CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An out-of-bounds memory write flaw was found in the Linux kernel's watch_queue event notification subsystem, which can overwrite parts of kernel state.
A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system.
Yonyou u8 v13.0 was found to contain a DOM-based cross-site scripting (XSS) vulnerability via the /u8sl/WebHelp component. An attacker can inject a malicious script that executes in the victim's browser.
A stored cross-site scripting (XSS) vulnerability in the upload function of /admin/show.php allows attackers to execute arbitrary web scripts or HTML via a crafted image file.
An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older.
A vulnerability in zlib before version 1.2.12 allows memory corruption during data compression when the input contains many distant matches.
Certain HP Print devices may be vulnerable to potential information disclosure, denial of service, or remote code execution.
Certain HP Print devices may be vulnerable to information disclosure, denial of service, or remote code execution.
Certain HP Print devices may be vulnerable to potential information disclosure, denial of service, or remote code execution.
Wtyczka Ninja Forms - File Uploads dla WordPressa jest podatna na refleksyjny atak typu cross-site scripting z powodu braku sanitizacji parametru nazwy pliku w pliku ~/includes/ajax/controllers/uploads.php. Atakujący bez uwierzytelnienia mogą wykorzystać tę lukę do dodania złośliwych skryptów do podatnych witryn WordPress, w wersjach do 3.3.12 włącznie.
Wtyczka Ninja Forms - File Uploads dla WordPressa jest podatna na nieautoryzowane przesyłanie plików z powodu niewystarczającej walidacji typu pliku wejściowego w pliku ~/includes/ajax/controllers/uploads.php. Atakujący mogą obejść tę walidację, co umożliwia przesyłanie złośliwych plików, które mogą prowadzić do zdalnego wykonania kodu.
Wtyczka Amelia do WordPressa jest podatna na ataki Cross-Site Scripting z powodu niewystarczającego oczyszczania i sanitizacji parametru lastName w pliku ~/src/Application/Controller/User/Customer/AddCustomerController.php. Umożliwia to atakującym wstrzykiwanie dowolnych skryptów webowych na stronach, które są wykonywane, gdy użytkownik uzyskuje dostęp do kalendarza rezerwacji z datą, w którą atakujący wstrzyknął złośliwy ładunek.
IrfanView 4.59 is vulnerable to a buffer overflow in the function at address 0x413c70 (in the 32-bit version). The vulnerability is triggered when the user opens a malicious TIFF image.
A buffer overflow vulnerability exists in the blocking.cgi script of ASUS AC68U routers version 3.0.0.4.385.20852 and earlier. This flaw can lead to a denial of service (DoS).
Asus RT-AC68U before version 3.0.0.4.385.20633 and RT-AC5300 before version 3.0.0.4.384.82072 are affected by a buffer overflow in blocking_request.cgi. This vulnerability could allow a remote attacker to execute arbitrary code or cause a denial of service.
A heap buffer overflow in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c allows a local attacker with normal privileges to overwrite kernel heap objects, potentially leading to local privilege escalation.
A vulnerability in BigAnt Server version 5.6.06 allows an attacker to perform a Denial of Service (DoS) attack, potentially causing service disruption.
A cross-site scripting (XSS) vulnerability was discovered in BigAnt Server version 5.6.06. It allows an attacker to inject malicious scripts into web pages.
BigAnt Server version 5.6.06 from BigAnt Software was found to contain a Cross-Site Request Forgery (CSRF) vulnerability. This allows an attacker to perform unauthorized actions on behalf of an authenticated user.
BigAnt Server version 5.6.06 uses weak password hashing functions, making password recovery easier.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS