CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Kitto framework version 0.5.1 is vulnerable to memory exhaustion in the router, resulting in a DoS attack.
Kitto 0.5.1 is vulnerable to directory traversal in the router, which may lead to remote code execution.
xmlsec version 1.2.23 and earlier is vulnerable to XML External Entity Expansion when parsing crafted input documents, potentially leading to information disclosure or denial of service.
In version 5.1 of EyesOfNetwork (EON), there is an unauthenticated SQL injection vulnerability in eonweb that can lead to remote root access.
Kubernetes versions 1.5.0-1.5.4 are vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin, allowing the use of any existing PodSecurityPolicy object.
Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to arbitrary code execution in the deserialization functions of Plug.Session.
Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to null byte injection in the Plug.Static component, which may allow users to bypass filetype restrictions.
JasPer 2.0.12 is vulnerable to a NULL pointer exception in the function jp2_encode which failed to check to see if the image contained at least one component resulting in a denial-of-service.
The web framework using the qs module in versions older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS attack. A malicious user can send an evil request causing the framework to crash.
rbenv (all current versions) is vulnerable to Directory Traversal in the specification of Ruby version, resulting in arbitrary code execution.
Mautic version 2.6.1 and earlier fails to set flags on session cookies, which may lead to unauthorized access to user sessions.
gtk-vnc version 0.4.2 and older does not correctly check framebuffer boundaries when updating, which may lead to memory corruption during rendering.
Framadate version 1.0 is vulnerable to Formula Injection in the CSV Export resulting possible Information Disclosure and Code Execution.
RVM automatically loads environment variables from files in $PWD, leading to command execution vulnerabilities. RVM also executes hooks and installs gems and performs 'bundle install' based on files in $PWD, resulting in code execution.
Akka versions up to 2.4.16 and 2.5-M1 are vulnerable to a deserialization attack in its Remoting component, potentially leading to remote code execution in the context of the ActorSystem.
CVE-2017-1000031 is an SQL injection vulnerability in graph_templates_inputs.php in Cacti 0.8.8b that allows remote attackers to execute arbitrary SQL commands via the graph_template_input_id and graph_template_id parameters.
GlassFish Server version 3.0.1 (build 22) is vulnerable to Java Key Store Password Disclosure, allowing an unauthenticated attacker to obtain the administrative user's plain text password and gain access to the web-based administration interface.
Oracle's GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to a Local File Inclusion vulnerability that allows arbitrary files to be included on the server. This vulnerability can be exploited without any prior authentication.
GlassFish Server version 4.1 is vulnerable to a Directory Traversal attack that can be exploited by both authenticated and unauthenticated users. The attack involves sending a specially crafted HTTP GET request.
Versions 0.3.0 and older of mixlib-archive from Chef Software are vulnerable to a directory traversal attack allowing attackers to overwrite arbitrary files by using '..' in tar archive entries.