CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SQL Injection vulnerability in PrinterLogic Web Stack versions 19.1.1.13 SP9 and below allows an attacker to inject malicious SQL code, potentially gaining unauthorized access to additional audit records.
A reflected XSS vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the search_term parameter in the modules/Scheduling/Courses.php script.
A potential arbitrary file deletion vulnerability has been identified in HP Support Assistant software. The vulnerability could be exploited by an attacker to delete files on the victim's system.
A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755
The Apache Xerces Java (XercesJ) XML parser in version 2.12.1 and earlier is vulnerable to an infinite loop when handling specially crafted XML document payloads. This may cause the parser to wait indefinitely, potentially consuming system resources for a prolonged duration.
A race condition was found in the Linux kernel's ebpf verifier between bpf_map_update_elem and bpf_map_freeze due to a missing lock in kernel/bpf/syscall.c. In this flaw, a local user with a special privilege (cap_sys_admin or cap_bpf) can modify the frozen mapped address space. This flaw affects kernel versions prior to 5.16 rc2.
node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor. The vulnerability allows leakage of data that should be restricted.
GCC v12.0 was discovered to contain an uncontrolled recursion via the component libiberty/rust-demangle.c. This vulnerability allows attackers to cause a Denial of Service (DoS) by consuming excessive CPU and memory resources.
vim is vulnerable to a heap-based buffer overflow. Technical details are not provided in the description.
Reprise License Manager 14.2 is affected by a reflected XSS vulnerability in the 'count' parameter of the /goform/activate_process endpoint. No authentication is required.
W wersji 1.4.0 Trusted Firmware-M (TF-M) przy użyciu profilu Small występuje nieprawidłowa kontrola dostępu. NSPE może uzyskać dostęp do zabezpieczonego klucza (przechowywanego przez usługę Crypto) jedynie na podstawie znajomości jego identyfikatora klucza.
An improper check or handling of exceptional conditions in the NPU driver allows arbitrary memory write and code execution.
The Serv-U web login screen for LDAP authentication allowed characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization.
Fluxbb version 1.4.12 is affected by a Cross Site Scripting (XSS) vulnerability. This allows an attacker to inject malicious JavaScript code into pages viewed by other users.
An information exposure issue has been discovered in Opmantek Open-AudIT 4.2.0. The vulnerability allows an authenticated attacker to read files outside of the restricted directory.
Ghostscript GhostPDL 9.50 through 9.54.0 has a heap-based buffer overflow in sampled_data_finish (called from sampled_data_continue and interp). This may lead to a crash or arbitrary code execution.
Wersje Apache Log4j2 od 2.0-beta7 do 2.17.0 (z wyłączeniem poprawek bezpieczeństwa 2.3.2 i 2.12.4) są podatne na atak zdalnego wykonania kodu (RCE) przy użyciu konfiguracji z JDBC Appender i źródłem danych JNDI LDAP, gdy atakujący ma kontrolę nad docelowym serwerem LDAP. Problem został rozwiązany poprzez ograniczenie nazw źródeł danych JNDI do protokołu java w wersjach Log4j2 2.17.1, 2.12.4 i 2.3.2.
A cross-site scripting (XSS) vulnerability was found in S-CMS Government Station Building System v5.0 in the /function/booksave.php file. It allows an attacker to inject malicious client-side scripts.
A cross-site scripting (XSS) vulnerability was found in the search function of S-CMS Government Station Building System v5.0. It allows injection of malicious JavaScript code into the page.
An Invalid Pointer vulnerability exists in GNU patch 2.7 via the another_hunk function, which causes a Denial of Service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS