CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.01)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Podatność typu Server-Side Request Forgery (SSRF) w szablonach Brainstorm Force Starter Templates — Elementor, WordPress i Beaver Builder. Problem ten dotyczy szablonów Starter Templates — Elementor, WordPress i Beaver Builder w wersjach od n/a do 3.2.4.
Podatność typu Server-Side Request Forgery (SSRF) w Paytm Payment Gateway, która dotyczy wersji od n/a do 2.7.0. Umożliwia atakującym wysyłanie złośliwych żądań z serwera.
A vulnerability in the craftbeer bar canvas mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications by leaking the channel access token (via captured network traffic).
A flaw was found in Quarkus Cache Runtime. When request processing uses a Uni cached with @CacheResult and the cached Uni reuses the initial 'completion' context, the processing switches to the cached Uni instead of the request context. This can allow a malicious user to receive a response meant for another user, gaining access to sensitive data.
An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. If exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.
Podatność typu Template Injection pozwala uwierzytelnionemu atakującemu, w tym osobie z dostępem anonimowym, na wstrzyknięcie niebezpiecznego wejścia użytkownika do strony Confluence. Dzięki temu atakujący może uzyskać zdalne wykonanie kodu (RCE) na podatnej instancji.
A stored cross-site scripting (XSS) vulnerability was discovered in DaiCuo version 2.5.15 in the /admin.php file. Attackers can inject malicious JavaScript or HTML via crafted input.
Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user, potentially leading to OS Command Injection.
VisiLogic w wersjach przed 9.9.00, używany w PLC i HMI Vision oraz Samba, korzysta z domyślnego hasła administracyjnego. Nieautoryzowany atakujący z dostępem do sieci może przejąć kontrolę administracyjną nad podatnym systemem.
Dell PowerScale OneFS w wersjach od 8.2.2.x do 9.6.0.x zawiera podatność na niewłaściwą kontrolę zasobów w trakcie ich cyklu życia. Atakujący zdalny, nieautoryzowany użytkownik może wykorzystać tę podatność, co może prowadzić do odmowy usługi.
A memory corruption vulnerability in Graphics Linux occurs while assigning a shared virtual memory region during an IOCTL call. It may lead to unintended memory modification.
Memory corruption occurs while submitting a large list of sync points in an AUX command to IOCTL_KGSL_GPU_AUX_COMMAND. It may lead to unintended memory modification.
Memory corruption in DSP Services occurs during a remote call from HLOS to DSP. It may lead to unintended memory modification.
In MISP before version 2.4.179, there is an XSS vulnerability in the event timeline widget located in app/Lib/Tools/EventTimelineTool.php.
CVE-2023-5637 vulnerability in ArslanSoft Education Portal allows unrestricted upload of files with dangerous types, enabling the reading of sensitive strings within an executable. This issue affects versions before 1.1.
The vulnerability in ArslanSoft Education Portal allows unrestricted file uploads of dangerous types, leading to command injection.
A vulnerability in ArslanSoft Education Portal related to improper protection for outbound error messages and alert signals allows for Account Footprinting. This issue affects versions before 1.1.
CVE-2023-5634 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in the ArslanSoft Education Portal. This issue affects versions of the Education Portal before v1.1.
Podatność typu Use After Free w sterownikach GPU Arm Ltd Bifrost, Valhall oraz Arm 5. generacji pozwala lokalnemu użytkownikowi bez uprawnień na wykonywanie nieprawidłowych operacji przetwarzania GPU, co może prowadzić do uzyskania dostępu do już zwolnionej pamięci. Problem dotyczy wersji sterowników od r44p0 do r45p0.
A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2, iPadOS 17.1.2, macOS Sonoma 14.1.2, and Safari 17.1.2. Processing web content may lead to arbitrary code execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS