CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to terminate the daemon via an NTS request with excess NTS Cookie Placeholder extension fields.
A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
A NULL pointer dereference in the gf_ac4_presentation_ch_mode function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
A flaw was fixed in the Linux kernel BPF verifier's 32-bit zero extension logic. The removal of register liveness tracking in commit 107e16979905 allowed certain verification paths to miss the zext_dst mark, potentially letting a BPF program inject an arbitrary value into the upper half of a register. The fix replaces subreg_def-based logic with static liveness analysis in bpf_compute_live_registers().
A SQL injection vulnerability was found in itsourcecode Sales-and-Inventory-System in /pages/cust_searchfrm.php via manipulation of the ID argument. The attack can be launched remotely and a public exploit is already available. The product uses a rolling release model, so specific affected versions are not provided.
A SQL injection vulnerability was found in itsourcecode Sales-and-Inventory-System in the file /pages/cust_edit.php, caused by manipulation of the ID argument. The attack can be performed remotely and a public exploit is already available.
In pypdf before 6.21.1, an attacker can craft a PDF containing image data labeled with the /DCTDecode filter that causes Pillow to select and invoke an unintended image parser when the image is loaded. Environments without the optional Pillow dependency are not affected. This is fixed in version 6.21.1.
The pfSense REST API package is an unofficial, open-source REST and GraphQL API for pfSense CE and pfSense Plus firewalls. A privilege escalation vulnerability in pfSense-pkg-RESTAPI prior to version 2.9.0 allows authenticated accounts holding the dedicated settings sync permission to modify REST API configuration secrets. This enables a non-administrative user to elevate their privileges to a full administrator.
A segmentation violation in the GetESD function (/isomedia/track.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) by supplying a crafted MP4 file.
A segmentation violation in the check_media_profile function (/mp4box/mp4box.c) of GPAC Project/MP4Box before version 2.5 allows attackers to cause a denial of service (DoS) by supplying a crafted MP4 file.
A stack overflow in the gf_bifs_dec_node function (/bifs/field_decode.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a denial of service via a crafted MP4 file.
A heap use-after-free in the dasher_flush_segment function (/filters/dasher.c) of GPAC Project/MP4Box before version 2.5 allows attackers to cause a denial of service (DoS) by supplying a crafted MP4 file.
A heap use-after-free in the gf_filter_pid_send_event_downstream function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
A segmentation violation in the gf_isom_get_esd function (/isomedia/isom_read.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file.
A use-after-free in the gf_filter_packet_destroy function (/filter_core/filter_pck.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-2 file.
A vulnerability in the Linux kernel Bluetooth ISO module has been resolved. The content of a Periodic Advertisement Report is copied to BASE only if the service UUID matches the Basic Audio Announcement Service UUID.
A vulnerability was detected in Insurance-Management-System in unknown code of `/Agent/includes/UpdatePolicyHolder-inc.php` within the Policy Holder Update Form component. Manipulation of the `Policy_no` argument results in improper authorization. The attack can be launched remotely, and the exploit is now public.
PHP has global state that temporarily points into request memory. In some scenarios, this state may not be correctly reset or may be repopulated after reset, referring to freed request memory. Subsequent requests may read or branch on this stale state before full initialization, potentially leading to remote code execution (RCE).
PHP uses longjmp() for out-of-memory (OOM) errors, which may leave request memory in an uninitialized state before allocation. Subsequent request cleanup may read or branch on this memory, and multiple OOM strategies can consistently trigger this condition, leading to remote code execution (RCE).
WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in gp_add_coordinator_standby() (named gp_add_master_standby() in WHPG 6, kept as an alias in WHPG 7). Unlike other segment add and remove functions, it does not require superuser privileges. A low-privileged user who can open a utility-mode connection can add a fake standby coordinator entry to gp_segment_configuration on a cluster with no standby configured, preventing administrators from adding a real standby until a superuser removes the fake entry. User data is not exposed or modified.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS