CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.08)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
GZDoom to port gier opartych na silniku Doom, który w wersjach 4.14.2 i wcześniejszych ma lukę w obsłudze stanów aktorów ZScript. Luka ta pozwala na odczyt dowolnych adresów, zapis stałych w sekcji kodu JIT oraz przekierowanie przepływu kontroli poprzez odpowiednio skonstruowane struktury FState i VMFunction, co prowadzi do wykonania kodu kontrolowanego przez atakującego.
TOTOLINK N300RT routers with firmware before V3.4.0-B20250430 have an OS command injection vulnerability in the Boa formWsc handling. An unauthenticated attacker can send crafted requests to execute commands via the targetAPSsid parameter.
In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.6, and 9.3.2411.117.125, an unauthenticated attacker can inject ANSI escape codes into Splunk log files due to improper validation at the /en-US/static/ web endpoint.
Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, if the URL to the page is modified to include a /tag/ declaration, the CMS will render the page regardless of group restrictions. This vulnerability is fixed in 7.2.8, 7.3.13, and 7.4.6.
Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, there is vulnerable to host header poisoning which allows account takeover via password reset email. This vulnerability is fixed in 7.2.8, 7.3.13, and 7.4.6.
Masa CMS before versions 7.2.8, 7.3.13, and 7.4.6 is vulnerable to remote code execution. The vulnerability exists in the addParam function, which accepts user input via the criteria parameter, subsequently evaluated by setDynamicContent, allowing an unauthenticated attacker to execute arbitrary code via the m tag.
A stored cross-site scripting (XSS) vulnerability in the PwdGrp.cgi endpoint of AVTECH DGM1104 allows attackers to inject malicious JavaScript or HTML into the username field. Successful exploitation enables arbitrary script execution in the victim's browser context.
An authenticated command injection vulnerability was discovered in the SMB server function of AVTECH SECURITY Corporation DGM1104 (firmware version FullImg-1015-1004-1006-1003). This flaw allows attackers to execute arbitrary system commands via crafted input.
An authenticated command injection vulnerability was discovered in the NetFailDetectD binary of AVTECH SECURITY Corporation DGM1104 (FullImg-1015-1004-1006-1003). This vulnerability allows attackers to execute arbitrary system commands via crafted input.
An authenticated command injection vulnerability was discovered in the Machine.cgi endpoint of AVTECH DGM1104 running FullImg-1015-1004-1006-1003. This flaw allows attackers to execute arbitrary commands via crafted input.
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0, including packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious JavaScript. The payload executes when an administrator clicks the image link, resulting in stored XSS. This may lead to account takeover, privilege escalation, or full compromise of the ERPNext instance.
An authenticated command injection vulnerability was discovered in the test_mail function of AVTECH SECURITY DGM1104 (firmware version FullImg-1015-1004-1006-1003). This flaw allows an attacker to execute arbitrary system commands via crafted input.
Usługa GC-AGENTS-SERVICE, będąca częścią platformy Guardicore Agent dla systemu Windows w wersjach przed v49.20.1, v50.15.0, v51.12.0, v52.2.0, jest podatna na lokalną eskalację uprawnień. Usługa próbuje odczytać plik konfiguracyjny OpenSSL z nieistniejącej lokalizacji, do której standardowi użytkownicy Windows mają domyślne uprawnienia do zapisu.
Wtyczka Frontend Admin autorstwa DynamiApps dla WordPressa jest podatna na nieautoryzowaną modyfikację dowolnych opcji WordPressa we wszystkich wersjach do 3.28.20 włącznie. Problem wynika z niewystarczających kontroli uprawnień i walidacji danych wejściowych w funkcji ActionOptions::run() odpowiedzialnej za zapis.
A vulnerability was found in WebKitGTK that allows remote, user-assisted information disclosure. The flaw is due to missing verification of the source of file drag-and-drop operations, enabling an attacker to read any file the user is permitted to access.
Wykryto lukę w obsłudze informacji o montażu dostarczonych przez użytkownika przez demona ABRT. Demon ABRT kopiuje do 12 znaków z niezweryfikowanego wejścia i umieszcza je bezpośrednio w poleceniu powłoki, co pozwala na wstrzyknięcie metaznaków powłoki przez lokalnego użytkownika bez uprawnień.
Wtyczka Advanced Custom Fields: Extended dla WordPressa jest podatna na zdalne wykonanie kodu w wersjach od 0.9.0.5 do 0.9.1.1 poprzez funkcję prepare_form(). Problem wynika z akceptacji danych wejściowych od użytkownika, które są następnie przekazywane przez call_user_func_array().
In ImageMagick, prior to versions 7.1.2-9 and 6.9.13-34, there is a vulnerability in the Magick++ layer that manifests when Options::fontFamily is invoked with an empty string. This leads to memory being freed while leaving a pointer to freed memory, which can result in crashes or heap corruption.
NMIS/BioDose software V22.02 and previous versions contain executable binaries with plain text hard-coded passwords. These hard-coded passwords could allow unauthorized access to both the application and database.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS