CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The XXE vulnerability in PySAML2 version 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.
Local privilege escalation vulnerability in the Gentoo QEMU package before version 2.5.0-r1.
The editbanner feature in SolarWinds LEM (also known as SIEM) up to version 6.3.1 allows remote authenticated users to execute arbitrary code by editing /usr/local/contego/scripts/mgrconfig.pl.
SolarWinds LEM (also known as SIEM) before version 6.3.1 has an incorrect sudo configuration, allowing local users to gain root access by editing /usr/local/contego/scripts/hostname.sh.
SAP GUI versions 7.2 through 7.5 allow remote attackers to bypass intended security policy restrictions and execute arbitrary code via crafted ABAP code.
USB Pratirodh allows remote attackers to conduct XML External Entity (XXE) attacks via XML data in usb.xml.
Microsoft Skype version 7.16.0.102 contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system. The issue arises from the way .dll files are loaded by Skype.
The User::randomPassword function in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 generates passwords smaller than $wgMinimalPasswordLength, making it easier for remote attackers to gain access via a brute-force attack.
MediaWiki versions before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly sanitize parameters when calling the cURL library. This allows remote attackers to read arbitrary files via an @ (at sign) character in unspecified POST array parameters.
The User::matchEditToken function in MediaWiki before version 1.23.12 and 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 does not perform token comparison in constant time, allowing remote attackers to guess the edit token and bypass CSRF protection via a timing attack.
The User::matchEditToken function in MediaWiki before 1.23.12 and 1.24.x before 1.24.5 does not perform token comparison in constant time, allowing remote attackers to guess the edit token and bypass CSRF protection via a timing attack.
The Soft Access Point feature in Samsung Smart TVs X10P, X12, X14H, X14J, and NT14U and Xpress M288OFW printers generate weak WPA2 PSK keys, making it easier for remote attackers to obtain sensitive information or bypass authentication via a brute-force attack.
Cloudera Key Trustee Server before 5.4.3 does not store keys synchronously, which might allow attackers to have unspecified impact via vectors related to loss of an encryption key.
The _mediaLibraryPlayCb function in mainwindow.py in pitivi before 0.95 allows attackers to execute arbitrary code via shell metacharacters in a file path.
The calcstepsizes function in jpc_dec.c in JasPer 1.900.22 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectors.
The jpc_floorlog2 function in jpc_math.c in JasPer before version 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectors.
The jpc_dequantize function in jpc_dec.c in JasPer 1.900.13 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectors.
The JPC_NOMINALGAIN function in JasPer through version 2.0.12 allows remote attackers to cause a denial of service (JPC_COX_RFT assertion failure) via unspecified vectors.
The jpc_bitstream_getbits function in jpc_bs.c in JasPer before 2.0.10 allows remote attackers to cause a denial of service (assertion failure) via a very large integer.
The jpc_irct and jpc_iict functions in jpc_mct.c in JasPer before version 1.900.14 allow remote attackers to cause a denial of service (assertion failure).