CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.10)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In BentoPDF, prior to version 2.8.3, a cross-site scripting (XSS) vulnerability was identified. An attacker could execute arbitrary JavaScript under certain circumstances in the Markdown to PDF Tool.
A hidden, persistent backdoor was found in Yarbo firmware v2.3.9 that provides remote, unauthenticated (or weakly authenticated) access to privileged functionality. The backdoor is undocumented, cannot be disabled via user-facing settings, and survives factory reset and ordinary firmware updates.
Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to enroll a device belonging to a restricted set of unenrolled devices, leading to information disclosure about EPMM appliance and impacting on the integrity of the newly enrolled device identity.
An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to achieve remote code execution.
An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to invoke arbitrary methods.
Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 has improper certificate validation, allowing a remote unauthenticated attacker to impersonate registered Sentry hosts and obtain valid CA-signed client certificates.
An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote authenticated attacker to gain administrative access.
The youtube-regex npm package through version 1.0.5 has a Regular Expression Denial of Service (ReDoS) vulnerability.
Daptin prior to version 0.11.5 has a vulnerability in the processFuzzySearch function that allows SQL injection through improper handling of the column parameter. Users can access the entire database by using the fuzzy operator in API queries.
A flaw in gnutls causes permitted name constraints to be incorrectly ignored when previous CAs only had excluded name constraints. A remote attacker can bypass critical name constraint checks during certificate validation.
Wallos is an open-source, self-hostable personal subscription tracker. In versions 4.8.4 and prior, the incomplete SSRF fix in Wallos validates webhook URLs via gethostbyname() but passes the original hostname to cURL without CURLOPT_RESOLVE pinning on 10 of 11 outbound HTTP endpoints, leaving a DNS rebinding TOCTOU window.
Weblate is a web-based localization tool. Prior to version 5.17.1, an authenticated user with project.add permissions could import a crafted project backup ZIP containing an attacker-chosen repo URL, potentially leading to data exposure.
RELATE, a web-based courseware package, was vulnerable to predictable token generation in the make_sign_in_key() and gen_ticket_code() functions. This issue has been patched via commit 2f68e16.
Daptin is a headless CMS based on GraphQL/JSON-API. In versions prior to 0.11.4, the /aggregate/:typename endpoint accepted column and group query parameters that were passed without validation, allowing authenticated users to inject arbitrary SQL expressions.
NPM package node-ts-ocr version 1.0.15 is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js.
Bricks Builder has a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through 1.9.2 to 2.2.
Dagster, a data orchestration platform, had a vulnerability in versions prior to 1.13.1 for Dagster Core and 0.29.1 for Dagster libraries. I/O managers like DuckDB, Snowflake, BigQuery, and DeltaLake improperly interpolated dynamic partition key values into SQL queries, potentially allowing arbitrary SQL injection.
The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) exposes Android Debug Bridge (ADB) on TCP port 5555 without requiring authentication. Additionally, a functional su binary exists that grants root privileges without authentication.
DivvyDrive has a vulnerability related to improperly controlled modification of dynamically-determined object attributes, leading to excessive resource allocation and potential flooding.
Memory safety bugs were present in Firefox 150.0.1, showing evidence of memory corruption. With enough effort, some could have been exploited to run arbitrary code. The vulnerability was fixed in Firefox 150.0.2 and Thunderbird 150.0.2.