CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.08)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The web application allows an unauthenticated remote attacker to learn information about existing user accounts with their corresponding role due to missing authentication for critical function.
Baza danych aplikacji webowej jest wystawiona bez uwierzytelnienia, co pozwala nieautoryzowanemu zdalnemu atakującemu uzyskać dostęp i potencjalnie ją skompromitować.
Deserialization of Untrusted Data vulnerability in Apache IoTDB. This issue affects Apache IoTDB from 1.0.0 before 2.0.5. Users are recommended to upgrade to version 2.0.5, which fixes the issue.
A vulnerability exists in Apache IoTDB affecting versions from 1.3.3 through 1.3.4 and from 2.0.1-beta through 2.0.4. Users are recommended to upgrade to version 2.0.5, which fixes the issue.
A reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.112 and Liferay DXP 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92. A remote authenticated attacker can inject JavaScript via the _com_liferay_commerce_product_definitions_web_internal_portlet_CPDefinitionsPortlet_productTypeName parameter. The malicious payload is reflected and executed in the user's browser.
Wykryto podatność w wersji 3.60 oprogramowania firmware Click Plus PLC, polegającą na przewidywalnym ziarnie w generatorze liczb pseudolosowych. Ta podatność wpływa na bezpieczeństwo generowanych kluczy prywatnych.
W wersji 3.60 oprogramowania firmware Click Plus PLC odkryto użycie uszkodzonego lub ryzykownego algorytmu kryptograficznego. Podatność polega na tym, że oprogramowanie wykorzystuje niebezpieczną implementację algorytmu szyfrowania RSA.
Use After Free vulnerability in RTI Connext Professional (Security Plugins) allows File Manipulation. This issue affects Connext Professional: from 7.5.0 before 7.6.0.
DNN (formerly DotNetNuke), an open-source web content management platform (CMS) in the Microsoft ecosystem, prior to version 10.1.0 allowed users to inject JavaScript code in the Biography field, even if that field is not rich-text. The injected code would run in the context of the website for any user viewing the profile, including administrators and/or superusers. This issue has been patched in version 10.1.0.
An untrusted pointer dereference vulnerability in RTI Connext Professional (Core Libraries) allows pointer manipulation. It affects Connext Professional versions from 7.4.0 before 7.6.0, from 7.0.0 before 7.3.0.10, from 6.1.0 before 6.1.2.27, from 6.0.0 before 6.0.1.43, from 5.3.0 before 5.3.*, from 5.2.0 before 5.2.*, and from 4.4a before 5.1.*.
Buffer over-read and off-by-one error vulnerability in RTI Connext Professional (Core Libraries) allows file manipulation and buffer overreads. Affects versions from 4.4a to 7.6.0 (before specific releases).
An untrusted pointer dereference vulnerability in RTI Connext Professional (Core Libraries) allows pointer manipulation. It affects Connext Professional versions from 7.4.0 before 7.6.0 and from 7.2.0 before 7.3.0.9.
A flaw was found in Libtiff, a 'write-what-where' condition triggered when processing a specially crafted TIFF image file. By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controlled color data to an arbitrary memory location.
Cross-site scripting (XSS) vulnerability in YzmCMS through version 7.3, located in the referer header on the registration page. It allows an attacker to inject malicious script into the victim's browser.
Podatność typu Uncontrolled Search Path Element w Salesforce CLI na systemie Windows umożliwia zastąpienie zaufanego pliku wykonywalnego. Problem ten dotyczy wersji Salesforce CLI przed 2.106.6.
Podatność CVE-2025-9846 dotyczy systemu Inka.Net, który przed wersją 6.7.1 pozwala na nieograniczone przesyłanie plików o niebezpiecznych typach, co może prowadzić do wstrzyknięcia poleceń.
Improper privilege management vulnerability in Novakon P series allows attackers to gain root privileges if one service is compromised. Affects versions from P-V2001.A.C518o2 to P-2.0.05 Build 2026.02.06 (commit d0f97fd9).
Novakon P series devices do not have a password set for the root user. A physically present attacker can easily log in to the device console.
A buffer overflow vulnerability in Novakon P series allows attackers to gain root permission without prior authentication. This affects P series versions from P – V2001.A.C518o2 up to P-2.0.05 Build 2026.02.06 (commit d0f97fd9).
W podatności CVE-2025-9342 występuje obejście autoryzacji poprzez klucz kontrolowany przez użytkownika w aplikacji AHE Mobile firmy Anadolu Hayat Emeklilik Inc., co umożliwia nadużycie uprawnień. Problem dotyczy wersji AHE Mobile od 1.9.7 do przed 1.9.9.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS