CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Uncontrolled resource consumption vulnerability in SE-elektronic GmbH E-DDC3.3 affecting versions 03.07.03 and higher. An attacker could interrupt the availability of the administration panel by sending multiple ICMP packets.
Podatność polegająca na wstawieniu wrażliwych informacji do wysyłanych danych występuje w InstaWP Connect w wersjach od n/a do 0.1.0.9. Może to prowadzić do nieautoryzowanego ujawnienia danych użytkowników.
W podatności CVE-2024-22283 występuje niewłaściwa neutralizacja specjalnych elementów używanych w poleceniach SQL, co prowadzi do możliwości ataku typu SQL Injection w systemie Delhivery Logistics Courier. Problem ten dotyczy wersji od n/a do 1.0.107.
Wtyczka WP Overnight PDF Invoices & Packing Slips dla WooCommerce zawiera podatność na wstrzykiwanie SQL z powodu niewłaściwej neutralizacji specjalnych elementów używanych w poleceniach SQL. Problem dotyczy wersji od n/a do 3.7.5.
A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other users.
The Path Traversal vulnerability in VGuard by Biges Safe Life Technologies Electronics Inc. allows for Absolute Path Traversal. This issue affects VGuard versions before 500.0003.R008.4011.C0012.B351.C.
An issue in the official Plone Docker image version 5.2.13 (5221) allows remote code execution due to improper validation of HOST headers.
A vulnerability in Projectworlds Vistor Management System in PHP version 1.0 allows a remote attacker to escalate privileges via a crafted script sent to the login page in the POST/index.php path.
An issue discovered in provectus kafka-ui 0.4.0 through 0.7.2 allows remote attackers to execute arbitrary code via the q parameter of /api/clusters/local/topics/{topic}/messages. No fixed release is available; the project has had no commit since 2024-04-08.
A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.
An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a crafted input with a size smaller than 379 KB.
A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise.
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.
Podatność w SNP Digital SalesKing umożliwia ujawnienie wrażliwych informacji osobom nieuprawnionym. Problem dotyczy wersji SalesKing od n/a do 1.6.15.
Since version 5.2.0, when using deferrable mode with a Kubernetes configuration file for authentication, the Airflow worker serializes this file as a dictionary and stores it in metadata without encryption. In versions 2.3.0-2.6.0, the dictionary is also logged as plain text in the triggerer service. This allows anyone with access to metadata or logs to obtain the configuration file and access the Kubernetes cluster.
Podatność na deserializację niezaufanych danych w QuantumCloud ChatBot z AI. Problem ten dotyczy wersji ChatBot z AI od n/a do 5.1.0.
Podatność na deserializację niezaufanych danych w Asgaros Forum, która dotyczy wersji od n/a do 2.7.2. Problem ten może prowadzić do nieautoryzowanego dostępu lub wykonania złośliwego kodu.
Podatność CVE-2024-22152 dotyczy nieograniczonego przesyłania plików o niebezpiecznych typach w wtyczce WebToffee Product Import Export dla WooCommerce. Problem ten występuje w wersjach od n/a do 2.3.7.
Podatność CVE-2024-22135 dotyczy nieograniczonego przesyłania plików o niebezpiecznych typach w wtyczce WebToffee Order Export & Order Import dla WooCommerce. Problem ten występuje w wersjach od n/a do 2.4.3.
Podatność CVE-2023-52221 dotyczy nieograniczonego przesyłania plików o niebezpiecznych typach w aplikacji UkrSolution Barcode Scanner i Inventory Manager. Problem ten występuje w wersjach od n/a do 1.5.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS