CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CVE-2023-39268 in ArubaOS-Switch is a memory corruption vulnerability that could lead to unauthenticated remote code execution by receiving specially crafted packets. Successful exploitation allows arbitrary code execution as a privileged user on the underlying operating system.
An authenticated remote code execution vulnerability exists in ArubaOS-Switch. Successful exploitation results in a Denial-of-Service (DoS) condition in the switch.
An arbitrary file write vulnerability allows an authenticated, remote attacker with administrator privileges to alter logging variables to overwrite arbitrary files on the remote host with log data.
A pass-back vulnerability exists in the Nessus application before version 10.6.0, allowing an authenticated remote attacker with administrator privileges to uncover stored SMTP credentials.
In goauthentik, an open-source Identity Provider, affected versions with an enabled recovery flow allow an attacker to determine if a username exists. This issue only affects setups configured with a recovery flow.
OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. In versions up to 5.9.0, during the verification of Cleartext Signed Messages, any data preceding the 'Hash: ...' header was ignored, allowing attackers to add arbitrary text that could be perceived as signed.
On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error may trigger a kernel panic and cause system reload.
Version 2.11.0 of the Xmlsoft Libxml2 library was found to contain an out-of-bounds read vulnerability in the xmlSAX2StartElement() function. This allows attackers to cause a Denial of Service (DoS) by supplying a crafted XML file.
In OpenBGPD before 8.1, incorrect handling of BGP update data may cause the system to incorrectly reset a session by a potentially distant remote actor.
In Cerebrate 1.14, a vulnerability in UserSettingsController allows authenticated users to change user settings of other users.
A memory leak flaw was found in nft_set_catchall_flush in the Linux Kernel, which may allow a local attacker to cause double-deactivations of catchall elements, resulting in a memory leak.
Buffer Overflow vulnerability in Libming v.0.4.8 allows a remote attacker to cause a denial of service via a crafted .swf file to the makeswf function.
An issue was discovered in TechView LA-5570 Wireless Gateway version 1.0.19_T53, allowing physical attackers to gain escalated privileges via a telnet connection.
An issue was discovered in TECHView LA5570 Wireless Gateway version 1.0.19_T53, allowing physical attackers to gain escalated privileges via the UART interface.
In jupyter-server, improper cross-site credential checks on `/files/` URLs could allow exposure of certain file contents or accessing files when opening untrusted files. This issue has been addressed in version `2.7.2`.
The vulnerability in jupyter-server allows for an Open Redirect attack, enabling redirection of users to arbitrary sites after logging into a Jupyter server. Maliciously crafted login links can lead to unauthorized redirects.
Cross Site Scripting vulnerability in Badaso v.2.9.7 allows a remote attacker to execute arbitrary code via a crafted payload to the title parameter in the new book and edit book function.
A stored cross-site scripting (XSS) vulnerability in the Create function of Zenario CMS v9.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Menu navigation text field.
Spinnaker, an open source multi-cloud continuous delivery platform, has a logging issue where GitHub status is always logged in full. This may lead to the exposure of GitHub tokens in the logging system.
Multiple cross-site scripting (XSS) vulnerabilities in the inventory management system version 1.0 allow attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the Name, Address, and Company parameters under the Add Member section.