CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository cockpit-hq/cockpit prior to version 2.6.3, allowing for the storage of malicious code.
A Cross-Site Scripting (XSS) vulnerability in CSZ CMS 1.3.0 allows attackers to execute arbitrary code via a crafted payload to the Gallery parameter in the YouTube URL fields.
CSZ CMS version 1.3.0 is vulnerable to cross-site scripting (XSS), allowing attackers to execute arbitrary web scripts or HTML via a crafted payload entered in the 'Carousel Wiget' section.
A critical vulnerability was found in the Byzoro Smart S85F Management Platform up to version 20230807. Manipulation of the argument in the file /log/decodmail.php leads to command injection, allowing for remote attacks.
A critical vulnerability was found in the TOTOLINK EX1200L device in version EN_V9.3.5u.6146_B20201023, affecting the setWanCfg function. Manipulation of this function leads to OS command injection.
A critical vulnerability has been found in the TOTOLINK EX1200L device version EN_V9.3.5u.6146_B20201023, affecting the setTracerouteCfg function. Manipulation of this function leads to remote OS command injection.
A critical vulnerability was found in the TOTOLINK EX1200L device version EN_V9.3.5u.6146_B20201023, affecting the setDiagnosisCfg function. Manipulation of this function leads to remote command injection.
A critical vulnerability has been found in NBS&HappySoftWeChat version 1.1.6, allowing unrestricted file uploads. The attack can be launched remotely.
A critical vulnerability was found in Codecanyon Credit Lite version 1.5.4, affecting an unknown functionality of the file /portal/reports/account_statement in the POST Request Handler component. Manipulation of the arguments date1/date2 leads to SQL injection.
The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the eh_callback_handler function in versions up to and including 3.7.9. This allows unauthenticated attackers to modify the order status of arbitrary WooCommerce orders.
A vulnerability in the AcyMailing Enterprise component for Joomla allows unauthorized actors to obtain the number of subscribers in a specific list.
Improper Access Control vulnerability in AcyMailing Enterprise component for Joomla. It allows the unauthorized removal of attachments from campaigns.
Improper Access Control vulnerability in AcyMailing Enterprise component for Joomla. It allows unauthorized users to create new mailing lists.
CVE-2023-39971 describes an improper neutralization of input during web page generation vulnerability in the AcyMailing Enterprise component for Joomla, allowing for XSS attacks. This issue affects versions 6.7.0-8.6.3 of the component.
In OpenMNS Horizon version 31.0.8 and earlier than 32.0.2, users with the ROLE_FILESYSTEM_EDITOR can easily escalate their privileges to ROLE_ADMIN or any other role. This issue also affects related Meridian versions.
A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated attacker to upload arbitrary files via J-Web. This can lead to a loss of integrity for the file system.
A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated attacker to upload arbitrary files via J-Web, leading to a loss of file system integrity.
CVE-2023-36844 is a PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS that allows an unauthenticated attacker to modify important environment variables. An attacker can use a crafted request to change certain variables, leading to partial loss of integrity.
Version 23.01 of lrzip-next was discovered to contain an access violation in the component /bz3_decode_block src/libbz3.c.
In lrzip version 0.651, a heap overflow was discovered in the libzpaq::PostProcessor::write(int) function in /libzpaq/libzpaq.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS