CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Joomla extension J-BusinessDirectory before version 6.2.3 contains a DoS vulnerability in pagination parameter handling. Pagination values were not strictly typed. Array/non-numeric values (for example limitstart[]) could trigger PHP type errors in arithmetic, and limit was not validated before use in list queries.
The Joomla extension - cmsjunkie.com - J-BusinessDirectory before version 6.2.3 contains a reflected XSS / XML injection vulnerability. The companyName parameter from the request is written unescaped into an XML attribute, potentially allowing execution of malicious scripts in the victim's browser.
SQL injection vulnerability in Joomla extension J-BusinessDirectory (cmsjunkie.com) before version 6.2.3. In trips search, search keywords and ORDER BY were concatenated into SQL. Version 6.2.3 quotes keywords and allow-lists the sort clause.
The Joomla extension J-BusinessDirectory versions below 6.2.3 contain an open mail relay. The recipient address is taken from the request (contact_id_offer / contact_id_event parameters) instead of the server-side offer/event record, allowing mail to be sent to an arbitrary address.
Joomla extension J-BusinessDirectory before version 6.2.3 contains a Cross-site request forgery (CSRF) vulnerability. Tokens are missing on many AJAX/state-changing tasks such as contact/quote forms, cart, bookmarks, uploads, messages, AI text generation, and several administrator actions. Frontend CSRF requires a registered/listing-owner session, while admin CSRF requires a backend admin session.
Joomla extension J-BusinessDirectory before version 6.2.3 contains an Insecure Direct Object Reference (IDOR) vulnerability in multiple frontend/API actions. This vulnerability allows direct object references without proper authorization.
Joomla extension J-BusinessDirectory before version 6.2.3 contains an unauthenticated listing ownership takeover vulnerability. Ownership could be changed using attacker-supplied company and user IDs, including for listings that already had an owner. Version 6.2.3 binds the action to the authenticated user and only allows unowned listings.
The J-BusinessDirectory extension for Joomla before version 6.2.3 contains a vulnerability allowing arbitrary file upload/deletion via path traversal. The _path_type parameter can point to component site/admin trees, and the extension check is weak. CSRF token is also missing on upload/remove.
Cudy WR3000 2.0 running firmware before 2.5.24 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary OS commands with root privileges by sending unsanitized input through the mesh MQTT command interface. The sync_command binary forwards unsanitized input directly to a shell execution sink in command.lua, enabling attackers with access to the MQTT broker to exploit the default-enabled command execution path to achieve full root-level system compromise.
Cudy WR3000 2.0 with firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret in the Mosquitto MQTT broker's authentication plugin. An unauthenticated attacker can extract the secret from the firmware image and forge valid JWT tokens, gaining unauthorized access to the device's mesh networking interface.
Dell OpenManage Enterprise versions prior to 4.7.0 contain an SQL injection vulnerability. A low privileged attacker with remote access could exploit this, leading to information exposure.
Dell Command Update (DCU) versions prior to 5.7.1 contain an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges and Server-side request forgery.
Dell Command Update (DCU) versions prior to 5.7.1 contain an Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.
Dell Command Update (DCU) versions prior to 5.7.1 contain an Incorrect Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
Dell Command Update (DCU) versions prior to 5.7.1 contain a Missing Authorization vulnerability. A low privileged attacker with local access could exploit this, leading to elevation of privileges.
Dell Command Update (DCU) versions prior to 5.7.1 contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could exploit this, leading to filesystem access.
Dell Command Update (DCU) versions prior to 5.7.1 contain a Missing Authorization vulnerability. A low privileged attacker with local access could exploit this, leading to unauthorized access.
Dell Command Update (DCU) versions prior to 5.7.1 contain a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privileged attacker with local access could exploit this, leading to elevation of privileges.
Dell Command Update (DCU) versions prior to 5.7.1 contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.
Dell OpenManage Enterprise versions prior to 4.7.0 contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.