CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A stack-based buffer overflow vulnerability exists in Fireware OS's WireGuard configuration processing. A remote attacker with man-in-the-middle TLS-decrypted access between the Firebox and WatchGuard Cloud can create a denial of service condition and potentially execute arbitrary code by tampering with a FireCloud Gateway configuration payload.
Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and Linkind Wi-Fi Smart Light Bulb 3.30.17 are vulnerable to Remote Code Execution (RCE) via UPnP root description parsing. The vulnerability allows an attacker to execute arbitrary code on the device.
nest-admin before 1.0.1 contains an authentication bypass that lets unauthenticated attackers forge administrator tokens using a hardcoded JWT_SECRET committed in .env.production. Attackers can sign tokens with the known secret trusted by JwtStrategy and RbacGuard, impersonating any user ID or claiming the admin role.
NVIDIA NeMo Agent Toolkit contains a missing authentication vulnerability that an attacker could exploit. This may lead to code execution, privilege escalation, data tampering, denial of service, and information disclosure.
In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth client secret or the Controller bootstrap admin password, and supply the access token the operator stores for later Controller API calls.
@fastify/express is a Fastify plugin that runs Express middleware inside Fastify. In versions 4.0.5 through 4.0.8, when Fastify runs with the non-default ignoreDuplicateSlashes option enabled, the plugin matches path-scoped Express middleware against a URL whose duplicate-slash normalization has also collapsed the separator after an absolute-form request target's scheme, so Fastify's router resolves the request to the scoped path and runs the handler while the Express layer no longer sees that path.
REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for accounts like admin, gaining backend access and code execution outside live mode.
Out-of-bounds write vulnerability in Hitachi JP1 products. It affects JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 (Manager, Agent, Agent Minimal Edition), and JP1/Base in specific versions. The flaw can cause memory corruption due to writing beyond buffer boundaries.
Heap-based buffer overflow vulnerability in Hitachi JP1 products. It affects JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 (Manager, Agent, Agent Minimal Edition), and JP1/Base in specified version ranges. The flaw can corrupt heap memory.
Stack-based buffer overflow vulnerability in Hitachi JP1 products. It affects JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 (Manager, Agent, Agent Minimal Edition), and JP1/Base in specific versions. The flaw can corrupt stack memory and potentially lead to code execution.
Heap-based buffer overflow vulnerability in Hitachi JP1/Base. It affects versions from 11-00 before 12-50-54. The flaw can corrupt heap memory.
Stack-based buffer overflow vulnerability in Hitachi HiRDB. It affects HiRDB Server Version 10 (from 10-00 before 10-12-01) and HiRDB Server Version 9 and additional-function variants in specified version ranges. The flaw can corrupt stack memory.
Heap-based buffer overflow vulnerability in Hitachi HiRDB. It affects HiRDB Server Version 10 (from 10-00 before 10-12-01) and HiRDB Server Version 9 and additional-function variants in specified version ranges. The flaw can corrupt heap memory.
OS command injection vulnerability in Hitachi HiRDB. It affects HiRDB Server Version 10 (from 10-00 before 10-12-01) and HiRDB Server Version 9 and additional-function variants in specified version ranges. The flaw may allow execution of arbitrary commands on the system.
Stack-based buffer overflow vulnerability in Hitachi HiRDB. It affects HiRDB Server Version 10 (from 10-00 before 10-12-01) and HiRDB Server Version 9 and additional-function variants in specified version ranges. The flaw can corrupt stack memory.
Authentication bypass by spoofing vulnerability in Hitachi HiRDB. It affects HiRDB Server Version 10 (from 10-00 before 10-12-01) and HiRDB Server Version 9 and additional-function variants in specified version ranges. The flaw may allow unauthorized access.
Missing authentication for critical function vulnerability in Hitachi HiRDB. It affects HiRDB Server Version 10 (from 10-00 before 10-12-01) and HiRDB Server Version 9 and additional-function variants in specified version ranges. The flaw may allow access to critical functions without authentication.
Heap-based buffer overflow vulnerability in JP1/Automatic Job Management System 3. Affects Manager and Agent components from version 11-00 before 13-50-31.
Authentication bypass vulnerability in JP1/Automatic Job Management System 3. Affects the Manager component from version 10-00 before 13-50-31.
Heap-based buffer overflow vulnerability in JP1/Automatic Job Management System 3. Affects the Manager component from version 10-00 before 13-50-31.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS