CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
W Mbed TLS w wersji 3.5.x przed 3.6.0 odkryto problem związany z negocjacją wersji TLS po stronie serwera. Może on przejść do implementacji TLS 1.2, nawet jeśli została ona wyłączona, co prowadzi do nieskończonej pętli w przypadku klienta TLS 1.2 próbującego połączyć się z serwerem obsługującym tylko TLS 1.3.
W Mbed TLS w wersjach 3.5.x przed 3.6.0 odkryto problem, który występuje podczas resetowania kontekstu SSL za pomocą API mbedtls_ssl_session_reset(). Maksymalna wersja TLS do negocjacji nie była przywracana do skonfigurowanej, co pozwalało atakującemu na zablokowanie nawiązywania połączeń TLS 1.3.
A Cross Site Scripting (XSS) vulnerability in CA17 TeamsACS version 1.0.1 allows a remote attacker to execute arbitrary code via a crafted script in the errmsg parameter.
A Cross Site Scripting (XSS) vulnerability in Insurance Management System version 1.0.0 and earlier allows a remote attacker to execute arbitrary JavaScript code in the victim's browser via the "First Name" input field.
A Cross-Site Scripting (XSS) vulnerability exists in dcat-admin version 2.1.3 and earlier. A remote attacker can inject a malicious script via the user login box to execute arbitrary code.
A flaw in GnuTLS can cause an application crash when verifying a specially crafted .pem bundle using the 'certtool --verify-chain' command.
A data-race vulnerability was found in the Linux kernel's ipv6_mc_down / mld_ifc_work functions for IPv6 multicast. The idev->mc_ifc_count field can be written without proper locking, leading to undefined behavior.
The Email Encoder – Protect Email Addresses and Phone Numbers plugin for WordPress up to version 2.2.0 is vulnerable to Stored Cross-Site Scripting via shortcodes due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level permissions can inject arbitrary scripts that execute when a page is visited.
A Cross Site Scripting (XSS) vulnerability in Stimulsoft Dashboard.JS before version 2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload in the search bar component.
A Cross Site Scripting (XSS) vulnerability in Stimulsoft Dashboard.JS before version 2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload in the ReportName field.
A vulnerability in Solar-Log Base 15 Firmware 6.0.1 Build 161 allows privilege escalation via stored XSS in the switch group function. An attacker can gain installer or PM rights and then administrative access to the web portal.
W Mbed TLS w wersjach 2.x przed 2.28.7 oraz 3.x przed 3.5.2 odkryto problem związany z czasowym kanałem bocznym w operacjach prywatnych RSA. Taki kanał boczny może umożliwić lokalnemu atakującemu odzyskanie tekstu jawnego.
Uncontrolled resource consumption vulnerability in SE-elektronic GmbH E-DDC3.3 affecting versions 03.07.03 and higher. An attacker could interrupt the availability of the administration panel by sending multiple ICMP packets.
An issue in the official Plone Docker image version 5.2.13 (5221) allows remote code execution due to improper validation of HOST headers.
Since version 5.2.0, when using deferrable mode with a Kubernetes configuration file for authentication, the Airflow worker serializes this file as a dictionary and stores it in metadata without encryption. In versions 2.3.0-2.6.0, the dictionary is also logged as plain text in the triggerer service. This allows anyone with access to metadata or logs to obtain the configuration file and access the Kubernetes cluster.
The vulnerability in Consensys Discovery versions prior to 0.4.5 uses the same AES/GCM nonce for the entire session, while it should be unique for every message. The node's private key is not compromised, only the session key generated for specific peer communication is exposed.
DependencyCheck for Maven 9.0.0-9.0.6, CLI 9.0.0-9.0.5, and Ant 9.0.0-9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file.
Hard-coded credentials in mod-remote-storage versions under 1.7.2 and from 2.0.0 to 2.0.3 allow unauthorized users to gain read access to mod-inventory-storage records including instances, holdings, items, contributor-types, and identifier-types.
AWS Encryption SDK for Java versions 2.0.0 to 2.2.0 and versions earlier than 1.9.0 incorrectly validate some invalid ECDSA signatures. This could lead to acceptance of forged signatures.
Cross-site scripting vulnerability in MolecularFaces before 0.3.0 allows a remote attacker to execute arbitrary JavaScript in the victim's browser via crafted molfiles.