CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A remote buffer overflow vulnerability in the /cgi-bin/dido/setdo.cgi endpoint of Vivotek FD8136 cameras (firmware FD8136-VVTK-0300a) allows an authenticated attacker to execute arbitrary code as root.
A post-authentication buffer overflow vulnerability in the /cgi-bin/admin/eventtask.cgi endpoint of the Vivotek FD8136 camera with firmware FD8136-VVTK-0300a allows an authenticated attacker to execute arbitrary code as root remotely.
A buffer overflow vulnerability in the VIVOTEK FD8136-VVTK-0300a camera allows a remote attacker to execute arbitrary code via the set_getparam.cgi component.
The SIP signaling stack in Verizon IMS implements SIP signaling without IPsec integrity protection. This allows an on-path attacker to compromise confidentiality, integrity, and authenticity of VoLTE signaling.
Insufficient access control restrictions in the file write tool in Amazon Kiro IDE before version 0.11 might allow remote unauthenticated actors to execute arbitrary commands via crafted instructions that cause writes to execution-sensitive paths (such as .vscode/tasks.json), enabling auto-execution on folder open.
An out-of-bounds write vulnerability in the Bitdefender Napoca hypervisor real-mode hook handler allows writing past the RealModeMemory buffer into the hypervisor heap using guest-controlled SS:SP values.
An out-of-bounds write vulnerability in the Bitdefender Napoca hypervisor BIOS INT 0x15 / E820 handler allows a malicious guest to write up to 20 bytes past the RealModeMemory buffer into the hypervisor heap.
Use of default credentials vulnerability in Roche Diagnostics navify Digital Pathology (RabbitMQ Management interface modules) allows Default Usernames and Passwords. This affects versions from 2.0.0 before 2.4.1.
CWE-522: Insufficiently Protected Credentials in web services in Progress Sitefinity versions 8.0.5700 to 13.3.7652. A remote authenticated attacker can obtain plain-text credentials used to connect to the Sitefinity Insight service. Requires active integration with Sitefinity Insight, non-default site configuration, and valid back-end authorization.
In Progress Sitefinity versions 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630, an authorization bypass vulnerability via user-controlled key exists. A remote authenticated attacker can modify account properties of other users.
Progress Sitefinity versions 14.1.x through 14.3.x, 14.4.x before 14.4.8152, 15.0.x before 15.0.8234, 15.1.x before 15.1.8335, 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 have an improper input validation vulnerability (CWE-20) in web services. A remote unauthenticated attacker can compromise user account integrity and confidentiality. User interaction and non-default site configuration are required.
Deserialization of Untrusted Data vulnerability in Elated-Themes Askka allows Object Injection. This issue affects Askka from n/a through 1.3.1.
Vulnerability in the WaveRide theme for WordPress (versions up to 1.4) due to improper control of filename in include/require statement, enabling PHP Local File Inclusion (LFI).
Vulnerability in the Blueprint plugin allows PHP Local File Inclusion (LFI) via improper filename control in include/require statements. Affects versions before 1.1.5.
Improper Authentication in REST API in Collibra Agent allows a remote unauthenticated attacker to access privileged functionality via exposed '/rest/* endpoints.
Path traversal vulnerability in the restore handler of Collibra Agent. An attacker can write arbitrary files outside the intended extraction directory via a crafted ZIP archive. The agent fails to properly validate and canonicalize file paths during extraction.
Vulnerability in the Racquet theme allows PHP Local File Inclusion (LFI) via improper filename control in include/require statements. Affects versions up to and including 1.12.0.
The Cookiteer theme by androThemes (versions up to 1.4.8) contains a PHP Local File Inclusion (LFI) vulnerability via improper control of filename in include/require statements.
The Fermentio theme by Axiomthemes (versions up to 1.5.0) contains a PHP Local File Inclusion (LFI) vulnerability via improper control of filename in include/require statements.
The Spin theme by Axiomthemes (versions up to 1.8) contains a PHP Local File Inclusion (LFI) vulnerability via improper control of filename in include/require statements.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS