CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An improper authentication vulnerability exists in curl versions 7.33.0 to 7.82.0 which might allow reuse of OAUTH2-authenticated connections without properly ensuring that the connection was authenticated with the same credentials. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S), and LDAP(S) (openldap only).
A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is running within the NOSi container. This vulnerability exists because the health check RPM opens TCP port 6379 by default upon activation. An attacker could exploit this vulnerability by connecting to the Redis instance on the open port. A successful exploit could allow the attacker to write to the Redis in-memory database, write arbitrary files to the container filesystem, and retrieve information about the Redis database. Given the configuration of the sandboxed container that the Redis instance runs in, a remote attacker would be unable to execute remote code or abuse the integrity of the Cisco IOS XR Software host system.
Gibbon v23 does not generate a new session ID after user authentication, making it vulnerable to session fixation attacks. An attacker can force a victim to use a known session ID and then hijack the session after login.
W systemie zamawiania jedzenia online w wersji 1.0 występuje podatność na przesyłanie dowolnych plików w funkcji wyboru obrazu, co pozwala atakującym na wykonanie dowolnego kodu za pomocą spreparowanego pliku PHP.
W systemie zamawiania jedzenia online w wersji 1.0 odkryto podatność na wstrzykiwanie SQL poprzez parametr Search w pliku food-search.php.
A vulnerability in CyberLink Power Director v14 allows attackers to escalate privileges via a crafted .exe file.
VMware Tools dla systemu Windows (wersje 12.0.0, 11.x.y i 10.x.y) zawiera podatność typu XML External Entity (XXE). Złośliwy użytkownik z nieadministracyjnymi uprawnieniami lokalnymi w systemie Windows, gdzie zainstalowane są VMware Tools, może wykorzystać tę lukę, co prowadzi do stanu odmowy usługi lub niezamierzonego ujawnienia informacji.
The default configuration of the TreeGrid component uses Object::toString as a key in client-side and server communication in Vaadin, potentially disclosing values that should not be available on the client side. Affected versions include Vaadin 14.8.5-14.8.9, 22.0.6-22.0.14, 23.0.0.beta2-23.0.8, and 23.1.0.alpha1-23.1.0.alpha4.
Multiple EMCO Software products (MSI Package Builder, Remote Installer, Ping Monitor, Remote Shutdown, WakeOnLan, Network Inventory, Network Software Scanner, UnLock IT) are affected by CWE-494: Download of Code Without Integrity Check. The Updater component downloads code without integrity verification, allowing remote code execution.
CSRF vulnerability in Simple Food Website 1.0 by Lumidek Associates allows an attacker to take over an admin or moderator account without their knowledge.
Multiple cross-site scripting (XSS) vulnerabilities were found in the /obcs/user/profile.php component of Online Birth Certificate System v1.2. Attackers can inject malicious JavaScript or HTML via the fname or lname parameters, leading to arbitrary script execution in the victim's browser.
Diary Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name parameter in search-result.php. This allows an attacker to inject malicious scripts into the page.
The D-Link DSL-G2452DG (hardware version T1, firmware ME_2.00) was found to have insecure permission settings. This vulnerability could allow unauthorized users to access sensitive functions or data.
A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use after free both read or write when non synchronized between cleanup routine and firmware download routine.
A use-after-free vulnerability exists in BusyBox 1.35-x's awk applet within the copyvar function. Processing a crafted awk pattern can lead to denial of service or potentially code execution.
TOTOLINK A3100R routers with firmware versions V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were found to have a stack overflow vulnerability. The issue occurs in the setParentalRules function via the startTime and endTime parameters, allowing an attacker to cause a Denial of Service (DoS) through a crafted POST request.
A vulnerability in the Z-Wave S0 NonceGet protocol specification in Silicon Labs Z-Wave 500 series allows a local attacker to block S0/S2 protected Z-Wave networks by sending crafted S0 NonceGet packets that exploit included but absent NodeIDs.
An arbitrary file upload vulnerability in Tiddlywiki5 v5.2.2 allows attackers to execute arbitrary code via a crafted SVG file.
An SSRF vulnerability in MicroStrategy Web SDK 11.1 and earlier allows unauthenticated remote attackers to perform server-side request forgery via the srcURL parameter in the shortURL task.
If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS