CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.11)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CVE-2026-39804 vulnerability in mtrudel bandit allows for remote denial of service via memory exhaustion when permessage-deflate compression is enabled in WebSocket. An unauthenticated attacker can send a specially crafted frame, leading to an out-of-memory kill.
A weakness has been identified in itsourcecode Courier Management System 1.0, affecting an unknown function of the file /edit_staff.php. Manipulating the ID argument can lead to SQL injection.
A vulnerability was identified in the eyal-gor p_69_branch_monkey_mcp library that allows remote command injection through manipulation of the dev_script argument in the advanced.py file. Exploitation of this vulnerability is possible due to publicly available exploits.
A stack overflow was discovered in the 'Main' function of flipperzero-firmware commit ad2a80.
An issue in the DirectIo64.sys component of PassMark BurnInTest v11.0 Build 1011, OSForensics v11.1 Build 1007, and PerformanceTest v11.1 Build 1004 allows attackers to access kernel memory and escalate privileges via a crafted IOCTL 0x8011E044 call.
An off-by-one out-of-bounds write vulnerability in the bgp_flowspec_op_decode() function of FRRouting (FRR) stable/10.0 allows attackers to cause a Denial of Service (DoS) via a crafted FlowSpec component.
Version 3.0.1 of the Eprosima Micro-XREC-DDS Agent has an issue that allows a remote attacker to cause a denial of service by sending a packet with an invalid value in any Boolean field.
An issue in Eprosima Micro-XREC-DDS Agent v.3.0.1 allows a remote attacker to cause a denial of service via a crafted packet to the MTU length field.
AGL agl-service-can-low-level contains a stack buffer overflow in the uds-c library. The send_diagnostic_request function allocates a 6-byte stack buffer but copies up to 7 bytes, leading to controlled buffer overflow.
CVE-2026-42469 describes a buffer overflow vulnerability in Open Vehicle Monitoring System 3 (OVMS3) version 3.3.005. The parser in canformat_canswitch.cpp does not properly validate a CANswitch DLC value, allowing remote attackers to cause a denial of service or potentially execute arbitrary code via crafted CANswitch frames.
CVE-2026-42468 describes a buffer overflow vulnerability in Open Vehicle Monitoring System 3 (OVMS3) version 3.3.005. The phdr.len field in the parser in canformat_pcap.cpp is not properly validated, allowing remote attackers to cause a denial of service or potentially execute arbitrary code via crafted PCAP input.
An issue was discovered in Open-SAE-J1939 that leads to denial of service via crafted CAN frames on the J1939 bus. This issue was identified in commit b6caf884df46435e539b1ecbf92b6c29b345bdfe on November 30, 2025.
OpenAMP w wersji v2025.10.0 zawiera podatność na przepełnienie całkowite w analizie obrazów firmware. W pliku elf_loader.c następuje mnożenie dwóch wartości 16-bitowych kontrolowanych przez atakującego z nagłówka ELF bez sprawdzania przepełnienia.
CVE-2026-37538 describes a buffer overflow vulnerability in socketcand version 0.4.2, in the file socketcand.c in the main function. Attackers can exploit this vulnerability to cause a denial of service or other unspecified impacts via crafted bus_name.
The collin80/Open-SAE-J1939 project has an integer underflow issue leading to out-of-bounds write in Transport Protocol Data Transfer handling. This occurs when the sequence number from the CAN frame is 0, causing the index to underflow.
The miaofng/uds-c code contains a stack buffer overflow in the send_diagnostic_request function. The issue arises because a 6-byte buffer receives data that can exceed its size by 4 bytes due to a lack of bounds checking on the payload length.
openxc/isotp-c up to commit 5a5d19245f65189202719321facd49ce6f5d46ac contains an out-of-bounds read in the ISO-TP Single Frame receive handler, where the 4-bit payload length nibble is used directly without validation. A malicious CAN frame with an oversized length nibble can lead to memory reads beyond the buffer.
AGL agl-service-can-low-level up to version 17.1.12 contains a heap buffer over-read in the isotp-c library. The issue arises when extracting payload length from a CAN frame, potentially leading to reading data beyond the allocated buffer.
AGL agl-service-can-low-level up to version 17.1.12 contains a stack buffer overflow in the uds-c library. The send_diagnostic_request function allocates a 6-byte stack buffer but copies up to 7 bytes, leading to controlled buffer overflow.
A vulnerability in AGL app-framework-binder (afb-daemon) allows local processes to execute privileged supervision commands without authentication. The on_supervision_call function in src/afb-supervision.c dispatches eight commands without credential verification.