CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.05)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Version 3.4.4 of October CMS contains a vulnerability that allows arbitrary file uploads, enabling attackers to execute arbitrary code via a crafted file.
Netdisco before v2.063000 was found to contain an open redirect vulnerability. An attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users into clicking on crafted links.
Netdisco before v2.063000 was found to contain a cross-site scripting (XSS) vulnerability via the component /Web/TypeAhead.pm.
A buffer overflow in SumatraPDF Reader v3.4.6 allows attackers to cause a Denial of Service (DoS) via a crafted text file.
A cross-site request forgery vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information.
Access control bypass vulnerability in the SolarWinds platform that allows an underprivileged user to read arbitrary resources.
The Bazaar Plugin in Jenkins versions 1.22 and earlier has a cross-site request forgery (CSRF) vulnerability that allows attackers to delete previously created Bazaar SCM tags.
Jenkins Chef Identity Plugin version 2.0.3 and earlier does not mask the user.pem key form field, increasing the risk of attackers observing and capturing it.
The Qualys Web App Scanning Connector plugin for Jenkins, version 2.0.10 and earlier, has incorrect permission checks that allow attackers with global Item/Configure permission to connect to an attacker-specified URL using attacker-specified credential IDs obtained through another method.
The GitLab Authentication Plugin for Jenkins versions 1.17.1 and earlier contains a cross-site request forgery (CSRF) vulnerability that allows attackers to trick users into logging into the attacker's account.
The Gradle Plugin for Jenkins version 2.8 has an always-incorrect control flow implementation that may result in credentials not being masked (i.e., not replaced with asterisks) in the build log under certain circumstances.
Jenkins versions 2.415 and earlier, and LTS 2.401.2 and earlier do not sanitize or properly encode URLs in build logs when transforming them into hyperlinks, resulting in a stored XSS vulnerability exploitable by attackers able to control build log contents.
The Space plugin in JetBrains IntelliJ IDEA before version 2023.2 was requesting excessive permissions.
emlog version 2.1.9 is vulnerable to arbitrary file deletion via admin emplate.php.
There is an FPE vulnerability in paddle.trace in PaddlePaddle before version 2.5.0, which can lead to runtime crashes and denial of service.
A null pointer dereference in paddle.flip in PaddlePaddle before version 2.5.0 results in a runtime crash and denial of service.
A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 SP1 Update 1 allows a remote unauthenticated attacker to potentially obtain access to an ePO administrator's session by convincing the authenticated ePO administrator to click on a carefully crafted link.
In Directus, from version 10.3.0 to 10.5.0, permission filters are not properly checked when using GraphQL subscriptions. This leads to unauthorized users receiving events they should not have access to.
TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to version 3.0.7.1, TDengine DataBase crashes on UDF nested query.
The copyparty file server software prior to version 1.8.7 contains a reflected XSS vulnerability via URL parameters `?k304=...` and `?setck=...`. This can lead to moving or deleting existing files on the server, as well as uploading new files using the account of the person who clicks the malicious link.