CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.03)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A flaw in JBoss Enterprise Application Platform (EAP) and EC2 Amazon Machine Image (AMI) involves incorrect permissions (755) for the /var/cache/jboss-ec2-eap/ directory, allowing a local user to read sensitive files. This can lead to information disclosure, specifically exposing AWS credentials.
expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function. This allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue.
A remote code execution vulnerability exists in the way the WinVerifyTrust function handles Windows Authenticode signature verification for portable executable (PE) files. An attacker could modify an existing signed executable to add malicious code without invalidating the signature. Microsoft does not plan to enforce stricter verification by default — it requires manually setting the EnableCertPaddingCheck registry key.
Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev. E1) allow remote authenticated users to inject arbitrary web script or HTML via various parameters in CGI files, such as ntpServer1, username, TodUrlAdd, appName, fltName, rmLst, groupName, snmpRoCommunity, PolicyName, ippName, smbNetBiosName, smbDirName, wlSsid.
Microsoft Silverlight 5 before 5.1.20913.0 does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silverlight application, aka "Silverlight Vulnerability."
A cross-site scripting (XSS) vulnerability in devform.php in Tenable SecurityCenter 4.6 through 4.7 allows remote attackers to inject arbitrary web script or HTML via the message parameter.
The FormAuthenticator in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships between authentication requirements and sessions, allowing remote attackers to inject a request into a session by sending this request during completion of the login form. This is a variant of a session fixation attack.
Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding. This allows remote attackers to cause a denial of service by streaming data.
Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.
A flaw in OpenStack Keystone allows a remote attacker to send a large HTTP request with a long tenant name when requesting a token, leading to excessive CPU and memory consumption and denial of service.
A flaw in PackStack allows a local user to modify deployed systems by changing the answer file, which is created in insecure directories such as /tmp or the current working directory. This insecure file creation could lead to unauthorized system modifications.
A flaw was found in OpenStack Glance. Remote authenticated users can exploit this vulnerability by requesting a cached image when the single-tenant Swift or S3 store is in use. This action causes the system to report the location field, which can lead to the disclosure of the operator's backend credentials.
The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.
A flaw in the puppetlabs-cinder module as used in PackStack is due to incorrect world-readable permissions on the cinder.conf and api-paste.ini configuration files. A local user can read these files, leading to disclosure of OpenStack administrative passwords.
Mechanizm uwierzytelniania hasłem serwera WWW używany przez produkty jest podatny na ataki typu MitM oraz Replay. Skuteczne wykorzystanie tej podatności umożliwia nieautoryzowany dostęp do serwera WWW produktu, co pozwala na przeglądanie i modyfikowanie informacji o konfiguracji i diagnostyce produktu.
A flaw in Pulp as used in Red Hat CloudForms allows a local user to read the administrative password due to world-readable permissions on the pulp.conf configuration file. This information disclosure could enable unauthorized access to sensitive system credentials.
OpenStack Compute (Nova) Folsom before 2012.2.2 and Grizzly, when using libvirt and LVM backed instances, does not properly clear physical volume (PV) content when reallocating for instances, which allows attackers to obtain sensitive information by reading the memory of the previous logical volume (LV).
The CsrfPreventionFilter in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.
A flaw was found in OpenStack Keystone. This vulnerability allows remote authenticated users to bypass intended authorization restrictions. This occurs because OpenStack Keystone does not properly handle EC2 tokens when a user's role has been removed from a tenant. An attacker can leverage a token associated with a removed user role to gain unauthorized access.
Apache Tomcat through 7.0.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS