CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
W jądrze Linuxa rozwiązano podatność związaną z rejestracją grup sysfs przez rdzeń sterownika. Umożliwiono uproszczenie obsługi błędów oraz czyszczenia, a także uniknięcie wyścigu UAF podczas wyrejestrowywania, gdzie atrybuty sysctl były dostępne po zwolnieniu struktury info.
A deadlock vulnerability was found in the Linux kernel's EROFS filesystem caused by crafted images with overlapping pclusters. The issue leads to a task hang due to improper handling of managed folios and I/O submission ordering.
A cross-site scripting (XSS) vulnerability was found in Piwigo version 14.5.0 in the /admin.php?page=photo component. An attacker can inject malicious JavaScript or HTML into the Description field, leading to arbitrary script execution in the victim's browser.
A cross-site scripting (XSS) vulnerability was found in Piwigo version 14.5.0 in the /admin.php?page=album component. An attacker can inject malicious JavaScript or HTML into the Description field, leading to arbitrary script execution in the victim's browser.
A Remote Code Execution (RCE) vulnerability in ZoneMinder through version 1.36.33 allows an attacker to create a new .php log file in the language folder. By executing a crafted payload, the attacker can escalate privileges and execute arbitrary commands on the remote system.
A directory listing vulnerability in the baserCMS plugin for BurgerEditor and BurgerEditor Limited Edition before version 2.25.1 allows remote attackers to obtain sensitive information by exposing a list of uploaded files.
A reflected cross-site scripting (XSS) vulnerability in Elaine's Realtime CRM Automation v6.18.17 allows attackers to execute arbitrary JavaScript code in the user's web browser by injecting a crafted payload into the dialog parameter at wrapper_dialog.php.
Krayin CRM version 1.3.0 is vulnerable to Cross Site Scripting (XSS) via the organization name field in /admin/contacts/organizations/edit/2. An attacker can inject malicious JavaScript code that will execute in the administrator's browser.
Cross Site Scripting (XSS) vulnerability in LimeSurvey before version 6.5.0+240319 allows a remote attacker to execute arbitrary JavaScript code in the victim's browser. The issue stems from missing input validation and output encoding in the Alert Widget's message component.
A Cross-Site Scripting (XSS) vulnerability was found in LimeSurvey before version 6.5.12+240611. A remote attacker can execute arbitrary code via a crafted script in the title and comment fields.
OnlineNewsSite v1.0 is vulnerable to Cross Site Scripting (XSS) in the /admin/post/edit/ endpoint. Attackers can inject arbitrary JavaScript code via the Title and Summary fields, leading to arbitrary code execution in the victim's browser.
Slim Select versions 2.0 through 2.9.0 are vulnerable to cross-site scripting (XSS). The createOption() function assigns user-provided text to innerHTML without sanitization, allowing attacker-executed JavaScript.
A vulnerability was found in Golang FIPS OpenSSL that allows a malicious user to return an uninitialized buffer length variable with a zeroed buffer in FIPS mode. This may lead to false positive hash comparisons and result in a derived key being all zeros.
A heap buffer overflow vulnerability was discovered in Giflib Project version 5.2.2 via the gif2rgb utility. The issue occurs when processing specially crafted GIF files, potentially leading to program crashes.
Podatność CVE-2024-8608 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w aplikacji ValeApp od Oceanic Software, co pozwala na wystąpienie ataków typu Stored XSS. Problem ten dotyczy wersji ValeApp przed 2.0.0.
A reflected Cross-Site Scripting (XSS) vulnerability was found in Temenos T24 Browser R19.40 in the about.jsp and genrequest.jsp components. An attacker can remotely execute arbitrary JavaScript code via the skin parameter.
W podatności CVE-2024-6877 występuje niewłaściwa neutralizacja danych wejściowych podczas generowania stron internetowych w Eliz Software Panel, co pozwala na ataki typu Reflected XSS. Problem dotyczy wersji Panelu przed 2.3.24.
W panelu Eliz Software występuje podatność na XSS (Cross-site Scripting) z powodu niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych. Problem dotyczy wersji panelu przed 2.3.24.
Podatność CVE-2024-5682 dotyczy systemu automatyzacji bibliotek Yordam przed wersją 20.1, gdzie niewłaściwe ograniczenie nadmiernych prób uwierzytelnienia umożliwia manipulację interfejsem. Problem ten może prowadzić do nieautoryzowanego dostępu do systemu.
W jądrze systemu Linux zidentyfikowano podatność, która występuje podczas resetowania interfejsu sieciowego. Wywołanie funkcji ethtool w trakcie resetu może prowadzić do dereferencji wskaźnika NULL, co skutkuje awarią systemu.