CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
TOTOLINK T10_v2 5.9c.5061_B20200511 has a stack-based buffer overflow in setWiFiWpsConfig in /lib/cste_modules/wps.so. Attackers can send crafted data in an MQTT packet, via the pin parameter, to control the return address and execute code.
In go-libp2p, prior to versions 0.27.8, 0.28.2, and 0.29.1, a malicious peer can use large RSA keys to perform a resource exhaustion attack, forcing a node to spend time verifying signatures of the large key.
The social-media-skeleton project, implemented using PHP, MySQL, CSS, JavaScript, and HTML, has a stored XSS vulnerability in versions 1.0.0 to 1.0.3. The issue is patched in version 1.0.3.
A vulnerability in .NET and Visual Studio allows for a Denial of Service (DoS) attack, potentially leading to application or service unavailability. An attacker can exploit this flaw to disrupt system operations.
A vulnerability in ASP.NET allows for elevation of privilege, potentially leading to unauthorized access to system resources.
.NET Framework vulnerability allows spoofing, potentially leading to unauthorized access to systems or data.
A vulnerability in ASP.NET Core SignalR and Visual Studio allows for information disclosure. An attacker could exploit this flaw to gain access to sensitive data.
Users of jackson-dataformats-text for parsing TOML data may be vulnerable to Denial of Service (DOS) attacks. If the parser is running on user-supplied input, an attacker may provide content that causes the parser to crash due to stack overflow.
Dangerzone is software for converting potentially dangerous files into safe PDFs. In versions prior to 0.4.2, if the container is compromised, an attacker may spoof messages in the user's terminal or change the window title.
In Zoom clients before version 5.14.10, there is a client-side enforcement issue of server-side security that may allow a privileged user to enable information disclosure via network access.
Improper input validation in Zoom SDK’s before 5.14.10 may allow an unauthenticated user to enable a denial of service via network access.
Improper input validation in Zoom Desktop Client for Windows before version 5.14.7 may allow an unauthenticated user to enable an escalation of privilege via network access.
A vulnerability in Microsoft Message Queuing (MSMQ) allows attackers to remotely trigger a fault, leading to denial of service. Exploiting this flaw may cause the MSMQ service to stop responding to requests.
A vulnerability in Azure Apache Hadoop allows attackers to spoof other services, potentially leading to unauthorized access to data.
A vulnerability in Windows Mobile Device Management allows for privilege escalation. An attacker can exploit this flaw to gain higher privileges on the device.
A vulnerability in Microsoft Exchange Server allows for remote code execution by an attacker. Exploiting this flaw could lead to system takeover.
A vulnerability in the LDAP protocol in Windows allows for remote code execution. An attacker can exploit this flaw to gain control over the system.
A vulnerability in Microsoft Exchange Server allows for remote code execution. An attacker can exploit this flaw to gain control over the system.
A vulnerability in Microsoft Exchange Server allows attackers to spoof other email addresses. Exploiting this flaw could lead to email communication fraud.
A vulnerability in .NET Core and Visual Studio allows for a Denial of Service (DoS) attack, potentially leading to application unavailability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS