CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.08)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Motyw Tiger dla WordPressa jest podatny na eskalację uprawnień we wszystkich wersjach do i włącznie z 101.2.1. Problem wynika z braku ograniczeń w pliku 'paypal-submit.php', który pozwala na rejestrację użytkowników z rolą 'administrator'.
Wtyczka Tiare Membership dla WordPressa jest podatna na eskalację uprawnień we wszystkich wersjach do i włącznie z 1.2. Problem wynika z funkcji 'tiare_membership_init_rest_api_register', która nie ogranicza ról użytkowników podczas rejestracji.
Wtyczka FindAll Membership dla WordPressa jest podatna na obejście uwierzytelniania we wszystkich wersjach do i włącznie z 1.0.4. Problem wynika z niewłaściwego logowania użytkownika z danymi wcześniej zweryfikowanymi przez funkcje 'findall_membership_check_facebook_user' oraz 'findall_membership_check_google_user'.
Wtyczka FindAll Listing dla WordPressa jest podatna na eskalację uprawnień we wszystkich wersjach do i włącznie z 1.0.5. Problem wynika z funkcji 'findall_listing_user_registration_additional_params', która nie ogranicza ról użytkowników podczas rejestracji.
The validator package before version 13.15.22 has a vulnerability in the isLength() function that mishandles Unicode variation selectors (\uFE0F, \uFE0E), leading to incorrect string length calculation. Attackers can exploit this to submit strings longer than expected, causing data truncation in databases, buffer overflows, or denial-of-service.
Podatność związana z niewłaściwym zarządzaniem uprawnieniami w ZTE ElasticNet UME R32 na systemie Linux umożliwia dostęp do funkcjonalności, która nie jest odpowiednio ograniczona przez listy kontroli dostępu (ACL). Problem dotyczy wersji ElasticNet UME R32: ElasticNet_UME_R32_V16.23.20.04.
Improper Input Validation vulnerability in CyberArk Secure Web Sessions Extension on Chrome, Edge allows Denial of Service when trying to start new SWS sessions. This issue affects CyberArk Secure Web Sessions Extension before 2.2.30305.
The Access Control Bypass vulnerability in ALC WebCTRL and Carrier i-Vu up to and including version 8.5 allows a malicious actor to bypass intended access restrictions and expose sensitive information via the web-based building automation server.
W Angularze, przed wersjami 19.2.16, 20.3.14 i 21.0.1, występowała luka związana z wyciekiem tokena XSRF poprzez URL-e względne protokołu w klientach HTTP. Luka ta prowadzi do nieautoryzowanego ujawnienia tokena XSRF do domeny kontrolowanej przez atakującego.
Ray is an AI compute engine. Prior to version 2.52.0, developers using Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This is due to insufficient guard against browser-based attacks, as the current defense uses the User-Agent header starting with 'Mozilla'. This defense is insufficient because the fetch specification allows modifying the User-Agent header. Combined with DNS rebinding, the vulnerability is exploitable against a developer who inadvertently visits a malicious website or sees a malicious ad. Patched in version 2.52.0.
XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted. An attacker can remove the signature from an XML document to make it pass verification. XML-Sig is a Perl module to validate signatures on XML files. An unsigned XML file should return an error, but affected versions return true when validating an XML file with no signatures.
An IDOR vulnerability in classroomio 0.1.13 allows students to access sensitive admin/teacher endpoints by manipulating course IDs in URLs, resulting in temporary unauthorized disclosure of sensitive course, admin, and student data before the system reverts to normal access restrictions.
An unauthenticated administrative access vulnerability exists in the open-source HashTech project (https://github.com/henzljw/hashtech) from version 1.0 through commit 5919decaff2681dc250e934814fc3a35f6093ee5 (2021-07-02). Due to missing authentication checks on /admin_index.php, an attacker can directly access the admin dashboard without valid credentials. This allows full administrative control including viewing/modifying user accounts, managing orders, changing payments, and editing product listings. Successful exploitation can lead to information disclosure, data manipulation, and privilege escalation.
A vulnerability in imonnit.com (as of 2025-04-24) allows attackers to escalate privileges via a crafted password reset, enabling takeover of arbitrary user accounts.
A stored cross-site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via crafted SVG cover images.
A stored cross-site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via crafted SVG profile pictures.
An Insecure Direct Object Reference (IDOR) vulnerability in classroomio 0.1.13 allows unauthorized access to share and invite features in course settings.
In classroomio 0.1.13, student accounts can delete courses from the Explore page without any authorization or authentication checks, bypassing the expected admin-only deletion restriction.
NCP Secure Enterprise Client 13.18 and NCP Secure Entry Windows Client 13.19 have an Untrusted Search Path vulnerability.
Zenitel TCIV-3+ jest podatny na refleksyjną podatność typu cross-site scripting, która może umożliwić zdalnemu atakującemu wykonanie dowolnego kodu JavaScript w przeglądarce ofiary.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS