CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The mabl plugin in Jenkins versions 0.0.46 and earlier contains a cross-site request forgery (CSRF) vulnerability that allows attackers to connect to an attacker-specified URL using credentials obtained through another method.
The mabl plugin for Jenkins version 0.0.46 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access credentials they are not entitled to.
A missing permission check in Jenkins mabl Plugin 0.0.46 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
A missing permission check in Jenkins Orka by MacStadium Plugin 1.33 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Oracle Cloud Infrastructure Compute Plugin version 1.0.16 and earlier does not validate SSH host keys when connecting to OCI clouds, enabling man-in-the-middle attacks.
Jenkins OpenShift Login Plugin version 1.1.0.227.v27e08dfb_1a_20 and earlier improperly determines whether a redirect URL after login legitimately points to Jenkins, allowing attackers to perform phishing attacks.
Jenkins OpenShift Login Plugin version 1.1.0.227.v27e08dfb_1a_20 and earlier does not invalidate the previous session on login.
A missing permission check in Jenkins SAML Single Sign On (SSO) Plugin versions 2.1.0 through 2.3.0 allows attackers with Overall/Read permission to download a string representation of the current security realm.
A missing permission check in Jenkins Datadog Plugin 5.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Active Directory Plugin version 2.30 and earlier ignores the 'Require TLS' and 'StartTls' options, resulting in an unencrypted connection test to Active Directory servers.
The Jenkins External Monitor Job Type Plugin version 206.v9a_94ff0b_4a_10 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
An issue was discovered in Keeper Password Manager for Desktop version 16.10.2 and KeeperFill Browser Extensions version 16.5.4, allowing local attackers to gain sensitive information via plaintext password storage in memory after the user is logged in. This issue has been fixed in version 17.2.
Deserialization of Untrusted Data vulnerability in Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier), and 2023.0.0.330468 (and earlier). It could result in arbitrary code execution. Exploitation does not require user interaction.
Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.
A flaw was found in libtiff that can lead to a segmentation fault due to a buffer overflow in the Fax3Encode function. A specially crafted TIFF file can cause a denial of service.
Code-projects Online Restaurant Management System version 1.0 is vulnerable to SQL Injection. An attacker can exploit this vulnerability to bypass the admin panel and view order records, add items, delete items, etc.
CVE-2023-3600 affects the worker lifecycle, where a use-after-free condition could have occurred, potentially leading to an exploitable crash. This affects Firefox < 115.0.2, Firefox ESR < 115.0.2, and Thunderbird < 115.0.1.
The session restore helper crashes whenever there is no parameter sent to the message handler. This vulnerability affects Firefox for iOS versions below 115.
The vulnerability involves the permission request prompt from the background tab overlaying the site in the foreground tab. This affects Firefox for iOS versions below 115.
The vulnerability in Rockwell Automation 1756-EN4* Ethernet/IP communication products could allow a malicious user to cause a denial of service by sending maliciously crafted CIP messages.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS