CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability was discovered in the odoh-rs rust crate that stems from faulty logic during the parsing of encrypted queries. This issue occurs when processing encrypted query data received from remote clients, allowing an attacker to send specially crafted queries to targeted ODOH servers.
The Wrangler command line tool (<[email protected] or <[email protected]) was affected by a directory traversal vulnerability when running a local development server for Pages. This vulnerability enabled an attacker in the same network as the victim to connect to the local development server and access the victim's files present outside of the directory for the development server.
A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests. There is no check for the value of `src_len` and `dst_len`, potentially leading to a heap buffer overflow when the two values differ.
WebBoss.io CMS version 3.7.0.1 contains a stored cross-site scripting (XSS) vulnerability.
WebBoss.io CMS version 3.7.0.1 contains a stored Cross-Site Scripting (XSS) vulnerability due to lack of input validation and output encoding.
CVE-2023-36299 in Typecho version 1.2.1 allows a remote attacker to execute arbitrary code via the upload and options-general parameters in index.php.
DedeCMS version 5.7.109 has a File Upload vulnerability, leading to remote code execution (RCE).
A missing Brute-Force protection in CODESYS Development System prior to version 3.5.19.20 allows a local attacker to have unlimited attempts of guessing the password within an import dialog.
After successful authentication as a user in multiple Codesys products in multiple versions, specifically crafted network communication requests with inconsistent content can cause the CmpAppForce component to read internally from an invalid address, potentially leading to a denial-of-service condition.
After successful authentication as a user in multiple Codesys products in multiple versions, specifically crafted network communication requests with inconsistent content can cause the CmpAppForce component to read internally from an invalid address, potentially leading to a denial-of-service condition.
After successful authentication as a user in multiple Codesys products in multiple versions, specifically crafted remote communication requests can cause the CmpAppBP component to overwrite a heap-based buffer, which can lead to a denial-of-service condition.
In multiple versions of Codesys products, after successful user authentication, specifically crafted network communication requests with inconsistent content can cause the CmpAppBP component to read from an invalid address, potentially leading to a denial-of-service condition.
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition.
In multiple versions of Codesys products, after successful user authentication, specifically crafted network communication requests with inconsistent content can cause the CmpAppBP component to read from an invalid address, potentially leading to a denial-of-service condition.
In multiple versions of Codesys products, after successful user authentication, specifically crafted network communication requests with inconsistent content can cause the CmpAppBP component to read from an invalid address, potentially leading to a denial-of-service condition.
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition.
In multiple Codesys products in multiple versions, after successful authentication as a user, specially crafted network communication requests can utilize the CmpApp component to download files with any file extensions to the controller. Unlike regular file downloads via CmpFileTransfer, no filtering of certain file types is performed here.
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition.
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition.
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS