CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.10)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Memory safety bugs were found in Firefox ESR 115.35.1, Firefox ESR 140.10.1, and Firefox 150.0.1. Some of these bugs showed evidence of memory corruption, which could potentially be exploited to run arbitrary code.
A use-after-free vulnerability was found in the DOM: Networking component of Firefox and Thunderbird. The flaw was fixed in Firefox 150.0.2, Firefox ESR 140.10.2, Firefox ESR 115.35.2, Thunderbird 150.0.2, and Thunderbird 140.10.2.
CVE-2026-6002 describes an improper neutralization of Script-Related HTML tags in web pages, leading to basic XSS vulnerabilities in DivvyDrive. The issue affects DivvyDrive versions from 4.8.2.9 before 4.8.3.2.
DivvyDrive has a 'cross-site scripting' (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects versions from 4.8.2.9 before 4.8.3.2.
In version 4.4.0 of GoBGP, an unauthenticated remote BGP peer can trigger a fatal panic by sending a specially crafted BGP UPDATE message. This bug causes the entire GoBGP process to crash, resulting in a complete loss of service availability.
A flaw in GnuTLS causes servers configured with RSA-PSK to incorrectly match usernames containing a NUL character with truncated usernames. A remote attacker can bypass authentication by sending a crafted username.
In the monetr application, prior to version 1.12.5, there was a server-side request forgery (SSRF) vulnerability in the Lunch Flow integration. This allowed any authenticated user on a self-hosted instance to send HTTP GET requests to arbitrary URLs, resulting in the response body from non-200 upstream responses being reflected back in the API error messages.
GoBGP, an open source implementation of the BGP protocol in Go, prior to version 4.3.0 has a remote Denial of Service (DoS) vulnerability. A malformed BGP UPDATE message can trigger a runtime error related to an index out of range.
In version 4.3.0 of GoBGP, an open source BGP implementation, a remote Denial of Service (DoS) vulnerability exists due to a nil pointer dereference. A malformed BGP UPDATE message containing an unrecognized Path Attribute marked as 'Well-known' leads to a process crash.
CVE-2026-3953 describes improper neutralization of input during web page generation, leading to Cross-Site Scripting (XSS) vulnerabilities in Proticaret E-Commerce software. The issue affects versions from 5.0.0 before 6.0.1767.1383.
Lack of user input validation in the file upload functionality of Open Notebook v1.8.3 allows the application user to create or modify files on the docker container via path traversal.
Open Notebook version 1.8.1 has improper input validation and an overly permissive default CORS configuration, allowing a remote attacker to trick a legitimate user into altering or deleting arbitrary database entries via a specially crafted malicious URL.
The vulnerability in the external sharing feature in Cryptobox allows an attacker knowing a sharing link URL to retrieve information from the server, enabling an offline brute-force attack on the access code associated with this sharing link.
CVE-2025-68060 describes an improper neutralization of special elements used in SQL commands, allowing for Blind SQL Injection attacks in the WPMart Team Member module.
A remote code execution vulnerability in Hitachi Storage Navigator and the maintenance console in various models of Hitachi Virtual Storage Platform. This affects models G130, G150, G350, G370, G700, G900, F350, F370, F700, F900, as well as E390, E590, E790, E990, E1090, and others.
A low privileged remote attacker can gain the root password due to improper removal of sensitive information before storage or transfer.
Out-of-bounds write vulnerability in LibreOffice due to crafted OOXML documents with mismatched encryption salt parameters.
CVE-2025-9661 describes an OS command injection vulnerability in the management GUI (maintenance utility) of Hitachi Virtual Storage Platform One Block 23, 24, 26, and 28.
The WP-Optimize plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the unscheduled_original_file_deletion function in all versions up to and including 4.5.2. This allows authenticated attackers with author-level access and above to delete arbitrary files on the server.
The Slider Revolution plugin for WordPress is vulnerable to Arbitrary File Upload in versions 7.0.0 to 7.0.10 due to insufficient file type validation. This allows authenticated attackers with subscriber-level access and above to upload potentially executable files.