CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.22)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In Android in all CAF releases using the Linux kernel, a Use of Uninitialized Variable vulnerability could potentially exist.
In the Embedded File System in all Android releases from CAF using the Linux kernel, a Time-of-Check Time-of-Use Race Condition vulnerability could potentially exist.
In WCDMA in all Android releases from CAF using the Linux kernel, a Use After Free vulnerability could potentially exist.
In WCDMA in all Android releases from CAF using the Linux kernel, a Use of Out-of-range Pointer Offset vulnerability could potentially exist.
In GERAN in all Android releases from CAF using the Linux kernel, a Buffer Copy without Checking Size of Input vulnerability could potentially exist.
In UIM in all Android releases from CAF using the Linux kernel, a Buffer Copy without Checking Size of Input vulnerability could potentially exist.
In GNSS in all Android releases from CAF using the Linux kernel, a Use After Free vulnerability could potentially exist.
In HDR in all Android releases from CAF using the Linux kernel, a Buffer Copy without Checking Size of Input vulnerability could potentially exist.
In Android releases from CAF using the Linux kernel, a Signed to Unsigned Conversion Error may occur.
In NAS in all Android releases from CAF using the Linux kernel, a Buffer Copy without Checking Size of Input vulnerability could potentially exist.
BigTree CMS versions up to 4.2.18 are vulnerable to CSRF attacks related to various scripts and URIs that allow modification of user information and removal of packages.
BigTree CMS versions up to 4.2.18 allow remote authenticated users to conduct SQL injection attacks via a crafted tables object in manifest.json in an uploaded package.
BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary code by uploading a crafted package containing a PHP web shell. This issue relates to the extraction of a ZIP archive to filename patterns such as cache/package/xxx/yyy.php.
The regexp module in YARA 3.5.0 contains a vulnerability that allows remote attackers to cause a denial of service (stack consumption) via a crafted rule involving hex strings, mishandled in the _yr_re_emit function.
Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to input validation (embedded newlines) in the get_process_ttyname() function resulting in information disclosure and command execution.
Openbravo Business Suite 3.0 is affected by SQL injection, which could allow remote authenticated attackers to inject arbitrary SQL code.
TeamPass versions before 2.1.27.4 are vulnerable to a SQL injection in users.queries.php.
Dolibarr ERP/CRM versions before 5.0.3 are vulnerable to SQL injection in user/index.php, in the search_supervisor and search_statut parameters.
Arbitrary file deletion exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before version 7.0.1-build2093. The attack methodology is absolute path traversal in cgi-bin/MANGA/firmware_process.cgi via the upfile.path parameter.
Cleartext password storage exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before version 7.0.1-build2093. The files in question are /etc/waipass and /etc/roapass, which can be easily read by an attacker.