CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.13)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Zidentyfikowano podatność w projekcie Simple Shopping Cart 1.0, która dotyczy nieznanej funkcji w pliku /adminlogin.php. Manipulacja argumentem admin_username prowadzi do wstrzyknięcia SQL.
A vulnerability was found in Simple Shopping Cart 1.0 by code-projects in some unknown processing of the file /Admin/additems.php. Manipulation of the argument item_name leads to SQL injection. The attack can be executed remotely and the exploit has been publicly disclosed.
A vulnerability was found in Simple Shopping Cart 1.0 by code-projects in unknown code of the file /Customers/settings.php. Manipulation of the argument user_id results in SQL injection. Remote exploitation is possible and the exploit has been made public.
W IdeaCMS w wersjach do 1.8 zidentyfikowano podatność, która dotyczy funkcji whereRaw w pliku app/common/logic/index/Coupon.php. Manipulacja argumentem params prowadzi do wstrzykiwania SQL, co może być wykorzystane przez zdalnego atakującego.
A vulnerability was detected in code-projects Daily Time Recording System 4.5.0. The impacted element is an unknown function of the file /admin/add_payroll.php. Manipulation of the argument detail_Id results in SQL injection. The attack can be initiated remotely, and the exploit is now public and may be used.
A security vulnerability has been detected in SourceCodester Inventory Management System 1.0. The affected element is an unknown function of the component SVC Report Export. Such manipulation leads to CSV injection. The attack can be launched remotely, and the exploit has been publicly disclosed.
A weakness has been identified in Yealink SIP-T21P E2 52.84.0.15. It affects an unknown function of the Local Directory Page component. Manipulation causes cross site scripting. The attack can be initiated remotely and the exploit is publicly available. The vendor was contacted but did not respond. This vulnerability only affects products no longer supported by the maintainer.
Vulnerability in FULLBACK Manager Pro by GS Yuasa International Ltd. due to registering two Windows services with unquoted file paths. A user with write permission to the installation directory can execute arbitrary code with SYSTEM privileges.
Improper configuration of the SSH service in Infinera MTC-9 allows an unauthenticated attacker to execute arbitrary commands and access data on the file system. This issue affects MTC-9 from R22.1.1.0275 before R23.0.
Remote shell service (RSH) in Infinera MTC-9 version R22.1.1.0275 allows an attacker to utilize password-less user accounts and obtain system access by activating a reverse shell. This issue affects MTC-9 from R22.1.1.0275 before R23.0.
A wrong permission check in KNIME Business Hub before version 1.17.0 allowed an authenticated user to save jobs of other users as if they were saved by the job owner. The attacker must have permissions to access the jobs, but they were saved into the catalog service using the wrong owner permissions, potentially allowing saves into spaces where the attacker lacks write permissions.
A SQL Injection vulnerability was discovered in Philipinho Simple-PHP-Blog in the /edit.php file. The flaw can be exploited remotely and a public exploit is already available. The product uses a rolling release model, so no specific affected or fixed versions are disclosed.
Zidentyfikowano podatność w systemie zarządzania studentami itsourcecode w wersji 1.0. Podatność ta dotyczy nieznanego kodu w pliku /edit_user.php, gdzie manipulacja argumentem fname prowadzi do wstrzyknięcia SQL.
A vulnerability was determined in D-Link DCS-930L 1.15.04 affecting an unknown part of the file /setSystemAdmin of the alphapd component. Manipulation of the AdminID argument can lead to command injection, and the attack can be executed remotely.
Denial of service (DoS) vulnerability in the office service. Successful exploitation may affect availability.
Denial of service (DoS) vulnerability in the office service. Successful exploitation may affect availability.
Denial of service (DoS) vulnerability in the office service. Successful exploitation may affect availability.
Denial of service (DoS) vulnerability in the office service. Successful exploitation may affect availability.
App lock verification bypass vulnerability in the file management app. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
A permission control vulnerability in the window management module. Exploitation may impact system availability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS