CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
NVIDIA Megatron Bridge contains a vulnerability that allows an attacker to cause deserialization of untrusted data. Successful exploitation could lead to code execution, data tampering, and information disclosure.
NVIDIA Megatron Bridge contains a vulnerability that allows an attacker to cause deserialization of untrusted data. Successful exploitation could lead to code execution, data tampering, and information disclosure.
NVIDIA Megatron Bridge contains a vulnerability that allows an attacker to cause deserialization of untrusted data. Successful exploitation could lead to code execution, data tampering, and information disclosure.
NVIDIA Megatron Bridge contains a vulnerability that allows an attacker to cause deserialization of untrusted data. Successful exploitation could lead to code execution, data tampering, and information disclosure.
NVIDIA Megatron Bridge contains a vulnerability that allows an attacker to cause deserialization of untrusted data. Successful exploitation could lead to code execution, data tampering, and information disclosure.
NVIDIA Megatron Bridge contains a vulnerability that allows an attacker to cause deserialization of untrusted data. Successful exploitation could lead to code execution, data tampering, and information disclosure.
NVIDIA Megatron Bridge contains a vulnerability that allows an attacker to cause deserialization of untrusted data. Successful exploitation could lead to code execution, data tampering, and information disclosure.
NVIDIA Megatron Bridge contains a vulnerability that allows deserialization of untrusted data. Successful exploitation could lead to code execution, data tampering, and information disclosure.
NVIDIA Megatron Bridge contains a vulnerability that allows deserialization of untrusted data. Successful exploitation could lead to code execution, data tampering, and information disclosure.
NVIDIA Megatron Bridge contains a vulnerability that allows deserialization of untrusted data. Successful exploitation could lead to code execution, data tampering, and information disclosure.
NVIDIA Megatron Bridge contains a vulnerability that allows deserialization of untrusted data. Successful exploitation could lead to code execution, data tampering, and information disclosure.
NVIDIA Megatron Bridge contains a vulnerability that allows deserialization of untrusted data. Successful exploitation could lead to code execution, data tampering, and information disclosure.
NVIDIA Megatron Bridge contains a vulnerability that allows deserialization of untrusted data. Successful exploitation could lead to code execution, data tampering, and information disclosure.
Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges.
Incorrect access control in the setElinkQosConfig function of TOTOLINK T6 (version 4.1.5cu.748_B20211015) allows unauthenticated attackers to modify privileged QoS policy on the master device via sending a crafted MQTT message to the cs_broker component.
A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage() without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only '-' characters but the internal BCP 47 scanner aliases '_' to '-' after the guard check. An unauthenticated attacker can send a crafted Accept-Language header using '_' separators to trigger quadratic-time parsing, consuming excessive CPU and denying authentication to all cluster users.
The FS-Poster plugin for WordPress is vulnerable to Remote Code Execution in versions up to and including 8.0.1. This is due to insufficient input sanitization of the FFmpeg path parameter before passing it to the exec() function, combined with missing authorization checks on the REST API endpoints. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary commands on the underlying server.
A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.
A vulnerability in Cleo Harmony up to version 5.8.1.10 affects an unknown function in the /api/connections file of the JWT Refresh Token Handler component. Manipulation of the Bearer argument leads to improper privilege management. The attack can be carried out remotely, and the exploit has been made public.
A vulnerability in Chanjet CRM up to version 20260707 affects the file jxf_dump_table.php. Manipulation of the gblOrgID argument causes SQL injection. The attack can be performed remotely, and the exploit has been published. The vendor did not respond to the disclosure.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS