CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Wersje Apache Log4j2 od 2.0-alpha1 do 2.16.0 (z wyjątkiem 2.12.3 i 2.3.1) nie chroniły przed niekontrolowaną rekurencją w przypadku samoodwołujących się wyszukiwań. Umożliwia to atakującemu, który ma kontrolę nad danymi w Thread Context Map, spowodowanie odmowy usługi podczas interpretacji spreparowanego ciągu.
An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless."
In unix_scm_to_skb of af_unix.c, there is a possible use-after-free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed.
Visual Studio Code Spoofing Vulnerability
Verint Workforce Optimization (WFO) version 15.2.8.10048 is vulnerable to Cross-Site Scripting (XSS) via the NEWUINAV parameter in the control/my_notifications endpoint. An attacker can inject malicious JavaScript code that executes in the victim's browser.
A cross-site scripting (XSS) vulnerability was found in Genesys Workforce Management 8.5.214.20 during record deletion via the Time-off parameter. An attacker can inject a malicious script that executes in the victim's browser.
A cross-site scripting (XSS) vulnerability was found in LimeSurvey 3.6.2+180406 in the theme.php controller. Attackers can inject arbitrary web script or HTML via the changes_cp parameter in requests to the index.php/admin/themes/sa/templatesavechanges URI.
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API.
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.
A vulnerability in Bundler versions before 2.2.33 allows arbitrary code execution when processing untrusted Gemfile. If a Gemfile contains a git dependency with a URL starting with a dash (e.g., '-u./payload'), Bundler may interpret it as a git clone option, leading to code execution.
A Cross Site Scripting (XSS) vulnerability exists in the redirect module of Racktables version 0.21.2. An attacker can inject arbitrary web script or HTML via the op parameter.
An issue was discovered in Mahavitaran android application 7.50 and below, allowing local attackers to read cleartext username and password while the user is logged into the application.
Chamilo LMS version 1.11.14 is affected by a Cross Site Scripting (XSS) vulnerability in /plugin/jcapture/applet.php. An attacker can exploit this by passing a hex2bin encoded message in the cookie.
Remote code execution vulnerability in Microsoft Edge (Chromium-based).
Elevation of Privilege Vulnerability in Windows 10 Update Assistant. An attacker could gain elevated privileges.
Elevation of Privilege vulnerability in Windows 10 Update Assistant. An attacker could exploit it to gain elevated privileges on the system.
Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page.
The Video Lessons Manager WordPress plugin before 1.7.2 and Video Lessons Manager Pro WordPress plugin before 3.5.9 do not properly sanitize and escape values when updating their settings, which could allow high privilege users to perform Cross-Site Scripting attacks.
Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
Insufficient control flow management in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS