute arbitrary code and cause a denial of service via the mp4info function in mp4read.c:1039.
Buffer Overflow vulnerability in faad2 v.2.10.1 allows a remote attacker to execute arbitrary code and cause a denial of service via the stcoin function in mp4read.c.
CVE-2023-38856 is a buffer overflow vulnerability in libxls version 1.6.2 that allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the get_string function in xlstool.c:411.
Buffer Overflow vulnerability in libxls version 1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the get_string function in xlstool.c:395.
Buffer Overflow vulnerability in libxls version 1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the transcode_latin1_to_utf8 function in xlstool.c:296.
Buffer Overflow vulnerability in libxlsv version 1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the xls_parseWorkBook function in xls.c:1015.
Buffer Overflow vulnerability in libxls version 1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the unicode_decode_wcstombs function in xlstool.c:266.
Buffer Overflow vulnerability in libxls version 1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the xls_parseWorkBook function in xls.c:1018.
Buffer Overflow vulnerability in Michaelrsweet codedoc v.3.7 allows an attacker to cause a denial of service via the codedoc.c:1742 component.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS