CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A flaw in the Submariner project involves unnecessary RBAC permissions. A privileged attacker can run a malicious container on a node, steal service account tokens, and compromise other nodes or the entire cluster.
The Base64 Encoder/Decoder WordPress plugin through version 0.9.2 lacks CSRF check when resetting its settings, allowing an attacker to trick a logged-in admin into resetting them via a CSRF attack.
The Base64 Encoder/Decoder WordPress plugin through version 0.9.2 does not sanitize or escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting vulnerability that could be used against high-privilege users like admins.
A use of externally-controlled format string vulnerability in Fortinet FortiOS and other Fortinet products allows an attacker to execute unauthorized code or commands via specially crafted cli commands and http requests.
A vulnerability in Fortinet FortiOS and FortiProxy allows for the use of externally-controlled format strings, enabling an attacker to execute unauthorized code or commands via specially crafted commands.
A Cross Site Scripting (XSS) vulnerability in Evertz microsystems MViP-II Firmware 8.6.5 and other products (XPS-EDGE-*, evEDGE-EO-*, MMA10G-*, 570IPG-X19-10G) allows a remote attacker to execute arbitrary code via a crafted payload in login parameters.
A vulnerability has been identified in various versions of SIMATIC automation tools and TIA Portal, allowing for an out of bounds read. This could lead to a Windows operating system crash in the form of a Blue Screen of Death (BSOD).
SQL Injection vulnerability in Cloud based customer service management platform v.1.0.0 allows a local attacker to execute arbitrary code via a crafted payload to the Login.asp component.
W jądrze Linuxa zidentyfikowano podatność związaną z obsługą data_vault, gdy wartość jest ZERO_SIZE_PTR. W niektórych przypadkach GDDV zwraca pakiet z buforem o zerowej długości, co prowadzi do dereferencji wskaźnika NULL w funkcji data_vault_read().
An RBAC authorization risk in Carina v0.13.0 and earlier allows local attackers to execute arbitrary code via crafted commands, enabling them to obtain the entire cluster's secrets and take over the cluster.
A vulnerability was found in Wildfly's management interface. Due to the lack of limitation of sockets for the management interface, it may be possible to cause a denial of service hitting the nofile limit as there is no possibility to configure or set a maximum number of connections.
The Windows kernel module 'ACE-BASE.sys' version 1.0.2202.6217 of Anti-Cheat Expert does not perform proper access control when handling system resources. This allows a local attacker to escalate privileges from regular user to System or PPL level.
In the Linux kernel, an unnecessary synchronize_net() call was removed from the ipv6_mc_down() function. This call caused delays from 200 microseconds to 5 milliseconds under load.
W jądrze systemu Linux rozwiązano podatność związaną z pstore, gdzie niewłaściwe użycie funkcji d_drop() i dput() prowadziło do problemów z liczeniem referencji. Zamiast tego, powinno się używać d_invalidate().
In the Linux kernel, the iwlwifi (mvm subsystem) driver has a vulnerability where the TX queue for the offloading TID is not guaranteed to exist during resume. In the rare case that no packets were sent on TID 0, the queue is not allocated, causing a system crash.
In the Linux kernel, a vulnerability in the netfilter nf_tables subsystem causes memory leaks when a set deletion operation fails, due to incorrect element iteration logic in the abort path that skips active instead of inactive elements.
Incorrect access control in ASUS RT-N12+ B1 and RT-N12 D1 routers allows local attackers to obtain root terminal access via the UART interface.
The Asus RT-N12+ B1 router stores credentials in cleartext, which could allow local attackers to obtain unauthorized access and modify router settings.
A CSV Injection vulnerability in the Asus RT-N12+ router allows an administrator to inject arbitrary commands or formulas into the client name parameter. When exported to CSV format, the injected code can be executed in another user's session upon opening the file.
A log injection flaw was found in Keycloak. A text string may be injected through the authentication form when using the WebAuthn authentication mode. This issue may have a minor impact to the logs integrity.