CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Versions of Nexpose prior to 6.4.66 fail to adequately validate the source of HTTP requests intended for the Automated Actions administrative web application, making them susceptible to a cross-site request forgery (CSRF) attack.
A Denial of Service (DoS) vulnerability related to regular expressions exists in the npm package ecstatic, before version 2.0.0. An attacker can overload and crash a server by sending a maliciously crafted string.
A privilege escalation vulnerability in Fortinet FortiClient for Windows 5.4.3 and earlier as well as 5.6.0 allows an attacker to exploit the Windows 'security alert' dialog, which can pop up when the 'VPN before logon' feature is enabled and an untrusted certificate chain is used.
The lib/gui.py file in Bob Hepple gjots2 version 2.4.1 does not validate strings before launching the program specified by the BROWSER environment variable, which may allow remote attackers to conduct argument-injection attacks via a crafted URL.
The uiutil.c file in Mensis version 0.0.080507 does not validate strings before launching the program specified by the BROWSER environment variable, which may allow remote attackers to conduct argument-injection attacks via a crafted URL.
The default.tcl file in Tkabber 1.1 does not validate strings before launching the program specified by the BROWSER environment variable, which may allow remote attackers to conduct argument-injection attacks via a crafted URL.
In version 1.9.22 of Kiwi, the file examples/framework/news/news3.py does not validate strings before launching the program specified by the BROWSER environment variable, which may allow remote attackers to conduct argument-injection attacks via a crafted URL.
In version 4.8.6 of GNU GLOBAL, the gozilla.c file does not validate strings before launching the program specified by the BROWSER environment variable, which may allow remote attackers to conduct argument-injection attacks via a crafted URL.
In Geomview 1.9.5, the common/help.c file does not validate strings before launching the program specified by the BROWSER environment variable, which may allow remote attackers to conduct argument-injection attacks via a crafted URL.
In AbiWord 3.0.2-2, the file af/util/xp/ut_go_file.cpp does not validate strings before launching the program specified by the BROWSER environment variable, which may allow remote attackers to conduct argument-injection attacks via a crafted URL.
In ScummVM 1.9.0, the posix.cpp file does not validate strings before launching the program specified by the BROWSER environment variable, which may allow remote attackers to conduct argument-injection attacks via a crafted URL.
The delphi_gui/WWWBrowserRunnerDM.pas in PasDoc 0.14 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
In version 1.2.3.57 of Bernard Parisse Giac, the Input.cc file does not validate strings before launching the program specified by the BROWSER environment variable, which may allow remote attackers to conduct argument-injection attacks via a crafted URL.
The guiclient.cpp file in xTuple PostBooks 4.7.0 does not validate strings before launching the program specified by the BROWSER environment variable, which may allow remote attackers to conduct argument-injection attacks via a crafted URL.
The library www_browser.pl in SWI-Prolog 7.2.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
In lib/webbrowser.py in Python through version 3.6.3, strings are not validated before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
The uiutil.c file in FontForge through version 20170731 does not validate strings before launching the program specified by the BROWSER environment variable, which may allow remote attackers to conduct argument-injection attacks via a crafted URL.
The url_handler.pl tool in TIN version 2.4.1 does not validate strings before launching the program specified by the BROWSER environment variable, which may allow remote attackers to conduct argument-injection attacks via a crafted URL.
In version 2.6 of OCaml Batteries Included (ocaml-batteries), the batteriesConfig.mlp component does not validate strings before launching the program specified by the BROWSER environment variable, which may allow remote attackers to conduct argument-injection attacks via a crafted URL.
In version 0.30.10 of White_dune, strings are not validated before launching the program specified by the BROWSER environment variable, which may allow remote attackers to conduct argument-injection attacks via a crafted URL.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS