CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.11)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
OpenHarness prior to commit dd1d235 contains a command injection vulnerability that allows remote gateway users with chat access to invoke sensitive administrative commands by exploiting insufficient distinction between local-only and remote-safe commands in the gateway handler. Attackers can execute administrative commands such as /permissions full_auto through remote chat sessions to change permission modes of a running OpenHarness instance without operator authorization.
The vulnerability in TP-Link Archer C7 v5 and v5.8 (uhttpd modules) related to inadequate encryption strength allows for password recovery exploitation. The web interface encrypts the admin password client-side using RSA-1024 before sending it to the router during login.
Free5GC to projekt open-source dla sieci rdzeniowych 5G. W wersjach 4.2.1 i niższych występuje podatność na ujawnienie informacji w usłudze UDR, która pozwala na uzyskanie identyfikatorów subskrybentów przez nieautoryzowanych atakujących.
maddy to modułowy, kompleksowy serwer pocztowy. W wersjach przed 0.9.3 występuje podatność na wstrzykiwanie LDAP w module auth.ldap, gdzie dostarczone przez użytkownika nazwy użytkowników są interpolowane w filtrach wyszukiwania LDAP i ciągach DN bez odpowiedniego zabezpieczenia, co umożliwia atakującym manipulację wynikami autoryzacji.
OWASP BLT prior to version 2.1.1 contains an RCE vulnerability in the .github/workflows/regenerate-migrations.yml workflow. It uses the pull_request_target trigger, allowing malicious code execution in the CI environment with full GITHUB_TOKEN permissions.
Pillow versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation).
Composer versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::syncCodeBase() and Perforce::generateP4Command() methods. An attacker can inject arbitrary commands through crafted source reference or source url values containing shell metacharacters, even if Perforce is not installed.
Command injection vulnerability in the Perforce::generateP4Command() method in Composer, a dependency manager for PHP. An attacker can inject arbitrary commands through Perforce connection parameters (port, user, client) in a malicious composer.json, leading to command execution in the context of the user running Composer.
Wersje Barracuda RMM przed 2025.2.2 zawierają podatność na eskalację uprawnień, która pozwala lokalnym atakującym uzyskać uprawnienia na poziomie SYSTEM, wykorzystując zbyt liberalne ACL systemu plików w katalogu C:\Windows\Automation. Atakujący mogą modyfikować istniejące treści automatyzacji lub umieszczać kontrolowane przez siebie pliki w tym katalogu, które są następnie wykonywane pod kontem NT AUTHORITY\SYSTEM podczas rutynowych cykli automatyzacji.
A buffer overflow vulnerability was found in GIMP's `ReadJeffsImage` function when loading GIF files. Processing a specially crafted GIF file can cause a write beyond the allocated buffer.
Type Confusion in V8 in Google Chrome prior to version 147.0.7727.101 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.
Heap buffer overflow in PDFium in Google Chrome on Windows prior to version 147.0.7727.101 allows a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code inside a sandbox via a crafted PDF file.
Use after free in FileSystem in Google Chrome prior to version 147.0.7727.101 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page.
W Google Chrome na systemie Windows przed wersją 147.0.7727.101 wystąpiła podatność typu use after free w module wideo, która pozwalała zdalnemu atakującemu, który przejął proces renderowania, na dostęp do pamięci poza przydzielonym zakresem za pomocą spreparowanej strony HTML.
A use after free vulnerability in XR in Google Chrome on Android prior to version 147.0.7727.101 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
A use after free vulnerability in Payments in Google Chrome on Android prior to version 147.0.7727.101 allowed a remote attacker to execute arbitrary code by convincing a user to perform specific UI gestures on a crafted HTML page.
Use after free in Codecs in Google Chrome prior to version 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
In Google Chrome prior to version 147.0.7727.101, there was a use after free vulnerability in the Cast component that allowed a remote attacker to execute arbitrary code via a crafted HTML page.
A use after free vulnerability in Forms in Google Chrome prior to version 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
A use after free vulnerability in Permissions in Google Chrome on Android prior to version 147.0.7727.101 allowed a remote attacker to execute arbitrary code by convincing a user to perform specific UI gestures on a crafted HTML page.