CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The H.245 protocol dissector in Wireshark versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 can crash, leading to a denial-of-service condition.
The Kerberos protocol dissector in Wireshark versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 can crash, leading to a denial-of-service condition.
The Bluetooth HFP Profile protocol dissector in Wireshark versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 can crash, leading to a denial-of-service condition.
The Bluetooth BR/EDR FHS protocol dissector in Wireshark versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 can crash, leading to a denial-of-service condition.
The CMS protocol dissector in Wireshark versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 can crash, leading to a denial-of-service condition.
The 3gpp phone log file parser in versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 can crash, leading to denial of service.
The ESS protocol dissector in versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 can crash, leading to denial of service.
The SSH protocol dissector in versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 can crash, leading to denial of service.
The Bluetooth AVRCP Profile protocol dissector in versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 can crash, leading to denial of service.
The UMTS FP protocol dissector in versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 can crash, leading to denial of service.
The Catapult DCT2000 file parser in versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 can crash, leading to denial of service.
The Bluetooth Attribute Protocol dissector in versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 can crash, leading to denial of service.
The CMS protocol dissector in versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 can crash, leading to denial of service.
In Splunk On-Call (VictorOps) app versions below 1.0.43 on Splunkbase, a user without the "admin" or "power" Splunk roles could read a partially masked API key from the App Key Value Store (KV Store). This is possible because the app does not fully mask the API key before storing it in a KV Store collection that the user can read.
In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect REST API could configure timestamp extraction with a crafted regular expression and matching event data to block a Kafka Connect worker thread, stopping event delivery for the affected connector. The vulnerability is possible because timestamp extraction evaluates customer-supplied regular expressions without a time limit.
In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect REST API and influence responses from an HTTP Event Collector endpoint in Splunk Enterprise could cause the connector to retry failed event batches until event delivery stops. The vulnerability is possible because HTTP Event Collector delivery retry handling uses an unbounded default for failed batches instead of a finite retry limit.
In Splunk AI Toolkit versions below 6.0.1, a user who does not hold the "admin" or "power" Splunk roles could delete the experiment history of another user without permission through the REST API. The vulnerability is possible because Splunk AI Toolkit deletes experiment history before it verifies that the user can delete the associated experiment.
In Splunk AI Toolkit versions below 6.0.0, a user who can upload models could overwrite a model being uploaded by another user by sending a concurrent upload request for the same model name, causing the resulting model lookup entry to reference attacker-controlled content. The race condition is possible because Splunk AI Toolkit does not verify that the uploaded content belongs to the request that creates the model lookup entry.
In Splunk AI Toolkit versions below 6.0.0, a user who does not hold the "admin" or "power" Splunk roles could obtain predictable or default credentials for connected container services. The use of hard-coded credentials is possible because Splunk AI Toolkit generates or stores credentials for connected container services using predictable or hard-coded default values.
In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, an unauthenticated user could access the add-on OpenAPI specification through Splunk Web static file paths. The exposed specification could allow for reconnaissance of the add-on REST API endpoints and authentication model.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS