CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
StudentManage v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability. This allows an attacker to perform unauthorized actions on behalf of an authenticated user.
Insecure permissions in Splashin iOS v2.0 allow unauthorized attackers to access location data for specific users.
Splashin iOS app version 2.0 fails to enforce server-side interval restrictions for location updates for free-tier users.
Podatność CVE-2024-13175 dotyczy oprogramowania Vidco Software VOC TESTER, które przed wersją 12.41.0 pozwala na ominięcie autoryzacji poprzez klucz kontrolowany przez użytkownika, co umożliwia wymuszone przeglądanie.
Mattermost versions 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to sanitize input paths of file attachments in the bulk import JSONL file, which allows a system admin to read arbitrary system files via path traversal.
Mattermost versions 10.5.x <= 10.5.6, 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, and 9.11.x <= 9.11.16 fail to verify authorization when retrieving cached posts by PendingPostID. An authenticated user can read posts in private channels they don't have access to by guessing the PendingPostID of recently created posts.
A Cross Site Scripting (XSS) vulnerability in Beakon Learning Management System (SCORM) version V.5.4.3 allows a remote attacker to inject malicious script via the URL parameter. This flaw can be exploited to steal sensitive information.
A vulnerability in a subset of REST APIs of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) allows an authenticated, low-privileged attacker to perform a blind SQL injection attack. The issue is due to insufficient validation of user-supplied input.
Vulnerability in Oracle Siebel CRM End User product (component: User Interface) in versions 25.0-25.5. It can be exploited remotely by an unauthenticated attacker via HTTP, leading to unauthorized read access to a subset of data.
A SQL injection vulnerability was discovered in SemCms v5.0 via the lgid parameter in SEMCMS_Products.php. An attacker can manipulate this parameter to execute unauthorized database queries.
A SQL injection vulnerability was discovered in SemCms v5.0 via the ID parameter in SEMCMS_Products.php. An attacker can manipulate this parameter to execute unauthorized database queries.
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter in SEMCMS_InquiryView.php. An attacker can manipulate this parameter to execute unauthorized database queries.
A SQL injection vulnerability was discovered in SemCms v5.0 via the lgid parameter in SEMCMS_Link.php. Attackers can manipulate this parameter to execute unauthorized database queries.
A SQL injection vulnerability was discovered in SemCms v5.0 via the ID parameter in SEMCMS_Link.php. An attacker can manipulate this parameter to execute unauthorized database queries.
A SQL injection vulnerability was discovered in SemCms v5.0 via the pid parameter in SEMCMS_Quanxian.php. Attackers can manipulate this parameter to execute unauthorized database queries.
A SQL injection vulnerability was discovered in SemCms v5.0 via the pid parameter in SEMCMS_Infocategories.php. Attackers can manipulate this parameter to execute unauthorized database queries.
A SQL injection vulnerability was discovered in SemCms v5.0 via the pid parameter in SEMCMS_ct.php. Attackers can exploit this flaw to execute unauthorized database queries.
A SQL injection vulnerability was discovered in SemCms v5.0 via the pid parameter in SEMCMS_Categories.php. An attacker can manipulate this parameter to execute unauthorized database queries.
A flaw was found in polkit where an out-of-bounds write can occur when processing an XML policy with 32 or more nested elements. This can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded.
A vulnerability classified as problematic has been found in GNU Binutils 2.45. The function bfd_elf_set_group_contents in bfd/elf.c is affected, leading to an out-of-bounds write. The attack can be launched locally, and the exploit has been disclosed publicly.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS