CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An access control issue was discovered in autMan version 2.9.6. This vulnerability may allow unauthorized users to bypass authorization mechanisms.
An issue in Silverpeas v.6.4.2 and lower allows a remote attacker to cause a denial of service (DoS) via the password change function.
The UNIX editor Vim prior to version 9.1.0678 has a use-after-free error in argument list handling. Adding a new file to the argument list can trigger `Buf*` autocommands, and closing the buffer leads to freeing the window structure, resulting in a use-after-free error.
Nieprawidłowa walidacja danych wejściowych w ARM® Trusted Firmware używanym w AMD Zynq™ UltraScale+™ MPSoC/RFSoC może umożliwić uprzywilejowanemu atakującemu wykonanie odczytów poza dozwolonym zakresem, co może prowadzić do wycieku danych oraz odmowy usługi.
A reflected XSS vulnerability exists in Microweber 2.0.15 and earlier in the '/search' endpoint. An unauthenticated remote attacker can inject arbitrary web script or HTML via the 'keywords' parameter.
A vulnerability in Horizon Business Services Inc. Caterease versions 16.0.1.1663 through 24.0.1.2405 and possibly later allows a local attacker to perform a password brute force attack due to improper restriction of excessive authentication attempts.
Dell Inventory Collector versions prior to 12.3.0.6 contain a Path Traversal vulnerability. A local authenticated malicious user could potentially exploit this vulnerability to achieve arbitrary code execution on the system.
In the Linux kernel, a vulnerability in the Bluetooth stack allows too large handle values in BIG to cause erroneous release of an IDA identifier in hci_conn_cleanup.
A Cross Site Scripting (XSS) vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the 'page' parameter in php-lfis/admin/index.php.
A Cross Site Scripting (XSS) vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the first, last, and middle name fields on the User Profile page.
In the Linux kernel, a NULL pointer dereference vulnerability was found in the GFS2 filesystem's gfs2_log_flush function. The issue occurs when glock operations race with an unmount, causing access to a freed sd_jdesc object.
An incorrect access control vulnerability in the Himalaya Xiaoya nano smart speaker (rom_version 1.6.96) allows a remote attacker to have an unspecified impact. The flaw enables unauthorized access to the device.
W jądrze systemu Linux zidentyfikowano podatność związaną z brakiem inicjalizacji pola cqe.result w NVMe. Problem dotyczy różnic w zachowaniu implementacji dla różnych protokołów, co może prowadzić do niezamierzonego ujawnienia danych ze stosu.
A Cross-Site Request Forgery (CSRF) vulnerability was found in ProcessWire version 3.0.229, allowing a remote attacker to insert a comment. The supplier disputes this, stating the product intentionally accepts anonymous, unauthenticated comments and that submitted comments are held for moderator review by default.
Podatność CVE-2024-5625 dotyczy niewłaściwego ograniczenia odniesienia do zewnętrznych jednostek XML w konsoli zarządzania Apinizer firmy PruvaSoft, co pozwala na eksplozję jednostek zewnętrznych podczas serializacji danych.
Podatność CVE-2024-5620 w konsoli zarządzania Apinizer firmy PruvaSoft umożliwia obejście uwierzytelniania poprzez alternatywną ścieżkę lub kanał. Problem ten dotyczy wersji przed 2024.05.1.
W SDK Pythona dla Sentry.io (sentry-sdk) w wersjach poniżej 2.8.0 występuje błąd, który pozwala na przekazywanie zmiennych środowiskowych do procesów podrzędnych, mimo ustawienia `env={}`. Problem ten został naprawiony w wersji 2.8.0 SDK.
W jądrze Linuxa zidentyfikowano podatność, która pozwala na asynchroniczne ustawienie wskaźnika ->sock na NULL, jeśli nie jest utrzymywany mutex ->recv_mutex. Brak jego utrzymania może prowadzić do błędów podczas odczytu sysfs.
In the Linux kernel's IPv6 multicast subsystem, a vulnerability was found due to using an RCU-unsafe version of ipv6_get_lladdr(). After external locks were removed from MLD code, this function can be called without proper synchronization, leading to use-after-free and system crash.
A vulnerability was found in OpenJPEG similar to CVE-2019-6988, which allows an attacker to bypass existing protections and cause an application crash through a maliciously crafted file.