CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.08)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Insecure design policies in the user management system of Revive Adserver 5.5.2 and 6.0.1 and earlier versions cause non-admin users to have access to the contact name and email address of other users on the system.
Improper input neutralization in the stats-conversions.php script in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes potential information disclosure and session hijacking via a stored XSS attack.
Missing JSON Content-Type header in a script in Revive Adserver 6.0.1 and 5.5.2 and earlier versions causes a stored XSS attack to be possible for a logged in manager user.
Improper neutralisation of format characters in the settings of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an administrator user to disable the admin user console due to a fatal PHP error.
Improper Neutralization of Input in Revive Adserver 5.5.2, 6.0.1 and earlier versions causes a potential reflected XSS attack. The vulnerability allows injection of malicious JavaScript that is reflected back to the victim's browser.
An authorization bypass in Revive Adserver 5.5.2, 6.0.1 and earlier versions allows a logged-in attacker to change other users' email addresses and potentially take over their accounts using the forgot password functionality. The vulnerability involves improper access control.
An uncontrolled resource consumption vulnerability exists in userlog-index.php. An attacker with access to the admin interface can request an arbitrarily large number of items per page, potentially leading to denial of service.
Podatność na obejście uwierzytelniania za pomocą alternatywnej ścieżki lub kanału w systemie ABB Ability Edgenius. Problem ten dotyczy wersji 3.2.0.0 oraz 3.2.1.1.
The read function in thinkphp\library\think\template\driver\File.php in ThinkPHP 5.0.24 contains a remote code execution vulnerability.
Dataease, an open source data visualization tool, versions prior to 2.10.17 are vulnerable to JNDI injection. A blacklist was added in 2.10.14, but JNDI injection remains possible via iiop, corbaname, and iiopname schemes. The vulnerability has been fixed in version 2.10.17.
Institute-of-Current-Students v1.0 contains a time-based blind SQL injection vulnerability in the mydetailsstudent.php endpoint. The 'myds' GET parameter is not adequately sanitized before being used in SQL queries.
An issue in Ilevia EVE X1 Server Firmware versions up to v4.7.18.0.eden and Logic Version up to v6.00 - 2025_07_21 allows a remote attacker to execute arbitrary code via the ping.php component, which does not perform secure filtering on IP parameters.
BASIS BBj prior to version 25.00 has a Jetty-served web endpoint that fails to validate or canonicalize path segments, allowing unauthenticated directory traversal to read arbitrary system files. This may expose credentials for BBj Enterprise Manager, enabling administrative access and system command execution.
The SonicWall Email Security appliance loads root filesystem images without verifying signatures, allowing attackers with VMDK or datastore access to modify system files and gain persistent arbitrary code execution.
Zidentyfikowano podatność w projekcie SourceCodester Online Shop w wersji 1.0. Problem dotyczy nieznanej funkcji w pliku /action.php, która umożliwia wstrzyknięcie SQL poprzez manipulację argumentem Search.
W projekcie Online Shop Project 1.0 odkryto podatność, która dotyczy nieznanego przetwarzania pliku /login.php. Manipulacja argumentem Password prowadzi do wstrzykiwania SQL, co może być przeprowadzone zdalnie.
W urządzeniu Tenda AC21 w wersji 16.03.08.16 znaleziono lukę, która dotyczy nieznanej części pliku /goform/SetIpMacBind. Manipulacja listą argumentów może prowadzić do przepełnienia bufora na stosie.
W systemie UTT 进取 750W w wersjach do 3.2.2-191225 wykryto podatność, która dotyczy funkcji systemowej pliku /goform/formPdbUpConfig. Manipulacja argumentem policyNames prowadzi do wstrzyknięcia poleceń.
Wykryto lukę bezpieczeństwa w Muse Group MuseHub w wersji 2.1.0.1567. Problem dotyczy nieznanej funkcji pliku Muse.Updater.exe, co prowadzi do niecytowanej ścieżki wyszukiwania.
In Looker configured with OIDC authentication, an attacker could take over a user account due to email address string normalization. Looker-hosted and Self-hosted were vulnerable; hosted is mitigated, self-hosted needs upgrade.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS