CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
GStreamer przed wersją 1.18.4 może uzyskiwać dostęp do już zwolnionej pamięci w ścieżkach kodu błędów podczas demuksowania niepoprawnie sformatowanych plików Matroska.
The overlayfs implementation in the Linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.
A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application.
The jose library, used for cryptographic operations, has a vulnerability in the AES_CBC_HMAC_SHA2 algorithm that allows the use of a padding oracle to decrypt data without knowing the key. Observable timing differences during padding errors can enable an attacker to exploit this vulnerability.
System Recenzenta Online w wersji 1.0 zawiera podatność na wstrzykiwanie SQL poprzez obejście uwierzytelniania, co może prowadzić do przesyłania powłoki odwrotnej.
Appspace 6.2.4 is vulnerable to a broken authentication mechanism. Pages such as /medianet/mail.aspx can be called directly, exposing the framework with layouts, menus, and functionalities.
W bibliotece Libsixel w wersji 1.8.6 występuje przepełnienie bufora w funkcji 'sixel_encoder_encode_bytes', co umożliwia atakującym wywołanie odmowy usługi (DoS).
Win32k Elevation of Privilege Vulnerability.
Apache Commons IO before version 2.7 has a limited path traversal vulnerability in the FileNameUtils.normalize method. When invoked with an improper input string like "//../foo" or "\\..\foo", the result is the same value, potentially providing access to files in the parent directory, but not further above.
A vulnerability in INTELBRAS TIP200 IP phone version 60.61.75.22 allows an attacker to access sensitive information via the /cgi-bin/cgiServer.exx endpoint.
Vulnerability in SonicWall Email Security version 10.0.9.x allows a post-authenticated attacker to upload an arbitrary file to the remote host.
A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.
Unibox SMB 2.4, UniBox Enterprise Series 2.4, and UniBox Campus Series 2.4 contain a cross-site request forgery (CSRF) vulnerability in several endpoints, including /tools/network-trace, /list_users, /list_byod?usertype=raduser, /dhcp_leases, and /go?rid=202. A specially crafted HTTP request may allow an attacker to reconfigure the device without administrator consent.
UniBox U-50 2.4, UniBox Enterprise Series 2.4, and UniBox Campus Series 2.4 contain an OS command injection vulnerability in the /tools/ping script. This flaw allows an attacker to gain complete control over the device.
In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. There is no known practical attack exploiting this vulnerability.
In RetroArch 1.9.0 for Windows, the accessibility_speak_windows function in platform_win32.c passes unsanitized input to PowerShell, allowing attackers with write access to filesystems used by RetroArch to execute code via command injection using specially crafted file and directory names.
Froala Editor 3.2.6 is vulnerable to persistent XSS. A crafted base64 string in the hyperlink creation module allows injection of malicious scripts.
This issue was addressed by improved management of object lifetimes. The issue is fixed in iOS 12.5.2, iOS 14.4.2, iPadOS 14.4.2, and watchOS 7.3.3, and processing maliciously crafted web content may lead to universal cross-site scripting. Apple is aware of a report that this issue may have been actively exploited.
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution.
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS