CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A critical vulnerability was found in DedeCMS version 5.7.110, affecting unknown code in the file /uploads/tags.php. Manipulation of the argument tag_alias leads to SQL injection.
A critical vulnerability was found in the Byzoro Smart S45F Multi-Service Secure Gateway management platform up to version 20230822. The issue affects an unknown functionality of the file /importexport.php, leading to SQL injection.
A critical vulnerability was found in IBOS OA version 4.5.5, affecting unknown processing of the file ?r=dashboard/user/export&uid=X. Manipulation of this file leads to SQL injection.
A critical vulnerability has been found in IBOS OA version 4.5.5, affecting unknown code in the file ?r=diary/default/del of the Delete Logs Handler component. Manipulation of this vulnerability leads to SQL injection.
A critical vulnerability was found in IBOS OA 4.5.5, affecting an unknown part of the file ?r=email/api/delDraft&archiveId=0 of the Delete Draft Handler component. The manipulation leads to SQL injection.
A critical vulnerability has been found in the Byzoro Smart S85F Management Platform up to version 20230820. The issue affects an unknown functionality of the file /sysmanage/updateos.php, allowing unrestricted file uploads through manipulation of the argument 1_file_upload.
Incorrect certificate validation in InvokeHTTP on Apache NiFi MiNiFi C++ versions 0.13 to 0.14 allows an intermediary to present a forged certificate during TLS handshake negotiation. The Disable Peer Verification property was effectively flipped, disabling verification by default when using HTTPS.
ProVide version 14.5 by Farsight Tech Nordic AB contains multiple XSS vulnerabilities (CWE-79) that can be exploited by a user with administrator privileges.
The Exifography plugin versions up to 1.3.1 have a stored Cross-Site Scripting (XSS) vulnerability with admin authorization. An attacker can exploit this flaw to inject malicious scripts that will be executed in the victim's browser context.
The Visualmodo Borderless plugin versions up to 1.4.8 contain a stored Cross-Site Scripting (XSS) vulnerability with admin authorization. An attacker can exploit this flaw to inject malicious scripts that will execute in the context of users with admin privileges.
The Realwebcare WRC Pricing Tables plugin versions <= 2.3.7 has a stored Cross-Site Scripting (XSS) vulnerability with authentication (admin+).
The WP OnlineSupport, Essential Plugin Audio Player with Playlist Ultimate plugin versions <= 1.2.2 has a stored Cross-Site Scripting (XSS) vulnerability for users with contributor+ privileges.
The QualityUnit Post Affiliate Pro plugin versions <= 1.25.0 has a stored Cross-Site Scripting (XSS) vulnerability with authentication (admin+).
The SuiteDash Direct Login plugin in versions up to 1.7.6 has a stored Cross-Site Scripting (XSS) vulnerability with admin authorization. An attacker can exploit this flaw to inject malicious scripts that will execute in the victim's browser context.
The Elastic Email Sender plugin versions <= 1.2.6 has a stored Cross-Site Scripting (XSS) vulnerability with authentication (admin+).
A vulnerability has been identified in MXsecurity versions prior to v1.0.1 that may lead to pollution of the sqlite database and the nsm-web interface. An unauthenticated attacker could register or add devices via the nsm-web application.
The Font Awesome 4 Menus plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'fa' and 'fa-stack' shortcodes in versions up to and including 4.7.0 due to insufficient input sanitization and output escaping on user supplied attributes.
A vulnerability was found in PlayTube 3.0.1 and classified as problematic. This issue affects some unknown processing of the component Redirect Handler, leading to information disclosure.
A critical vulnerability has been found in IBOS OA version 4.5.5, affecting the addComment function in the file ?r=weibo/comment/addcomment. Manipulation of the touid argument leads to SQL injection.
A critical vulnerability was found in Xintian Smart Table Integrated Management System version 5.6.9, affecting an unknown part of the file /SysManage/AddUpdateRole.aspx. Manipulation of the argument txtRoleName leads to SQL injection.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS