CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A flaw in the interactive shell of the xmllint XML parsing tool causes overly long commands to not be properly size-checked, potentially leading to a crash. In rare configurations without modern protections, arbitrary code execution may be possible.
W GLib występuje błąd w zarządzaniu pamięcią przez GString podczas dodawania danych do ciągów. Przy dużych ciągach, połączenie ich z dodatkowymi danymi może spowodować ukryty przepełnienie w obliczeniach rozmiaru, co prowadzi do pisania danych poza przydzieloną pamięcią.
A Use-After-Free vulnerability in Qt's QHttp2ProtocolHandler in the QtNetwork module affects only HTTP/2 handling. It arises from a race condition between uploading POST request body and simultaneous handling of HTTP errors. Affects only Qt 6.9.0; fixed in Qt 6.9.1.
A vulnerability has been identified in the libarchive library, triggered when file streams are piped into bsdtar, causing an out-of-bounds read. This can lead to unpredictable program behavior, memory corruption, or denial of service.
An off-by-one vulnerability has been identified in the libarchive library when handling file name prefixes and suffixes. This flaw causes a 1-byte write overflow, potentially corrupting adjacent memory and leading to unpredictable program behavior or crashes.
An integer overflow vulnerability has been identified in the libarchive library when processing WARC files claiming more than INT64_MAX - 4 content bytes. An attacker can craft a malicious WARC archive to trigger this overflow, leading to unpredictable behavior, memory corruption, or denial of service. This affects libarchive versions prior to 3.8.0.
A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME applications and other software. The vulnerability arises when processing the expiration date of cookies, where a specially crafted value can trigger an integer overflow. This may result in undefined behavior, allowing an attacker to bypass cookie expiration logic, causing persistent or unintended cookie behavior.
A security flaw in Dígitro NGC Explorer up to 3.48.21 involves an unknown function of the Password Transmission Handler, resulting in client-side enforcement of server-side security. The attack can be initiated remotely but is difficult to exploit. Upgrading to version 3.48.22 resolves the issue.
W BusyBox w wersji do 1.37.0, w narzędziu tar, archiwum TAR może ukrywać nazwy plików w liście za pomocą sekwencji ucieczki terminala. To może prowadzić do nieświadomego ujawnienia danych lub manipulacji plikami.
A flaw was found in OpenSSL's handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may result in undefined behavior or incorrect property parsing, leading to OpenSSL treating the input as an empty string.
In Fortinet FortiOS versions 7.4.0 to 7.4.8, 7.2, 7.0, and 6.4, passwords are stored in a recoverable format. This allows an attacker to disclose information by modifying the LDAP server IP to point to a malicious server.
A flaw was found in GLib where an integer overflow and buffer under-read occur when parsing a long invalid ISO 8601 timestamp with the g_date_time_new_from_iso8601() function.
During address list folding, when a separating comma ends up on a folded line and that line is to be unicode-encoded, the separator itself is also unicode-encoded instead of remaining a plain comma. This can cause some mail servers to misinterpret the address header.
W bibliotece GNU elfutils 0.192 zidentyfikowano podatność w funkcji elf_strptr, która może prowadzić do odmowy usługi. Atak można przeprowadzić na lokalnym hoście, jednak jego złożoność jest dość wysoka, co utrudnia wykorzystanie podatności.
An out-of-bounds write in Fortinet FortiOS versions 7.6.0, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, and 6.4.0 through 6.4.15 allows an attacker to trigger a denial of service via specially crafted packets.
W podatności CVE-2024-12970 występuje niewłaściwa neutralizacja specjalnych elementów używanych w poleceniach systemu operacyjnego, co pozwala na wstrzyknięcie poleceń systemowych w aplikacji My Computer w systemie Pardus OS. Problem dotyczy wersji przed 0.7.2.
Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization. A successful exploit could allow the authenticated admin attacker to access resources that are constrained to the admin access level, and the disclosure is limited to non-sensitive system information. This vulnerability does not allow file modification or privilege escalation.
A vulnerability in Keycloak allows a user with high privileges to read sensitive information from a Vault file outside the expected context. The attacker must have prior high access to the Keycloak server, for example, to configure an LDAP provider and set up a Vault file read, which only reveals whether the file exists.
The Hathway Skyworth CM5100-511 router version 4.1.1.24 stores sensitive information about USB and Wi-Fi connected devices in plaintext. This means anyone with access to the router's storage can read this data.
The vulnerability in RELY-PCIe versions v22.2.1 to v23.1.0 fails to set the Secure attribute for sensitive cookies in HTTPS sessions. This could cause the user agent to send those cookies in cleartext over an unencrypted HTTP session.