CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.08)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Improper neutralization of special elements in the template engine of Elastic Cloud Enterprise (ECE) allows an admin-level actor to exfiltrate sensitive information and issue commands via a specially crafted string where Jinjava variables are evaluated.
Podatność CVE-2025-9902 dotyczy oprogramowania QRMenu, które pozwala na obejście autoryzacji poprzez klucz kontrolowany przez użytkownika, co może prowadzić do nadużycia uprawnień. Problem ten występuje w wersjach QRMenu od 1.05.12 do wersji z dnia 05.09.2025.
W systemie Aykome License Tracking występuje podatność na wstrzykiwanie SQL z powodu niewłaściwego neutralizowania specjalnych elementów używanych w poleceniach SQL. Problem dotyczy wersji przed datą 06.10.2025.
A null pointer dereference has been identified in the AsIO3.sys driver. The vulnerability can be triggered by a specially crafted input, which may lead to a system crash (BSOD).
A stack buffer overflow has been identified in the AsIO3.sys driver. The vulnerability can be triggered by input manipulation, potentially leading to a system crash (BSOD) or other undefined execution.
Cross-site scripting vulnerability in the QGIS QWC2 Registration GUI <=v2025.03.31 allows an authorized attacker to plant arbitrary JavaScript code in the page.
Cross-site scripting vulnerability in the attribute table in QGIS QWC2 <2025.08.14 allows an authorized attacker to plant arbitrary JavaScript code in the page.
The WP Private Content Plus plugin through version 3.6.2 provides a global content protection feature that requires a password, but the access control check is based only on the presence of an unprotected client-side cookie. An unauthenticated attacker can completely bypass the password protection by manually setting the cookie value in their browser.
A link following vulnerability exists in the UnifyScanner component of Armoury Crate. It may be triggered by creating a specially crafted junction, potentially leading to local privilege escalation.
Podatność typu OS Command Injection w aplikacji Station Launcher na platformie 3DEXPERIENCE, od wersji R2022x do R2025x, może umożliwić atakującemu wykonanie dowolnego kodu na maszynie użytkownika.
Baza danych w chmurze przedsiębiorstwa opracowana przez Ragic ma podatność na nieautoryzowane przesyłanie plików, co pozwala zdalnym atakującym z uprawnieniami na przesyłanie i uruchamianie złośliwych skryptów, umożliwiając tym samym wykonanie dowolnego kodu na serwerze.
SOOP-CLM developed by PiExtract has a Server-Side Request Forgery (SSRF) vulnerability, allowing privileged remote attackers to read server files or probe internal network information.
SOOP-CLM opracowany przez PiExtract ma podatność na ukrytą funkcjonalność, która pozwala uprzywilejowanym zdalnym atakującym wykorzystać tę ukrytą funkcjonalność do wykonania dowolnego kodu na serwerze.
Uniweb/SoliPACS WebServer developed by EBM Technologies has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access a specific page to obtain user group names.
Uniweb/SoliPACS WebServer developed by EBM Technologies has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access a specific page to obtain information such as account names and IP addresses.
A vulnerability in code-projects Automated Voting System 1.0. It affects an unknown functionality in /admin/update_user.php, where the Password argument causes SQL injection. The attack can be performed remotely, and the exploit has been publicly disclosed.
A vulnerability was found in code-projects Automated Voting System 1.0. An unknown function of the file /admin/add_candidate_modal.php is affected. Manipulation of the firstname argument results in SQL injection. The attack can be executed remotely and the exploit has been made public.
Stored XSS vulnerability in 3DSearch in 3DSwymer on 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script in user's browser session.
Stored XSS vulnerability in Issue Management in ENOVIA Collaborative Industry Innovator (3DEXPERIENCE R2022x through R2025x) allows an attacker to execute arbitrary script in user's browser session.
Stored XSS vulnerability in Specification Management in ENOVIA Specification Manager (3DEXPERIENCE R2023x through R2025x) allows an attacker to execute arbitrary script in user's browser session.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS