CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.05)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Cross Site Scripting (XSS) vulnerability in Archer Platform before v.6.13, fixed in v.6.12.0.6 and v.6.13.0, allows a remote authenticated attacker to execute arbitrary code via a crafted malicious script.
A tampering vulnerability has been identified in Microsoft Edge for Android (Chromium-based) that could allow an attacker to make unauthorized changes to the application.
A vulnerability in Microsoft Edge for iOS allows spoofing, which may lead to information theft from users.
CVE-2023-36849 describes an improper check or handling of exceptional conditions vulnerability in the Layer-2 control protocols daemon (l2cpd) of Juniper Networks Junos OS. This allows an unauthenticated adjacent attacker to cause a Denial of Service (DoS) by sending malformed LLDP packets.
A vulnerability in the periodic packet management daemon (PPMD) of Juniper Networks Junos OS allows an unauthenticated adjacent attacker to cause a Denial of Service (DoS) by sending malformed CFM packets. This leads to an FPC crash, resulting in sustained denial of service when CFM is configured on the interface.
A Reachable Assertion vulnerability in Routing Protocol Daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows a locally-based, low-privileged attacker to cause a Denial of Service (DoS) by executing a specific L2VPN command.
A Use of an Uninitialized Resource vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, authenticated attacker with low privileges to cause a Denial of Service (DoS). In a Multicast only Fast Reroute (MoFRR) scenario, the rpd process can crash when a specific low privileged CLI command is executed.
CVE-2023-36834 describes an Incomplete Internal State Distinction vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX 4600 and SRX 5000 Series. An attacker can cause a Denial of Service (DoS) by sending a specific packet, leading to a loop in one of the Packet Processing Engines (PPE).
An Out-of-bounds Read vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS on SRX Series allows a local, authenticated attacker with low privileges to cause a Denial of Service (DoS). Executing a specific CLI command by a low privileged user causes flowd to crash, leading to temporary traffic interruption.
A Use After Free vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS Evolved allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS). The 'aftman-bt' process crashes after multiple flaps on a multicast-only fast reroute (MoFRR) enabled interface.
In Jami (version 20222284) by Savoir-faire Linux on Windows, there is improper input validation in hyperlink interpretation. This allows an attacker to send a custom HTML anchor tag to pass a string value to the Windows QRC Handler through the Jami messenger.
The 'nickname' field within Savoir-faire Linux's Jami application is susceptible to a failed state when a user inserts special characters into the field. When present, these special characters prevent the application from creating the user's signature, resulting in a local denial of service.
A Cross-site Scripting (XSS) vulnerability exists in the DOM context in the GitHub repository plaidweb/webmention.js prior to version 0.5.5.
Wireshark versions 4.0.0 to 4.0.6 contain a bug in the iSCSI dissector that can lead to application crashes. An attacker can exploit this via packet injection or a crafted capture file to cause denial of service.
Wireshark versions 4.0.0 to 4.0.6 and 3.6.0 to 3.6.14 contain a vulnerability that can lead to a crash of the Kafka dissector. An attacker can exploit this via packet injection or a crafted capture file to cause a denial of service.
A heap buffer overflow was discovered in the libjpeg library in the LineBitmapRequester::EncodeRegion function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted file.
A vulnerability in the libjpeg library was discovered that allows for a reachable assertion in the BitMapHook::BitMapHook method in bitmaphook.cpp. This vulnerability can be exploited by attackers to cause a Denial of Service (DoS) via a crafted file.
GLPI is a free IT asset management software that has a SQL injection vulnerability in the dashboards administration panel. An administrator can trigger this vulnerability, potentially leading to unauthorized data access.
JS7 is an open-source job scheduler that allows users to upload files containing documentation. Specifically crafted file names can enable an XSS attack that injects code executed in the browser.
CVE-2023-37849 describes a DLL hijacking vulnerability in Panda Security VPN for Windows prior to version v15.14.8, allowing attackers to execute arbitrary code by placing a crafted DLL file in the same directory as PANDAVPN.exe.