CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code execution when an admin user on DCE uploads or tampers with install packages.
The About Me 3000 widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via admin settings in versions up to and including 2.2.6 due to insufficient input sanitization and output escaping. This allows authenticated attackers with administrator-level permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_firebase_server_key function. This allows unauthenticated attackers to update the Firebase server key for push notifications when the order status changes, provided they can trick a site administrator into performing an action such as clicking on a link.
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_status_order_title function. This allows unauthenticated attackers to update status order titles via a forged request if they can trick a site administrator into performing an action such as clicking on a link.
The ARMember plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 4.0.5. This is due to missing or incorrect nonce validation on the arm_check_user_cap function, allowing unauthenticated attackers to perform multiple unauthorized actions via a forged request.
GPAC v2.3-DEV-rev381-g817a848f6-master was discovered to contain a segmentation violation in the BM_ParseIndexValueReplace function at /lib/libgpac.so.
GPAC v2.3-DEV-rev381-g817a848f6-master was discovered to contain a segmentation violation in the gf_isom_remove_user_data function at /lib/libgpac.so.
GPAC v2.3-DEV-rev381-g817a848f6-master was discovered to contain a segmentation violation in the gf_dump_vrml_sffield function at /lib/libgpac.so.
GPAC v2.3-DEV-rev381-g817a848f6-master was discovered to contain a segmentation violation in the dump_isom_scene function at /mp4box/filedump.c.
Pimcore Admin Classic Bundle, based on the ExtJS framework, has a vulnerability that allows an administrator who has not set up two-factor authentication to execute arbitrary scripts/HTML content. The attack does not require any privileges.
A critical vulnerability has been identified in the Suncreate Mountain Flood Disaster Prevention Monitoring and Early Warning System. The issue affects unknown processing of the file /Duty/AjaxHandle/UpLoadFloodPlanFile.ashx, leading to unrestricted file uploads.
A critical vulnerability was found in the Suncreate Mountain Flood Disaster Prevention Monitoring and Early Warning System, allowing unrestricted file uploads. The issue affects unknown code in the file /Duty/AjaxHandle/Write/UploadFile.ashx, where manipulation of the argument Filedata enables remote attacks.
The vulnerability in VP9 video extensions allows for information disclosure.
A vulnerability in Azure Active Directory allows for a security feature bypass, potentially leading to unauthorized access to resources.
A vulnerability in Azure Service Fabric on Windows allows for information disclosure. An attacker can exploit this flaw to gain access to sensitive data.
CVE-2023-35373 is a spoofing vulnerability in Mono Authenticode validation that may allow attackers to introduce false digital signatures.
A vulnerability in Windows Active Directory Certificate Services (AD CS) allows for remote code execution. An attacker can exploit this flaw to gain control over the system.
A vulnerability in Active Directory Federation Service allows for security feature bypass, potentially leading to unauthorized access to resources. An attacker could exploit this flaw to gain access to systems that should be protected.
A vulnerability in the Windows DNS Server allows for remote code execution. An attacker can exploit this flaw to gain control over the system.
A vulnerability in the Windows DNS Server allows for remote code execution. An attacker can exploit this flaw to gain control over the system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS