CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in Peplink InControl 2 up to version 2.14.2 before 2026-06-03 allows bypassing access-control rules for certain /rest/o/{orgId} endpoints by using a semicolon.
A vulnerability in Apache Kerby allows bypassing the Kerberos pre-authentication check by sending a PA-DATA with an unrecognized or unsupported type. The issue is fixed in version 2.1.2.
An OS Command Injection vulnerability in Dell Container Storage Modules (csi-powerstore, csi-unity, csi-powerflex, csi-powermax version 2.16.0) allows a high-privileged attacker with remote access to execute arbitrary operating system commands.
A path traversal vulnerability has been discovered in Apache IoTDB, allowing access to files outside the restricted directory. The issue affects versions from 1.0.0 to 1.3.5 and from 2.0.0 to 2.0.6.
A Path Traversal vulnerability has been discovered in Apache IoTDB, allowing bypass of file path restrictions. The issue affects versions from 2.0.0 before 2.0.6 and from 1.0.0 before 1.3.6.
Sending a deeply nested ASN1 structure to an Apache Kerby client or service can trigger a StackOverFlow exception, leading to denial of service (DoS).
The Exclusive Addons Elementor plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. The flaw affects all versions up to and including 2.7.9.8.
A vulnerability in libnfs up to version 6.0.2 before commit 935b8db causes an integer underflow in the xid field in the READ_IOVEC function in lib/socket.c. The issue occurs when connecting to a crafted NFS server, where the expected PDU size exceeds the absolute PDU size from the xid/record-marker.
A vulnerability in Johnson & Johnson Audit Tracking Management System (ATMS) before April 21, 2026 allows unauthorized viewing of meeting minutes and transcripts.
The vulnerability in Johnson & Johnson Campus Recruiting before October 31, 2025 allows unauthorized viewing of data provided by recruited students and notes entered about students by interviewers.
A vulnerability in the netclient and factory services of Reolink Home Hub (versions prior to v3.3.0.456_26031911) allows brute-force credential cracking. Attackers on the same local network can intercept traffic between the Hub and cameras and compromise camera credentials.
A Code Injection vulnerability in Trellix Network Security CM and NX allows a locally authenticated admin user to execute arbitrary code using the web interface and Alert artifact details.
A vulnerability in jupyter/nbconvert versions up to 7.17.0 allows Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exports. The `data_mermaid` block in `share/templates/lab/base.html.j2` renders `text/vnd.mermaid` cell output directly into HTML without escaping, enabling attackers to inject arbitrary HTML/JavaScript by breaking out of the `<pre>` tag.
The User Registration & Membership plugin for WordPress up to version 5.2.0 contains a vulnerability due to missing validation in the confirm_payment() function. This allows unauthenticated attackers to bypass payment processing and activate paid memberships.
The Bytes::Random::Secure::Tiny library for Perl (versions up to 1.011) shares internal PRNG state across forked processes. If an object is initialized before forking, all child processes produce identical random streams.
The vulnerability in the Bytes::Random::Secure library for Perl up to version 0.29 causes the internal state of the PRNG to be shared across forked processes. When an object is initialized before forking or the functional interface is used, child processes produce identical random streams.
In GeoVision GV-LPC2011 and GV-LPC2211 devices version V1.12 and earlier, a stack-based buffer overflow vulnerability exists in the vlsvr component. An unauthenticated remote attacker can exploit this vulnerability by sending crafted login data with overly long input, leading to memory corruption, denial of service, or potentially remote code execution.
A stack-based buffer overflow vulnerability exists in the ssvr component of GeoVision GV-LPC2011 and GV-LPC2211 devices running version V1.12 and earlier. The issue is caused by insufficient bounds checking when parsing RTSP Digest authentication fields. An unauthenticated remote attacker can exploit this by sending a crafted RTSP request with overly long authentication data, leading to memory corruption, denial of service, or potentially arbitrary code execution.
A stack-based buffer overflow vulnerability exists in the ssvr component of GeoVision GV-LPC2011 and GV-LPC2211 devices running version V1.12 and earlier. The issue is caused by insufficient bounds checking when processing RTSP custom authentication data. An unauthenticated remote attacker can exploit this vulnerability by sending a crafted RTSP request, potentially leading to memory corruption, denial of service, or arbitrary code execution.
An unauthenticated stack-based buffer overflow vulnerability exists in thttpd in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient bounds checking when processing web request parameters in a specific request path. A remote attacker may exploit this vulnerability by sending a crafted HTTP request with overly long input, resulting in memory corruption, denial of service, or potentially arbitrary code execution.