CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.01)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A missing permission check in Jenkins ElasticBox CI Plugin 5.0.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
The Jenkins ElasticBox CI Plugin version 5.0.1 and earlier contains a cross-site request forgery (CSRF) vulnerability that allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
The Jenkins Benchmark Evaluator Plugin version 1.0.1 and earlier has a CSRF vulnerability that allows attackers to connect to an attacker-specified URL and check for the existence of directories and `.csv` and `.ycsb` files on the Jenkins controller file system.
The Assembla Auth plugin in Jenkins version 1.14 and earlier contains a CSRF vulnerability that allows attackers to trick users into logging into the attacker's account.
The Sumologic Publisher plugin in Jenkins version 2.2.1 and earlier contains a cross-site request forgery (CSRF) vulnerability that allows attackers to connect to an attacker-specified URL.
The Jenkins Pipeline restFul API Plugin version 0.11 and earlier has a cross-site request forgery (CSRF) vulnerability that allows attackers to connect to an attacker-specified URL, capturing a newly generated JCLI token.
A missing permission check in Jenkins Orka by MacStadium Plugin 1.33 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins OpenShift Login Plugin version 1.1.0.227.v27e08dfb_1a_20 and earlier does not invalidate the previous session on login.
Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.
CVE-2023-3600 affects the worker lifecycle, where a use-after-free condition could have occurred, potentially leading to an exploitable crash. This affects Firefox < 115.0.2, Firefox ESR < 115.0.2, and Thunderbird < 115.0.1.
The vulnerability in Rockwell Automation 1756-EN4* Ethernet/IP communication products could allow a malicious user to cause a denial of service by sending maliciously crafted CIP messages.
An issue in MikroTik Router v6.46.3 and earlier allows an attacker to cause a denial of service (DoS) through misconfiguration in the SSH daemon.
CVE-2023-37579 describes an incorrect authorization vulnerability in Apache Pulsar Function Worker that allows authenticated users to access source and sink configurations without proper permissions. Many of these configurations contain credentials, which could lead to credential leakage.
CVE-2023-37197 describes an SQL Injection vulnerability that allows an authenticated user to access unauthorized content, modify or delete content, or perform unauthorized actions by tampering with mass configuration settings of endpoints on DCE.
CVE-2023-37196 describes an SQL Injection vulnerability that allows an authenticated user to access unauthorized content, change or delete content, or perform unauthorized actions by tampering with alert settings on DCE.
The Getnet Argentina plugin for Woocommerce in WordPress is vulnerable to authorization bypass due to missing validation on the 'webhook' function in versions up to and including 0.0.4. This allows unauthenticated attackers to set their payment status to 'APPROVED' without payment.
The WP Reroute Email plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via an email subject in versions up to and including 1.4.9 due to insufficient input sanitization and output escaping.
The Mail Queue plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via an email subject in versions up to and including 1.1 due to insufficient input sanitization and output escaping.
The Lana Email Logger plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via an email subject in versions up to and including Lana Email Logger due to insufficient input sanitization and output escaping.
The Mail Control plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via an email subject in versions up to and including 0.2.8 due to insufficient input sanitization and output escaping.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS