CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
OpenC3 COSMOS w wersjach od 5.0.0 do 6.10.1 zawiera krytyczną podatność na zdalne wykonanie kodu, dostępną przez API JSON-RPC. Atakujący może wykorzystać nieautoryzowane żądania do wykonania kodu Ruby, mimo że żądanie kończy się niepowodzeniem autoryzacji (401).
Deserializacja nieufnych danych w Microsoft Office SharePoint umożliwia nieautoryzowanemu atakującemu wykonanie kodu w sieci.
Fortinet FortiSIEM versions 7.4.0, 7.3.0-7.3.4, 7.1.0-7.1.8, 7.0.0-7.0.4, and 6.7.0-6.7.10 contain an OS command injection vulnerability. An attacker can execute unauthorized code or commands via crafted TCP requests.
W podatności CVE-2025-47855 w Fortinet FortiFone w wersjach 7.0.0 do 7.0.1 oraz 3.0.13 do 3.0.23 występuje ujawnienie wrażliwych informacji osobom nieuprawnionym. Atakujący bez uwierzytelnienia może uzyskać konfigurację urządzenia za pomocą spreparowanych żądań HTTP lub HTTPS.
Intermediate register values of secure workloads can be exfiltrated in workloads scheduled from applications running in the non-secure environment of a platform.
A bug in the Linux kernel's STMMAC driver causes a crash when executing XDP_TX action in zero copy mode. The issue is due to missing memory type check of the XDP buffer before use, leading to invalid mappings and system panic.
In the Linux kernel e1000 driver, an out-of-bounds (OOB) read vulnerability was found in e1000_tbi_should_accept(). The issue occurs when the descriptor-reported frame length is zero or exceeds the RX buffer size, causing a read beyond allocated memory and potentially crashing the system.
In the Linux kernel svcrdma component, svc_rdma_copy_inline_range did not verify that the rc_curpage index stays within the allocated page array, potentially causing out-of-bounds read/write.
phpgurukul News Portal Project V4.1 has a File Upload Vulnerability via upload.php, which enables the upload of files of any format to the server without identity authentication.
phpgurukul News Portal Project V4.1 is vulnerable to SQL Injection in check_availablity.php.
phpgurukul News Portal Project V4.1 has an Arbitrary File Deletion Vulnerability in remove_file.php. The parameter file can cause any file to be deleted.
In the Linux kernel, the ksmbd module has a use-after-free vulnerability during concurrent tree-connection disconnection. The tcon object is freed on one path while another path still holds a reference.
In the Linux kernel svcrdma, svc_rdma_copy_inline_range uses rc_curpage (page index) instead of rc_pageoff (byte offset) for memcpy, causing copies to land outside the current page.
In the Linux kernel, a data race on the m_flags field in the ksmbd vfs_cache structure was found. Some functions read and modify this field without proper locking, potentially causing loss of delete-on-close state or inconsistency.
In the Linux kernel iomap, iomap_adjust_read_range() assumes block-aligned positions and lengths, which is not always true (e.g., in erofs). This causes skipping too many bytes for uptodate blocks, leading to incorrect read position and length.
In the Linux kernel net/handshake, duplicate handshake cancellations cause a socket leak. When a second cancellation arrives, remove_pending() returns false, but the socket reference count is still decremented, leading to underflow.
An arbitrary file upload vulnerability in the /utils/uploadFile component of Hubert Imoveis e Administracao Ltda Hub v2.0 1.27.3 allows attackers to execute arbitrary code by uploading a crafted PDF file.
W Eclipse Che che-machine-exec znaleziono lukę, która umożliwia nieautoryzowane zdalne wykonywanie dowolnych poleceń oraz wyciek sekretów (kluczy SSH, tokenów itp.) z kontenerów Developer Workspace innych użytkowników. Luka ta jest dostępna poprzez nieautoryzowane API JSON-RPC / websocket na porcie TCP 3333.
OS command injection vulnerability in Vivotek cameras. Improper neutralization of special elements in a command allows an attacker to execute arbitrary OS commands.
W przeglądarce Firefox 146 oraz kliencie pocztowym Thunderbird 146 występują błędy związane z bezpieczeństwem pamięci. Niektóre z tych błędów wykazywały oznaki uszkodzenia pamięci i istnieje przypuszczenie, że przy odpowiednim wysiłku mogłyby zostać wykorzystane do uruchomienia dowolnego kodu.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS