CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.08)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Permission control vulnerability in the file management module. Successful exploitation of this vulnerability may affect service confidentiality.
Identity authentication bypass vulnerability in the Gallery app. Successful exploitation of this vulnerability may affect service confidentiality.
Permission control vulnerability in the file management module. Successful exploitation may affect service confidentiality.
The Nextend Social Login and Register plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 3.1.21. This is due to missing or incorrect nonce validation on the 'unlinkUser' function, allowing unauthenticated attackers to unlink a user's social login via a forged request if they can trick a site administrator into performing an action like clicking a link.
Configuration defect vulnerability in the file management module. Successful exploitation may affect app data confidentiality and integrity.
A denial of service (DoS) vulnerability exists in the office service. Successful exploitation of this vulnerability may affect availability.
Permission control vulnerability in the Notepad module. Successful exploitation may affect service confidentiality.
Permission control vulnerability in the Wi-Fi module. Successful exploitation may affect service confidentiality.
Permission control vulnerability in the App Lock module. Successful exploitation may affect availability.
Permission control vulnerability in the startup recovery module. Successful exploitation will affect availability and confidentiality.
A use-after-free (UAF) vulnerability exists in the screen recording framework module. Successful exploitation of this vulnerability may affect availability.
Permission control vulnerability in the print module. Successful exploitation may affect service confidentiality.
An issue was discovered in Logpoint before 7.7.0. Sensitive information is exposed in System Processes for an extended period during high CPU load.
Improper Input Validation vulnerability in CyberArk Secure Web Sessions Extension on Chrome, Edge allows Denial of Service when trying to start new SWS sessions. This issue affects CyberArk Secure Web Sessions Extension before 2.2.30305.
An IDOR vulnerability in classroomio 0.1.13 allows students to access sensitive admin/teacher endpoints by manipulating course IDs in URLs, resulting in temporary unauthorized disclosure of sensitive course, admin, and student data before the system reverts to normal access restrictions.
A stored cross-site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via crafted SVG cover images.
A stored cross-site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via crafted SVG profile pictures.
Multiple SQL injection vulnerabilities were discovered in SIGB PMB version 8.0.1.14 in the /opac_css/ajax_selector.php component. The flaws exist in the id and datas parameters.
The Perfect Brands for WooCommerce plugin for WordPress in versions up to and including 3.6.2 is vulnerable to time-based SQL Injection via the `brands` attribute of the `products` shortcode. This is due to insufficient escaping of the user-supplied parameter and lack of sufficient preparation on the existing SQL query.
A vulnerability in Blurams Lumi Security Camera (A31C) firmware v23.1227.472.2926 allows a local physical attacker to execute arbitrary code by overwriting the bootloader on the SD card.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS