CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.08)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A race condition was addressed with additional validation. This issue affects multiple Apple systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) and may allow an app to access sensitive user data.
Improved checks in macOS prevent an attacker with physical access to a locked device from viewing sensitive user information.
A vulnerability in Safari and Apple systems, fixed with improved data protection. An app may be able to access sensitive user data.
A use-after-free issue was addressed with improved memory management in Safari and macOS Tahoe. The problem is fixed in Safari 26.5 and macOS Tahoe 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.
A use-after-free vulnerability was addressed with improved memory management in Safari. The issue is fixed in Safari 26.5, iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5.
Improved file handling in macOS prevents a maliciously crafted ZIP archive from bypassing Gatekeeper checks.
A vulnerability in WebKit allows a process crash when processing maliciously crafted web content. The issue was addressed with improved memory handling.
A vulnerability in WebKit allows a process crash when processing maliciously crafted web content. The issue was addressed with improved memory handling.
A vulnerability in WebKit allows a process crash when processing maliciously crafted web content. The issue was addressed with improved memory handling.
An authorization issue was addressed with improved state management. Fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, and macOS Tahoe 26.4. An app may be able to access sensitive user data.
The vulnerability in Summarize versions through 0.14.1 (fixed in commit 0cfb0fb) creates the daemon configuration directory and file with default filesystem permissions that may be world-readable on Unix-like systems, allowing local attackers to read bearer tokens and API credentials stored in ~/.summarize/daemon.json.
In Sonatype Nexus Repository versions 3.6.0 through before 3.92.0, an authenticated user with upload permission to a hosted repository can store content that causes arbitrary JavaScript execution in the browser of any user browsing that repository directory via the HTML index page. This could allow the attacker to perform actions in the context of the victim's session.
A heap-based out-of-bounds read vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.
Bitwarden Server prior to v2026.4.1 contains a missing authorization vulnerability that allows any authenticated user to write ciphers into an arbitrary organization via POST /ciphers/import-organization by submitting an empty collections array, which causes the server-side permission check to be skipped.
A Cross-Site Scripting (XSS) vulnerability has been discovered in IoTGateway version 3.0.1 within the Log Record Function. This allows a remote attacker to execute arbitrary JavaScript code in the victim's browser.
W Casdoorze występuje podatność na zapis dowolnych plików w dostawcy lokalnego systemu plików. Z powodu niewystarczającej sanitizacji ścieżek, uwierzytelniony atakujący z uprawnieniami administratora może przeprowadzić atak typu Path Traversal, aby tworzyć lub nadpisywać dowolne pliki w systemie plików hosta.
Corteza contains a SQL injection vulnerability in its Microsoft SQL Server (MSSQL) backend when filtering Compose records by the meta field. This issue affects corteza: 2024.9.8.
The WebDyne::Session library for Perl before version 3.003_704 generates session IDs insecurely. IDs are created using the rand() function and MD5 hash, making them predictable and unsuitable for cryptographic purposes.
In Zephyr, sockets created with `IPPROTO_TLS_1_3` can negotiate a TLS 1.2 connection when both TLS versions are enabled in Kconfig, because the socket-level protocol selection is not propagated to mbedTLS. Applications assuming `IPPROTO_TLS_1_3` enforces TLS 1.3 may silently use TLS 1.2 and remain exposed to TLS 1.2-specific weaknesses.
Open5GS up to version 2.7.7 has a vulnerability in the OpenAPI_list_create function of the SMF component, leading to denial of service (DoS). The attack can be remote. Exploit has been disclosed.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS