CVE Vulnerability Catalog

Translated CVE descriptions from NVD NIST - in English

Browse vulnerabilities by package

CISA KEV catalog updated: 02/10/2026(UTC) (v2026.10.02)

All Critical High Medium Low Actively exploited86,241 results

One email a week with newly published vulnerabilities worth knowing about. No account needed.

This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.

01/09/2023(UTC)

An issue in hjson-java up to v3.0.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted JSON string.

01/09/2023(UTC)

Improper input validation exists in the GitHub repository usememos/memos prior to version 0.13.2.

01/09/2023(UTC)

Improper Privilege Management exists in the GitHub repository usememos/memos prior to version 0.13.2.

01/09/2023(UTC)

A predictable algorithm was used in the random number generator in the GitHub repository pkp/pkp-lib prior to version 3.3.0-16.

01/09/2023(UTC)

An Improper Input Validation vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). Receiving specially crafted BGP UPDATE messages may lead to the teardown of a BGP session or affect other remote systems.

31/08/2023(UTC)

FreeRDP, a free implementation of the RDP protocol, has a Use-After-Free issue in the `avc420_ensure_buffer` and `avc444_ensure_buffer` functions in affected 3.x beta versions. The issue occurs when the value of `piDstSize[x]` is 0, leading to the freeing of `ppYUVDstData[x]`, which has not been updated.

31/08/2023(UTC)

CVE-2023-41749 vulnerability involves sensitive information disclosure due to excessive collection of system information. It affects Acronis Agent (Windows) before build 32047 and Acronis Cyber Protect 15 (Windows) before build 35979.

31/08/2023(UTC)

FreeRDP versions 3.x before beta3 are vulnerable to a Use-After-Free error when processing `RDPGFX_CMDID_RESETGRAPHICS` packets. If `context->maxPlaneSize` is 0, `context->planesBuffer` will be freed, leading to a potential exploit vector.

31/08/2023(UTC)

Podatność CVE-2022-46869 dotyczy lokalnego podwyższenia uprawnień podczas instalacji z powodu niewłaściwego zarządzania dowiązaniami symbolicznymi. Dotyczy to produktów Acronis Cyber Protect Home Office (Windows) przed wersją 40278 oraz Acronis True Image OEM (Windows) przed wersją 42575.

31/08/2023(UTC)

CVE-2023-41744 allows local privilege escalation due to unrestricted loading of unsigned libraries. The affected products are Acronis Agent (macOS) before build 30600 and Acronis Cyber Protect 15 (macOS) before build 35979.

31/08/2023(UTC)

CVE-2023-41743 allows local privilege escalation due to insecure driver communication port permissions. It affects several Acronis products, including Acronis Cyber Protect Home Office and Acronis True Image OEM.

31/08/2023(UTC)

The CVE-2023-34392 vulnerability in the SEL-5037 SEL Grid Configurator allows an attacker to execute arbitrary commands on managed devices by an authorized device operator due to missing authentication for critical functions.

31/08/2023(UTC)

CVE-2023-34391 involves an insecure inherited permissions vulnerability in Schweitzer Engineering Laboratories SEL-5033 AcSELerator RTAC Software on Windows, allowing manipulation of configuration file search paths.

31/08/2023(UTC)

CVE-2023-41742 vulnerability concerns excessive attack surface due to binding to an unrestricted IP address. Affected products include Acronis Agent (Linux, macOS, Windows) before build 30430 and Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 35979.

31/08/2023(UTC)

CVE-2023-41640 describes an improper error handling vulnerability in the ErroreNonGestito.aspx component of GruppoSCAI RealGimm 1.1.37p38, allowing attackers to obtain sensitive technical information via a crafted SQL query.

31/08/2023(UTC)

An arbitrary file upload vulnerability in the Gestione Documentale module of GruppoSCAI RealGimm 1.1.37p38 allows attackers to execute arbitrary code via uploading a crafted file.

31/08/2023(UTC)

CVE-2023-41738 describes an improper neutralization of special elements used in OS commands in Directory Domain Functionality in Synology Router Manager (SRM) before version 1.3.1-9346-6. This allows remote authenticated users to execute arbitrary commands via unspecified vectors.

31/08/2023(UTC)

The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to SQL Injection via the pageId parameter in versions up to and including 1.2.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.

31/08/2023(UTC)

The WP Project Manager plugin for WordPress is vulnerable to privilege escalation in versions up to 2.6.4 due to insufficient restriction on the 'save_users_map_name' function. This allows authenticated attackers with minimal permissions, such as a subscriber, to modify their user role by supplying the 'usernames' parameter.

31/08/2023(UTC)

Wtyczka Quick Post Duplicator dla WordPressa jest podatna na atak typu SQL Injection poprzez parametr 'post_id' w wersjach do 2.0 włącznie, z powodu niewystarczającego zabezpieczenia dostarczonego przez użytkownika oraz braku odpowiedniego przygotowania istniejącego zapytania SQL. Umożliwia to uwierzytelnionym atakującym z uprawnieniami na poziomie współpracownika dodawanie dodatkowych zapytań SQL do już istniejących zapytań.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS