CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In the Linux kernel, a vulnerability in the netfilter conntrack module allows the hashtable size to exceed INT_MAX during resize, triggering a WARN_ON_ONCE in __kvmalloc_node_noprof() due to missing __GFP_NOWARN flag. This issue is limited to the init_netns namespace.
A vulnerability in the Linux kernel's AMD PMC driver (platform/x86/amd/pmc) causes an unbalanced IRQ1 wake disable when i8042 did not enable the wakeup, leading to a WARN() warning and potential wake_depth underflow.
A Cross-Site Scripting (XSS) vulnerability was found in sunnygkp10 Online Exam System master version. It allows a remote attacker to steal sensitive information via the 'w' parameter.
A path traversal vulnerability in Fortinet FortiRecorder, FortiVoice, and FortiWeb allows an attacker to escalate privileges via specially crafted packets.
A race condition was found in rsync's handling of symbolic links. By default, rsync skips symbolic links, but an attacker can replace a regular file with a symbolic link at the right moment to bypass this behavior and traverse symbolic links.
A flaw in rsync causes the client to improperly verify symbolic link destinations when using the `--safe-links` option, allowing path traversal and arbitrary file write outside the intended directory.
A path traversal vulnerability was found in rsync, caused by the `--inc-recursive` option (enabled by default for many clients and can be forced by the server). Insufficient symlink verification combined with per-file-list deduplication checks allows a server to write files outside the client's intended destination directory.
A flaw was found in rsync that could allow a server to enumerate the contents of an arbitrary file from the client's machine. The issue occurs during file copy from client to server when the server sends checksums of local data for comparison. An attacker can send specially crafted checksum values and reconstruct the data byte-by-byte based on client responses.
A stack-based buffer overflow vulnerability in Fortinet FortiAnalyzer and FortiManager allows a remote attacker to execute unauthorized code or commands via specially crafted packets. The issue affects multiple versions of these products, including cloud variants.
A privilege management vulnerability in Fortinet FortiManager and FortiManager Cloud allows unauthorized privilege escalation via specific shell commands. Affected versions include 7.4.0-7.4.3, 7.2.0-7.2.5, 7.0, and 6.4.
A vulnerability in Vim may lead to a heap-buffer overflow when switching to other buffers with visual mode still active. The issue arises from the improper ending of visual mode, which may result in attempts to access memory beyond the end of a line in a buffer.
MonicaHQ v4.1.2 was discovered to contain a Client-Side Injection vulnerability via the last_name parameter in the General Information module.
In the Linux kernel's DLM (Distributed Lock Manager), a vulnerability was found causing a possible null pointer dereference in a logging function when called from request_lock(), as lkb->lkb_resource is not yet assigned. Additionally, a resource name could be a non-printable byte array, leading to incorrect ASCII assumption.
MonicaHQ version 4.1.2 was found to have an authenticated Client-Side Injection vulnerability via the Reason parameter at /people/h:[id]/debts/create.
MonicaHQ version 4.1.1 was found to have an authenticated Client-Side Injection vulnerability. The flaw exists in the entry text field at /journal/entries/ID/edit.
MonicaHQ version 4.1.2 was found to contain multiple Client-Side Injection vulnerabilities. The flaws exist in the first_name and last_name parameters of the Add a new relationship feature.
The Paragraphs table module for Drupal has an insufficient granularity of access control vulnerability that allows content spoofing. This affects versions before 1.23.0 and 2.0.0 before 2.0.2.
A Cross Site Scripting (XSS) vulnerability in iPublish Media Solutions AdPortal 3.0.39 allows a remote attacker to escalate privileges via the shippingAsBilling parameter in updateuserinfo.html.
An Open Redirect vulnerability in Pnetlab 5.3.11 allows an attacker to manipulate URLs to redirect users to arbitrary external websites via a crafted script.
Cross-Site Scripting (XSS) vulnerability in Pnetlab 5.3.11 allows an attacker to inject malicious scripts into a web page, which are executed in the context of the victim's browser.