CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In QianFox FoxCMS up to version 1.2.6, a vulnerability was found in the Edit function of Admin.php, allowing manipulation of the password recovery process. The attack can be performed remotely, and the exploit is publicly available.
Tanium addressed a denial of service vulnerability in Tanium Server. The issue could lead to server disruption.
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress up to version 1.6.11.5 is vulnerable to DoS. A publicly accessible REST API endpoint (/wp-json/ssa/v1/async) calls PHP's sleep() with a user-supplied delay parameter without rate limiting, allowing unauthenticated attackers to exhaust PHP worker processes.
The Style Kits plugin for WordPress up to version 2.5.0 has a Stored XSS vulnerability via the kit title parameter in the '/wp-json/agwp/v1/tokens/save' endpoint. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript that executes whenever a user visits an infected page.
In OpenStack Swift before 2.36.2 and 2.37.2, the s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body. The StreamingInput class repeatedly appends an empty buffer and re-reads, causing the proxy-server worker to become permanently unresponsive with increasing CPU and memory consumption. An authenticated attacker can exhaust all proxy-server workers, resulting in denial of service. The defect was introduced in Swift 2.36.0.
In itsourcecode Courier Management System 1.0, an unknown function in the file /parcel_list.php is vulnerable to SQL Injection via manipulation of the argument s. The attack can be performed remotely, and the exploit has been made public.
GitHub Enterprise Server before versions 3.20.3, 3.19.7, 3.18.10, 3.17.16, and 3.16.19 has an SSRF vulnerability in the security advisories package lookup feature. An attacker can direct requests to internal services and infer sensitive environment variables, including signing secrets and private keys, via response timing.
In JeecgBoot up to version 3.9.1, a vulnerability in the AiragModelController component allows improper access controls via manipulation of list/queryById arguments. The attack can be executed remotely, and the exploit is public. Fixed in version 3.9.2.
The Crypt::ScryptKDF library for Perl up to version 0.010 uses an insecure random number source (rand()) when no CSPRNG modules are available. The random_bytes function falls back to the built-in rand(), weakening cryptography.
Vulnerability in Mojolicious::Plugin::Statsd for Perl up to version 0.04 allowed metric injections. Metric names and set values were not checked for newlines, colons or pipes. Metrics from untrusted sources could inject additional statsd metrics.
A vulnerability was found in SourceCodester eDoc Doctor Appointment System 1.0 in the file /admin/delete-session.php. Manipulation of the ID argument leads to missing authorization. Remote attack is possible and the exploit has been publicly disclosed.
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP Host request header was not validated before being used to reconstruct request.url. Because the routing algorithm relies on the raw HTTP path while request.url is rebuilt from the Host header, a malformed header could make request.url.path differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on request.url (rather than the raw scope path) could therefore be bypassed.
Prometheus from version 2.49.0 to before 3.5.3 and 3.11.3 contains an XSS vulnerability in the legacy web UI (enabled via --enable-feature=old-ui). In the histogram heatmap chart view, 'le' label values are not properly escaped, allowing an attacker to inject JavaScript via crafted metrics.
SharpCompress 0.47.4 and earlier has a path traversal vulnerability in IArchive.WriteToDirectory(). A malicious archive can create directories outside the extraction root. For TAR archives, this can be escalated to arbitrary file writes via symlinks.
The OpenTelemetry.Exporter.Instana NuGet package prior to version 1.1.0 does not validate HTTPS/TLS certificates when sending telemetry to a configured Instana backend via a proxy defined by the INSTANA_ENDPOINT_PROXY environment variable. A network attacker capable of Man-in-the-Middle (MitM) attacks on the proxy connection can intercept all OpenTelemetry telemetry data and the Instana API key.
An off-by-one error in gnutls in PKCS#12 bag element bounds check. A remote attacker can write past the internal array when the bag already contains 32 elements, causing memory corruption and potential DoS.
A logic issue was addressed with improved restrictions in macOS Tahoe 26. This issue allowed an app to access sensitive user data.
macOS Tahoe 26 addresses an out-of-bounds read issue with improved bounds checking. An app may cause unexpected system termination.
In macOS Tahoe 26, vulnerable code was removed to address a permissions issue that could allow an app to access sensitive user data.
A permissions issue in macOS Sequoia 15.7, Sonoma 14.8, and Tahoe 26. An app may be able to modify protected parts of the file system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS