CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in ZITADEL's federation process allowed auto-linking users from external identity providers to existing internal accounts even when the IdP was disabled or the organization disallowed federated authentication. This stemmed from the platform failing to enforce organization-specific security settings during authentication. Versions 2.71.19, 3.4.4, and 4.6.6 fix the issue by correctly validating the organization's login policy before auto-linking.
pgAdmin versions up to 9.9 are affected by a Remote Code Execution (RCE) vulnerability when running in server mode and performing restores from PLAIN-format dump files. Attackers can inject and execute arbitrary commands on the server hosting pgAdmin.
Zidentyfikowano podatność na obejście uwierzytelniania w niektórych routerach serii DSL, która może umożliwić zdalnym atakującym uzyskanie nieautoryzowanego dostępu do dotkniętego systemu.
FiberHome AN5506-04-FA firmware up to RP2631 and HG6245D before RP2602 contain a stack-based buffer overflow in the HTTP service ('webs') due to lack of maximum length enforcement for Cookie header values. Processing a cookie longer than 511 bytes overruns a stack buffer, leading to a crash or potential control of execution flow.
Dell Data Lakehouse versions prior to 1.6.0.0 contain an Improper Access Control vulnerability. A high privileged attacker with remote access could exploit this to elevate privileges, leading to unauthorized access with elevated privileges and compromising system integrity and customer data.
A SQL injection vulnerability exists in the login functionality of WellSky Harmony version 4.1.0.2.83 within the 'xmHarmony.asp' endpoint. User-supplied input to the 'TXTUSERID' parameter is not properly sanitized before being incorporated into a SQL query. Successful exploitation may lead to authentication bypass, data leakage, or full system compromise of backend database contents.
CentralSquare Community Development version 19.5.7 has an Authentication Bypass vulnerability that allows attackers to access the admin panel without admin credentials.
CentralSquare Community Development version 19.5.7 has a SQL Injection vulnerability that allows attackers to inject SQL via the permit_no field.
N-central Software Probe before 2025.4 is vulnerable to remote code execution via deserialization.
N-central before 2025.4 is vulnerable to authentication bypass via path traversal.
In the Linux kernel TLS subsystem, if tls_strp_msg_hold fails for async decryption, it can lead to use-after-free (UAF) of the skb or writing to userspace memory after recv() returns.
The a+HRD developed by aEnrich has an authentication abuse vulnerability, allowing unauthenticated remote attackers to craft administrator access tokens and use them to access the system with elevated privileges.
The a+HRD product by aEnrich has an Authentication Abuse vulnerability allowing unauthenticated remote attackers to send crafted packets to obtain administrator access tokens and use them to access the system with elevated privileges.
Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.
Double fetch in sandbox kernel driver in Avast/AVG Antivirus <25.3 on Windows allows a local attacker to escalate privileges via pool overflow.
Podatność CVE-2025-13026 dotyczy ucieczki z piaskownicy spowodowanej nieprawidłowymi warunkami brzegowymi w komponencie Graphics: WebGPU. Została naprawiona w wersjach Firefox 145 i Thunderbird 145.
Podatność CVE-2025-13024 dotyczy błędnej kompilacji Just-In-Time (JIT) w silniku JavaScript. Problem ten został naprawiony w wersjach Firefox 145 oraz Thunderbird 145.
Podatność CVE-2025-13023 dotyczy ucieczki z piaskownicy spowodowanej nieprawidłowymi warunkami brzegowymi w komponencie Graphics: WebGPU. Została naprawiona w wersjach Firefox 145 i Thunderbird 145.
W komponentach Graphics: WebGPU występują nieprawidłowe warunki graniczne, co może prowadzić do potencjalnych problemów z bezpieczeństwem. Podatność ta została naprawiona w wersjach Firefox 145 i Thunderbird 145.
W komponentach Graphics: WebGPU występują nieprawidłowe warunki graniczne, co może prowadzić do potencjalnych problemów z bezpieczeństwem. Podatność ta została naprawiona w wersjach Firefox 145 i Thunderbird 145.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS