CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its database download feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploit this path traversal weakness to disclose sensitive server files, including authentication credentials, enabling full unauthorized access to the application. The vulnerability is specific to the DataHub module, which was introduced in Bold Reports 6.3. Therefore, versions prior to 6.3 are not affected.
Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its font processing feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploit this path traversal weakness to disclose sensitive server files, including authentication credentials, enabling full unauthorized access to the application. The vulnerability is specific to the DataHub module, which was introduced in Bold Reports 6.3. Therefore, versions prior to 6.3 are not affected.
Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its SVG processing feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploit this path traversal weakness to disclose sensitive server files, including authentication credentials, enabling full unauthorized access to the application. The vulnerability is specific to the DataHub module, which was introduced in Bold Reports 6.3. Therefore, versions prior to 6.3 are not affected.
In JetBrains TeamCity before 2026.1.2 and 2025.11.6, code execution in Git VCS roots was possible.
SiYuan before version v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/<name> link references a non-existent plugin, the application opens a custom tab and inserts the link's icon parameter into the tab header via innerHTML without escaping, allowing injection of an <img onerror=...> element. Because the SiYuan Desktop renderer runs with nodeIntegration:true, the injected JavaScript can access Node's require and call require('child_process').execSync(...), escalating XSS to arbitrary OS command execution.
SiYuan before version v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View (database) cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping, and EscapeHTML is only applied when HasUnclosedHtmlTag returns true; because balanced self-closing tags such as <img> are skipped by that check, a payload like <img src=x onerror=...> is stored unescaped and later inserted into the page via innerHTML, executing when the database is viewed. Because the desktop renderer runs with nodeIntegration enabled, the injected script can reach require and escalate to arbitrary command execution.
Avada Core versions up to 5.15.6 contain an unauthenticated Cross Site Request Forgery (CSRF) vulnerability. An attacker can trick a logged-in administrator into performing unintended actions without their knowledge.
Really Simple CSV Importer versions up to 1.3 contain an Administrator Arbitrary File Upload vulnerability. An administrator can upload a malicious file, potentially leading to remote code execution on the server.
MapSVG versions up to 8.14.0 contain an Administrator Arbitrary File Upload vulnerability. An administrator can upload a malicious file, potentially leading to remote code execution on the server.
In JetBrains IntelliJ IDEA before 2026.2, unauthorized settings modification was possible in a Remote Development session.
In JetBrains IntelliJ IDEA before version 2026.2, unauthorized input injection is possible during a Remote Development session.
The TrueBooker plugin versions up to 1.2.3 contain an unauthenticated privilege escalation vulnerability.
The TrueBooker plugin versions up to 1.2.3 are vulnerable to unauthenticated SQL injection.
The Bookly plugin versions up to 27.7 are vulnerable to unauthenticated SQL injection.
The WPDM – Premium Packages plugin versions up to 6.2.0 are vulnerable to unauthenticated SQL injection.
The Participants Database plugin versions up to 2.7.8.3 allow unauthenticated arbitrary file deletion.
The Thrive Quiz Builder plugin versions up to 10.9.3.0 are vulnerable to unauthenticated PHP object injection.
The Advanced Views plugin versions up to 3.8.11 allow a subscriber to perform remote code execution (RCE).
The SMS Alert Order Notifications plugin versions up to 3.9.6 contain an unauthenticated privilege escalation vulnerability.
The MapSVG plugin versions up to 8.14.0 are vulnerable to unauthenticated SQL injection.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS