CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In GLPI (IT management software) from version 0.78 to 10.0.24 and 11.0.6, a technician can delete arbitrary files from the filesystem if the webserver has write permissions on them.
An integer underflow in the BGPUpdate.DecodeFromBytes function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a denial of service by sending a crafted BGP UPDATE message.
A DLL hijacking vulnerability in Wassimulator (GitHub) CactusViewer v2.3.0 allows attackers to escalate privileges and execute arbitrary code via a crafted DLL.
Missing input validation in the rfapiRibBi2Ri() function (rfapi_rib.c) in FRRouting (FRR) from stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) by supplying a crafted BGP UPDATE message.
An inclusion of functionality from untrusted control sphere vulnerability in the MinGW DLL component in Synology Hyper Backup Explorer before version 3.0.1-0156 allows local users to execute arbitrary code.
An inclusion of functionality from untrusted control sphere vulnerability in the OpenSSL configuration in Synology Active Backup for Business Recovery Media Creator before version 2.5.0-2081 allows local users to execute arbitrary code.
A remote attacker with user privileges can exploit a stack buffer overflow in gdv-serverconfig to gain full system access as root.
A remote attacker with user privileges can exploit a stack buffer overflow in dali-devconfig to gain full system access as root.
A remote attacker with user privileges can exploit a stack buffer overflow to gain full system access as root.
Vulnerability in the ugw-logread method allows a remote attacker with user privileges to access arbitrary local files due to insufficient input validation.
The ugw-logstop method allows a remote attacker with user privileges to terminate arbitrary processes due to insufficient validation of user-supplied input.
The ugw-restoreinfo method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
The ugw-restore method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
The ugw-logstop method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
The ugw-delete-file method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
The bac-scanresult method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
SWUpdate before 2026.05 is affected by a time-of-check time-of-use (TOCTOU) race condition that allows local unprivileged attackers to escalate privileges to root or install untrusted contents using a signed update.
It is possible for an unauthenticated adjacent attacker to download log files of the controller, which may disclose some restricted information.
The School Management plugin for WordPress versions up to 93.2.0 has an incorrect privilege assignment vulnerability allowing privilege escalation.
The School Management plugin for WordPress versions up to 93.2.0 is vulnerable to SQL injection, allowing SQL query injection.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS