CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
MySQL MCP Server prior to 0.4.2, when MCP_TRANSPORT=sse is set, constructs SseServerTransport without security settings or DNS rebinding protection, while the /, /sse, and /messages/ routes have no authentication and the service binds to 0.0.0.0 by default. A network attacker can directly reach execute_sql or use DNS rebinding to gain unauthorized access to the database. The issue is fixed in 0.4.2.
Conflibot prior to 1.2.1 builds git checkout, git merge, and git format-patch commands by interpolating the attacker-controlled pull request head.ref value into strings passed to exec. In the documented pull_request_target configuration, an attacker can open a pull request whose branch name contains shell metacharacters that are executed without maintainer interaction. The issue is fixed in versions 1.2.1 and 2.0.0.
OpenDJ prior to 5.1.1 processes attacker-controlled credential objects in the JMX RMI connector before authentication without a restrictive credentials filter pattern, and RmiAuthenticator accepts an unconstrained Object array rather than a two-element String[]. When the JMX Connection Handler is enabled and reachable, an unauthenticated remote attacker can submit a crafted serialized Java object and achieve code execution. The issue is fixed in 5.1.1.
Ghostscript before 10.08.0 contains a heap-based buffer overflow in the JPEG 2000 output adapter (base/sjpx_openjpeg.c). An attacker can cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. The issue is fixed in version 10.08.0.
On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file from a stored path. A malicious guest can replace a parent directory with a symlink, escape the shared workspace, and read or modify arbitrary host files as the VMM user, potentially achieving host code execution.
Mitigation bypass vulnerability in the Widget: Win32 component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Sandbox escape vulnerability due to incorrect boundary conditions in the Widget: Win32 component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Sandbox escape in the Profile Backup component of Firefox and Thunderbird. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
Incorrect boundary conditions in the Security: Process Sandboxing component. Fixed in Firefox 156 and Thunderbird 156.
Incorrect boundary conditions in the DOM: Editor component, which could lead to unexpected behavior or security bypass. Fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Mitigation bypass vulnerability in the Enterprise Policies component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Spoofing issue due to invalid pointer in the Graphics component. Fixed in Firefox 156 and Thunderbird 156.
Sandbox escape due to a race condition in the XPConnect component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
Sandbox escape vulnerability due to incorrect boundary conditions in the Widget: Win32 component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Sandbox escape vulnerability due to incorrect boundary conditions in the WebRTC component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Mitigation bypass vulnerability in the DOM: Networking component of Firefox and Thunderbird. The flaw was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Mitigation bypass vulnerability in the Remote Settings Client component of Firefox and Thunderbird. The flaw was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
Incorrect boundary conditions in the DOM: Animation component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
Incorrect boundary conditions in the Networking: HTTP component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS