CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Insecure permissions in Splashin iOS v2.0 allow unauthorized attackers to access location data for specific users.
Splashin iOS app version 2.0 fails to enforce server-side interval restrictions for location updates for free-tier users.
Podatność CVE-2024-13175 dotyczy oprogramowania Vidco Software VOC TESTER, które przed wersją 12.41.0 pozwala na ominięcie autoryzacji poprzez klucz kontrolowany przez użytkownika, co umożliwia wymuszone przeglądanie.
A Cross Site Scripting (XSS) vulnerability in Beakon Learning Management System (SCORM) version V.5.4.3 allows a remote attacker to inject malicious script via the URL parameter. This flaw can be exploited to steal sensitive information.
A vulnerability in a subset of REST APIs of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) allows an authenticated, low-privileged attacker to perform a blind SQL injection attack. The issue is due to insufficient validation of user-supplied input.
Vulnerability in Oracle Siebel CRM End User product (component: User Interface) in versions 25.0-25.5. It can be exploited remotely by an unauthenticated attacker via HTTP, leading to unauthorized read access to a subset of data.
A SQL injection vulnerability was discovered in SemCms v5.0 via the lgid parameter in SEMCMS_Products.php. An attacker can manipulate this parameter to execute unauthorized database queries.
A SQL injection vulnerability was discovered in SemCms v5.0 via the ID parameter in SEMCMS_Products.php. An attacker can manipulate this parameter to execute unauthorized database queries.
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter in SEMCMS_InquiryView.php. An attacker can manipulate this parameter to execute unauthorized database queries.
A SQL injection vulnerability was discovered in SemCms v5.0 via the lgid parameter in SEMCMS_Link.php. Attackers can manipulate this parameter to execute unauthorized database queries.
A SQL injection vulnerability was discovered in SemCms v5.0 via the ID parameter in SEMCMS_Link.php. An attacker can manipulate this parameter to execute unauthorized database queries.
A SQL injection vulnerability was discovered in SemCms v5.0 via the pid parameter in SEMCMS_Quanxian.php. Attackers can manipulate this parameter to execute unauthorized database queries.
A SQL injection vulnerability was discovered in SemCms v5.0 via the pid parameter in SEMCMS_Infocategories.php. Attackers can manipulate this parameter to execute unauthorized database queries.
A SQL injection vulnerability was discovered in SemCms v5.0 via the pid parameter in SEMCMS_ct.php. Attackers can exploit this flaw to execute unauthorized database queries.
A SQL injection vulnerability was discovered in SemCms v5.0 via the pid parameter in SEMCMS_Categories.php. An attacker can manipulate this parameter to execute unauthorized database queries.
A flaw was found in polkit where an out-of-bounds write can occur when processing an XML policy with 32 or more nested elements. This can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded.
Produkty Emerson ValveLink przyjmują dane wejściowe, ale nie weryfikują lub błędnie weryfikują, czy te dane mają wymagane właściwości do bezpiecznego i poprawnego przetwarzania.
loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.
A NULL pointer dereference flaw was found in the GnuTLS library in the _gnutls_figure_common_ciphersuite() function.
An XSS vulnerability in the Admin Login page of Allworx System Software v9.1.9.12 allows attackers to inject arbitrary web scripts or HTML via the SessionID parameter in query.asp.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS