CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A permissions issue was addressed with additional restrictions. An app may be able to access sensitive user data.
A buffer overflow vulnerability in Apple systems, fixed with improved bounds checking. An app may cause a denial of service.
An integer overflow vulnerability in Apple systems, fixed with improved input validation. Processing a maliciously crafted file may disclose process memory.
Concrete CMS versions 9.0.0 to 9.5.2 stored the Page Container icon value submitted through the dashboard without validating it against the set of known container icons. The unvalidated value was later concatenated into the src attribute of an img tag by a helper that did not encode attribute output, and was rendered raw in the Containers dashboard list and editor views. A user with delegated access to the Page Containers dashboard could store a crafted icon value that broke out of the src attribute and executed script in the authenticated session of another editor or administrator who viewed the list, enabling session token theft and privileged dashboard actions. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.0 with vector CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks Andrew Gonzalez for reporting.
IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 allows a non-privileged user to edit their given name and surname to include malicious JavaScript code. When an administrator later accesses the user account management panel and views that user's permissions, the malicious JavaScript code is executed. This could result in the cookies from the administrator being compromised.
IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow a remote authenticated attacker to perform UI spoofing and phishing attacks due to improper neutralization of user-supplied HTML markup.
IBM Sterling Secure Proxy versions 6.2.0.0 through 6.2.1.2 could allow a remote authenticated attacker to view administrative user interface components due to client-side authorization bypass.
An integer overflow vulnerability in Apple systems, fixed with improved input validation. An app may cause a denial of service.
A null pointer dereference vulnerability in Apple systems, fixed with improved input validation. Processing web content may lead to a denial-of-service.
A path handling issue in Apple systems, fixed with improved validation. An app may be able to modify protected parts of the file system.
A type confusion issue in Apple systems, fixed with improved memory handling. An app may cause a denial of service.
An integer overflow vulnerability in Apple systems, fixed with improved input validation. An app may cause unexpected system termination.
A use after free issue in Apple systems, fixed with improved memory management. An app may cause unexpected system termination.
A logic issue was addressed with improved validation. The vulnerability affects iOS, iPadOS, macOS, tvOS, and visionOS. An app may be able to access sensitive user data.
A memory initialization issue was addressed with improved memory handling. The vulnerability affects iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. An app may be able to determine kernel memory layout.
An authorization issue was addressed with improved state management. The vulnerability affects iOS, iPadOS, and macOS. A malicious application may be able to bypass Privacy preferences.
This issue was addressed with improved checks. The vulnerability affects iOS, iPadOS, macOS, visionOS, and watchOS. An app may be able to access sensitive user data.
A use after free issue was addressed with improved memory management. The vulnerability affects iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. An app may be able to cause unexpected system termination.
A race condition was addressed with improved state handling. The vulnerability affects macOS Golden Gate 27 and macOS Tahoe 26.7. An app may be able to cause unexpected system termination.
A file quarantine bypass was addressed with additional checks. The vulnerability affects iOS, iPadOS, macOS, visionOS, and watchOS. An archive may be able to bypass Gatekeeper.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS