CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The issue was addressed with improved checks. Processing a 3D model may result in disclosure of process memory.
A logic issue was identified in macOS that could allow apps to access user-sensitive data. This issue is fixed in macOS Monterey 12.6.8, macOS Ventura 13.5, and macOS Big Sur 11.7.9.
The issue was addressed with improved checks. Processing a 3D model may result in disclosure of process memory.
The issue involves the potential for an app to modify sensitive kernel state. It has been addressed with improved state management in Apple operating systems.
The issue was addressed with improved checks. Processing web content may disclose sensitive information.
A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This issue is fixed in macOS Ventura 13.5.
This issue was addressed with improved data protection. An app may be able to modify protected parts of the file system.
Yasm v1.3.0.78 is prone to NULL Pointer Dereference in /libyasm/intnum.c and /elf/elf.c. An attacker can exploit this vulnerability to cause a denial of service via a crafted file.
Version 3.4.4 of October CMS contains a vulnerability that allows arbitrary file uploads, enabling attackers to execute arbitrary code via a crafted file.
Netdisco before v2.063000 was found to contain an open redirect vulnerability. An attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users into clicking on crafted links.
Netdisco before v2.063000 was found to contain a cross-site scripting (XSS) vulnerability via the component /Web/TypeAhead.pm.
A buffer overflow in SumatraPDF Reader v3.4.6 allows attackers to cause a Denial of Service (DoS) via a crafted text file.
A cross-site request forgery vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information.
Access control bypass vulnerability in the SolarWinds platform that allows an underprivileged user to read arbitrary resources.
The Bazaar Plugin in Jenkins versions 1.22 and earlier has a cross-site request forgery (CSRF) vulnerability that allows attackers to delete previously created Bazaar SCM tags.
Jenkins Chef Identity Plugin version 2.0.3 and earlier does not mask the user.pem key form field, increasing the risk of attackers observing and capturing it.
The Qualys Web App Scanning Connector plugin for Jenkins, version 2.0.10 and earlier, has incorrect permission checks that allow attackers with global Item/Configure permission to connect to an attacker-specified URL using attacker-specified credential IDs obtained through another method.
The GitLab Authentication Plugin for Jenkins versions 1.17.1 and earlier contains a cross-site request forgery (CSRF) vulnerability that allows attackers to trick users into logging into the attacker's account.
The Gradle Plugin for Jenkins version 2.8 has an always-incorrect control flow implementation that may result in credentials not being masked (i.e., not replaced with asterisks) in the build log under certain circumstances.
Jenkins versions 2.415 and earlier, and LTS 2.401.2 and earlier do not sanitize or properly encode URLs in build logs when transforming them into hyperlinks, resulting in a stored XSS vulnerability exploitable by attackers able to control build log contents.