CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In the Linux kernel, io_pin_pages() in io_uring does not check for overflows when adding size to the user-provided address (uaddr). This can lead to errors and potential security vulnerabilities.
In the Linux kernel, if IMA appraisal is used with the "ima_appraise=log" boot param, lockdown can be defeated with kexec on any machine when Secure Boot is disabled or unavailable. IMA prevents setting "ima_appraise=log" from the boot param when Secure Boot is enabled, but this does not cover cases where lockdown is used without Secure Boot.
A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing administrative privileges to inject commands and run as a site user.
A vulnerability was found in Keycloak where the environment option `KC_CACHE_EMBEDDED_MTLS_ENABLED` does not work and the JGroups replication configuration is always used in plain text, which can allow an attacker with access to adjacent networks related to JGroups to read sensitive information.
Podatność na obejście autoryzacji poprzez klucz kontrolowany przez użytkownika w NextGeography NG Analyser umożliwia niewłaściwe wykorzystanie funkcjonalności. Problem dotyczy wersji NG Analyser przed 2.2.711.
Podatność CVE-2024-8475 dotyczy usługi Digital Operation Services WiFiBurada, która pozwala na obejście uwierzytelniania poprzez manipulację zmiennymi kontrolowanymi przez użytkownika. Problem występuje w wersjach przed 1.0.5.
Podatność CVE-2024-8429 dotyczy usługi Digital Operation Services WiFiBurada, która przed wersją 1.0.5 nieprawidłowo ogranicza nadmierne próby uwierzytelnienia, co pozwala na wykorzystanie znanych poświadczeń domenowych.
A cross-site scripting (XSS) vulnerability in Sunbird DCIM dcTrack v9.1.2 allows attackers to inject malicious scripts or HTML on certain admin screens.
An HTML injection vulnerability in Sunbird DCIM dcTrack 9.1.2 allows authenticated attackers with administrator privileges to inject arbitrary HTML code in an admin screen.
A flaw was found in the cert-manager package that allows an attacker who can modify PEM data read by cert-manager (e.g., in a Secret resource) to cause high CPU usage in the cert-manager controller pod, leading to a denial-of-service (DoS) vector for cert-manager in the cluster.
Remote code execution vulnerability in Microsoft Office. The NVD description does not provide technical details of the exploitation mechanism.
Illustrator versions 29.0.0, 28.7.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
A Cross Site Scripting (XSS) vulnerability was found in the profile.php of PHPGurukul Beauty Parlour Management System v1.1. Attackers can inject arbitrary HTML into the 'Firstname' and 'Last name' parameters, allowing remote code execution.
Podatność CVE-2024-11321 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w systemie Hi e-learning Learning Management System (LMS), co umożliwia ataki typu Reflected XSS.
A hardcoded decryption key in Thinkware Cloud APK v4.3.46 allows attackers to access sensitive data and execute arbitrary commands with elevated privileges.
In the Linux kernel, the pmdomain: imx93-blk-ctrl driver has a bug in the remove path where the check condition should be 'i < bc->onecell_data.num_domains' instead of 'bc->onecell_data.num_domains', causing an infinite loop and kernel panic. Additionally, there is an unbalanced pm_runtime_enable call.
W systemie zamówień online firmy RestApp Inc. występuje podatność związana z przepełnieniem lub owinięciem liczb całkowitych oraz niewłaściwą walidacją określonej ilości wprowadzonych danych, co umożliwia ataki typu Integer.
A SQL injection vulnerability was found in PHPGURUKUL Vehicle Parking Management System v1.13 in /users/view-detail.php. The issue affects the viewid parameter, where improper input sanitization allows attackers to inject malicious SQL queries.
In the Linux kernel on AMD Zen4 client CPUs, some SoCs advertise support for virtualized VMLOAD/VMSAVE instructions, causing random host reboots. The fix clears this capability.
A stack overflow vulnerability was discovered in the Quectel EC25-EUX module (version EC25EUXGAR08A05M1G). This flaw could allow an attacker to execute arbitrary code or cause a denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS