CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In version 13.0.50.20220805-git of GNU gdb (GDB), a heap buffer overflow was discovered in the function pe_as16() in the file /gdb/coff-pe-read.c.
In version 13.0.50.20220805-git of GNU gdb (GDB), a heap use after free vulnerability was discovered in the add_pe_exported_sym() function in /gdb/coff-pe-read.c.
In version 13.0.50.20220805-git, GNU gdb (GDB) was found to contain a stack overflow in the ada_decode function in /gdb/ada-lang.c.
Contao is an open source content management system. In versions from 4.0.0 to 4.9.42, 4.13.28, and 5.1.10, untrusted backend users can inject malicious code into headline fields, which will be executed both in the element preview and on the website.
A vulnerability in Envoy that causes the application to crash when the `origin` header is removed between `decodeHeaders` and `encodeHeaders`. Versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12 contain a fix for this issue.
In Envoy, prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, gRPC access loggers using listener's global scope can cause a `use-after-free` crash when the listener is drained. Versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12 have a fix for this issue.
Tuleap prior to version 14.10.99.4 (Community Edition) and prior to versions 14.10-2 and 14.9-5 (Enterprise Edition) improperly handles content displayed in card fields, which may allow a malicious user to execute uncontrolled code.
A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to cause a 4 byte out-of-bounds read of XFRMA_MTIMER_THRESH when parsing netlink attributes, leading to potential leakage of sensitive heap data to userspace.
A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in xfrm_update_ae_params(), leading to a possible kernel crash and denial of service.
The Apache Felix Healthcheck Webconsole Plugin version 2.0.2 and prior contains a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation.
In JetBrains TeamCity versions before 2023.05.2, it was possible to perform an XSS attack via GitHub integration.
In JetBrains TeamCity versions before 2023.05.2, a ReDoS attack was possible via integration with issue trackers.
In JetBrains TeamCity before version 2023.05.2, a token with limited permissions could be used to gain full account access.
Strapi, an open-source content management system, prior to version 4.10.8 allowed anyone to make content-type attributes public without realizing it. This vulnerability could lead to sensitive information being exposed as users might unknowingly remove the privateAttributes protection mechanism.
The MaxButtons plugin versions up to 9.5.3 contain a Cross-Site Scripting (XSS) vulnerability for users with contributor permissions and above. An attacker can exploit this flaw to inject malicious JavaScript code.
The GrandSlambert Login Configurator plugin versions <= 2.1 has a stored Cross-Site Scripting (XSS) vulnerability with authentication (admin+).
An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project, leading to resources that are unconstrained by the user's quota.
Username enumeration is possible through Bypassing CAPTCHA in On-premise SureMDM Solution on Windows deployment allows attacker to enumerate local user information via error message.
The 'Exposure of Resource to Wrong Sphere' vulnerability in Apache InLong (versions 1.4.0 to 1.7.0) allows an attacker to use general users to delete and update processes that should only be operable by admins.
A critical vulnerability has been found in Campcodes Beauty Salon Management System version 1.0. Manipulation of the contactno argument in the /admin/edit-accepted-appointment.php file leads to SQL injection, which can be exploited remotely.