CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.11)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Devices ZTE H8102E, H168N, H167A, H199A, H288A, H198A, H267A, H267N, H268A, H388X, H196A, H369A, H268N, H208N, H367N, H181A, and H196Q are vulnerable to an unauthenticated DoS attack. This can be triggered by sending an oversized application/x-www-form-urlencoded POST body, causing the management interface to become unresponsive until the device is rebooted.
HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation. This could allow unauthorized users to gain elevated privileges, bypassing intended access restrictions.
In Mistune versions 3.0.0a1 through 3.2.0, a ReDoS vulnerability exists in the `LINK_TITLE_RE` regular expression. Overlapping alternatives in the regex can cause catastrophic backtracking, leading to high CPU consumption and denial of service when processing crafted Markdown input.
A SQL injection vulnerability exists in Rucio versions 1.30.0 and later before 35.8.5, 38.5.5, 39.4.2, and 40.1.1 in `FilterEngine.create_postgres_query()`. This allows any authenticated Rucio user to execute arbitrary SQL against the PostgreSQL metadata database through the DID search endpoint.
Wersja 1.2.0 i wcześniejsze NanoClaw zawierają podatność na naruszenie granicy systemu plików hosta/kontenera w obsłudze załączników wychodzących oraz czyszczeniu skrzynki wychodzącej. Umożliwia to złośliwemu kontenerowi odczyt plików poza zamierzonym katalogiem skrzynki wychodzącej.
gopls by default communicates via pipe, but supports -port and -listen flags for debugging. Using -listen without an explicit host or using -port causes gopls to listen on 0.0.0.0, potentially exposing the service unintentionally.
A SQL injection vulnerability in the `FilterEngine.create_sqla_query()` method allows authenticated Rucio users to execute arbitrary SQL against the backend database through the DID search endpoint. In Oracle deployments, attacker-controlled filter keys and values are interpolated directly into `sqlalchemy.text()`, bypassing parameterization.
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, potentially leading to server crashes, out-of-memory exceptions, or excessive CPU usage.
An Uncontrolled Search Path Element vulnerability in JohnsonControls AC2000 on Windows allows Leveraging/Manipulating Configuration File Search Paths. This issue affects AC2000: from 10.6 before release 10, from 11.0 before release 9, from 12 before release 3.
A vulnerability in the SNMP protocol in Cisco 350 and 350X switches could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The issue is due to improper error handling when parsing response data for a specific SNMP request.
A vulnerability in the web-based management interface of Cisco IoT Field Network Director could allow an authenticated, remote attacker with low privileges to cause a DoS condition on a remotely managed router. This is due to improper error handling. An attacker could exploit this by submitting crafted input, causing the router to reload and resulting in a DoS.
A vulnerability in the web UI of Cisco Unity Connection Web Inbox allows an unauthenticated, remote attacker to conduct SSRF attacks. It is due to improper input validation for specific HTTP requests.
A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to execute arbitrary code on an affected device. The issue is due to insufficient validation of user-supplied input.
Uncontrolled search path element vulnerability in WatchGuard Agent on Windows allows using malicious files.
Use of hard-coded cryptographic key vulnerability in WatchGuard Agent on Windows allows inclusion of code in existing process.
The MongoDB C Driver's Cyrus SASL integration performs unsafe string copying during username canonicalization, enabling a heap buffer overflow before any authentication or network traffic.
Incorrect permission assignment for a resource in the patch management component of the WatchGuard Agent on Windows allows an authenticated local user to elevate their privileges to NT AUTHORITY\SYSTEM.
Gazelle versions through 0.49 for Perl allows HTTP Request Smuggling due to improper header precedence.
A type confusion vulnerability in Qt SVG allows an attacker to cause an application crash via a crafted SVG image. The issue occurs when processing SVG marker references, where the renderer does not verify the node type before casting.
W jądrze systemu Linux zidentyfikowano podatność, która pozwala na dostęp poza granice w funkcji fw_mbox_index_xlate(). Problem występuje, gdy w drzewie urządzeń zdefiniowano `#mbox-cells = <0>;`, co może prowadzić do niekontrolowanego dostępu, jeśli nie są dostarczone wskaźniki funkcji `fw_xlate` i `of_xlate`.