CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A heap-based buffer overflow vulnerability was found in the libopensc OpenPGP driver. A crafted USB device or smart card with malicious responses to APDUs during card enrollment using pkcs15-init may lead to out-of-bounds access, potentially allowing arbitrary code execution.
A vulnerability was found in the pkcs15-init tool in OpenSC. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs, leading to incorrect access to initialized parts of the buffer when buffers are partially filled with data.
A vulnerability was found in pkcs15-init in OpenSC due to insufficient or missing checking of return values of functions. An attacker could use a crafted USB device or smart card presenting specially crafted APDU responses, leading to the use of uninitialized variables.
A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK due to insufficient checking of function return values. An attacker could use a crafted USB device or smart card to present specially crafted APDU responses, leading to work with uninitialized variables.
A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK due to insufficient control of the response APDU buffer and its length during card communication. An attacker could use a crafted USB device or smart card to present specially crafted APDU responses.
In OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK, there is a missing initialization of variables that are expected to be initialized before being used as arguments to other functions. This can lead to unpredictable behavior or potential security issues.
The Base64 Encoder/Decoder WordPress plugin through version 0.9.2 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged-in admin add Stored XSS payloads via a CSRF attack.
An issue in LIEF v.0.14.1 allows a local attacker to obtain sensitive information via the 'name' parameter in the machd_reader.c component.
A potential NullPointerException was discovered in ThreeTen Backport version 1.6.8 in the compareTo method of the LocalDate class. However, multiple third parties dispute the validity of this vulnerability, suggesting the report may be based on an insufficiently robust tool.
A vulnerability was found in Quarkus. In certain conditions related to the CI process, git credentials could be inadvertently published, which could put the git repository at risk.
A race condition in Audited versions 4.0.0 through 5.3.3 can allow an authenticated user to cause audit log entries to be attributed to another user.
A SQL injection vulnerability was discovered in Gila CMS 1.15.4 and earlier. It allows a remote attacker to execute arbitrary web scripts via the 'user_id' parameter after login.
A SQL injection vulnerability in Gila CMS 1.15.4 and earlier allows a remote attacker to execute arbitrary web scripts via the ID parameter after login.
A SQL injection vulnerability was discovered in Gila CMS 1.15.4 and earlier. A remote attacker can execute arbitrary web scripts via the Area parameter under the Administration>Widget tab after login.
Vim prior to version 9.0.2121 has a heap-use-after-free vulnerability that can occur when executing the `:s` command for the first time using a sub-replace-special atom. This may lead to unsafe memory access and potential crashes of the Vim editor.
Vim is an open source command line text editor. In affected versions when shifting lines in operator pending mode and using a very large value, it may be possible to overflow the size of integer.
Vim is an open source command line text editor. When using the z= command, the user may overflow the count with values larger than MAX_INT, which may lead to a crash, although this does not happen in all situations.
Vim is an open source command line text editor that may cause an overflow when parsing relative ex addresses. The issue occurs in the existing overflow check when the line number becomes negative. The impact is low, user interaction is required.
Vim is an open source command line text editor. When getting the count for a normal mode z command, it may overflow for large counts given, which may lead to a crash, although this does not happen in all situations.
Vim is an open source command line text editor. If the count after the :s command is larger than what fits into a (signed) long variable, abort with e_value_too_large. This issue has been addressed in release version 9.0.2108.