CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Use-after-free vulnerability in Indexed DB API in Google Chrome prior to 93.0.4577.82. A remote attacker who compromised the renderer process could potentially perform a sandbox escape via a crafted HTML page.
Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.
Assuming radio permission is gained, missing input validation in the modem interface driver prior to SMR Oct-2021 Release 1 results in a format string bug leading to kernel panic.
Lack of boundary checking of a buffer in set_skb_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read and it results in arbitrary code execution by dereference of invalid function pointer.
Grafana has a vulnerability that allows unauthenticated and authenticated users to view snapshots with the lowest database key by accessing specific paths. If the public_mode setting is enabled, unauthenticated users can also delete such snapshots. Authenticated users can delete snapshots regardless of this setting, leading to complete snapshot data loss.
An XSS vulnerability in Afian FileRun 2021.03.26 allows an attacker to inject malicious scripts when an administrator uses the HTML Editor to preview or edit a crafted document.
An SSRF vulnerability in NagiosXI up to version 5.8.4 allows authenticated users to create scheduled reports with PDF screenshots of any view. Lack of input sanitization enables replacing the target page with an SSRF payload.
A vulnerability in Afian FileRun 2021.03.26 allows remote code execution by administrators via the Check Path value for the magick binary.
A vulnerability in Afian FileRun 2021.03.26 allows remote code execution by administrators via the Check Path value for the ffmpeg binary.
Afian FileRun 2021.03.26 is vulnerable to stored XSS via an HTTP X-Forwarded-For header that is mishandled when rendering Activity Logs. An attacker can inject malicious JavaScript code.
W Apache HTTP Server 2.4.49 znaleziono lukę w normalizacji ścieżek, która umożliwia atak typu path traversal. Atakujący może uzyskać dostęp do plików poza skonfigurowanymi katalogami, co może prowadzić do zdalnego wykonania kodu, jeśli skrypty CGI są włączone dla tych ścieżek.
prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the Linux kernel before 5.14.12 allows unprivileged users to trigger an eBPF multiplication integer overflow with a resultant out-of-bounds write.
JIZHICMS 1.5.1 contains a cross-site scripting (XSS) vulnerability in the /user/release.html component, allowing attackers to arbitrarily add an administrator cookie.
In version 2.1.15 and below of the Lider module in LiderAhenk software, configurations are leaking via an unsecured API. An attacker with access to the configurations API could obtain valid LDAP credentials.
A vulnerability in SMM branch registers a SWSMI handler that does not sufficiently validate the allocated buffer pointer (QWORD values for CommBuffer), allowing an attacker to corrupt SMRAM memory and potentially execute arbitrary code.
Wersje curl od 7.20.0 do 7.78.0 mają lukę, która pozwala na ominięcie wymogu użycia TLS podczas komunikacji z serwerami IMAP, POP3 lub FTP. Jeśli serwer zwróci odpowiednio skonstruowaną, ale poprawną odpowiedź, curl może kontynuować operacje bez szyfrowania, mimo że użytkownik tego nie oczekiwał.
In Progress WhatsUp Gold before version 21.1.0, an application endpoint failed to adequately sanitize malicious input, which could allow an unauthenticated attacker to execute arbitrary code in a victim's browser.
Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentially leads to DoS.
A vulnerability in sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process if the configuration specifies running the command as a different user.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS