CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A missing permission check in Jenkins SAML Single Sign On (SSO) Plugin versions 2.1.0 through 2.3.0 allows attackers with Overall/Read permission to download a string representation of the current security realm.
A missing permission check in Jenkins Datadog Plugin 5.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Active Directory Plugin version 2.30 and earlier ignores the 'Require TLS' and 'StartTls' options, resulting in an unencrypted connection test to Active Directory servers.
The Jenkins External Monitor Job Type Plugin version 206.v9a_94ff0b_4a_10 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
An issue was discovered in Keeper Password Manager for Desktop version 16.10.2 and KeeperFill Browser Extensions version 16.5.4, allowing local attackers to gain sensitive information via plaintext password storage in memory after the user is logged in. This issue has been fixed in version 17.2.
A flaw was found in libtiff that can lead to a segmentation fault due to a buffer overflow in the Fax3Encode function. A specially crafted TIFF file can cause a denial of service.
The session restore helper crashes whenever there is no parameter sent to the message handler. This vulnerability affects Firefox for iOS versions below 115.
The vulnerability involves the permission request prompt from the background tab overlaying the site in the foreground tab. This affects Firefox for iOS versions below 115.
In JetBrains YouTrack versions before 2023.1.16597, there was an issue with improper captcha validation in Helpdesk forms.
In JetBrains TeamCity before 2023.05.1 build parameters of the 'password' type could be written to the agent log.
In JetBrains TeamCity versions before 2023.05.1, reflected XSS via the Referer header was possible during artifact downloads.
In JetBrains TeamCity versions before 2023.05.1, stored XSS was possible while viewing the build log.
In JetBrains TeamCity before 2023.05.1, build chain parameters of the 'password' type could be written to the agent log.
In JetBrains TeamCity before version 2023.05.1, it was possible to perform a stored XSS attack while running custom builds.
In JetBrains TeamCity before 2023.05.1 parameters of the 'password' type could be shown in the UI in certain composite build configurations.
In JetBrains TeamCity versions before 2023.05.1, stored XSS was possible when using a custom theme.
Apache Airflow, versions before 2.6.3, has a vulnerability where an authenticated user can use crafted input to make the current request hang.
Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows unauthorized read access to a DAG through the URL.
A NULL pointer dereference vulnerability was found in netlink_dump. This issue can occur when the Netlink socket receives the message of type XFRM_MSG_GETSA or XFRM_MSG_GETPOLICY with the DUMP flag set, potentially leading to denial of service or another unspecified impact.
In the iwnpi server, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS