CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.01)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The vulnerability in aiohttp allows an attacker to modify an HTTP request or create a new one if they control the HTTP version. This issue only occurs if the attacker can control the HTTP version of the request.
The vulnerability in aiohttp allows an attacker to modify the HTTP request through improper validation, potentially leading to header injection or the creation of new requests if the attacker controls the HTTP method.
Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file.
A buffer overflow vulnerability was discovered in Zumtobel Netlink CCD Onboard firmware version 3.80 in the NetlinkWeb::Information::SetDeviceIdentification component. This flaw could allow an attacker to execute arbitrary code or cause a denial of service.
A command injection vulnerability was discovered in Zumtobel Netlink CCD Onboard firmware versions 3.74-3.80 via the NetHostname parameter. An attacker can remotely execute arbitrary system commands.
Hardcoded credentials for the Administrator account were discovered in Zumtobel Netlink CCD Onboard firmware versions 3.74-3.80.
A vulnerability in JumpServer GPLv3 v.3.8.0 allows a remote attacker to bypass command filtering and execute arbitrary code. Note that the vendor disputes this, stating that command filtering is not intended to restrict authorized users.
CVE-2023-6201 describes an improper neutralization of special elements used in OS commands, allowing for command injection. This issue affects Univera Computer System Panorama versions before 8.0.
CVE-2023-6151 vulnerability concerns incorrect use of privileged APIs in ESKOM's e-municipality module, allowing data collection as provided by users. This issue affects versions of the module before 105.
CVE-2023-6150 vulnerability concerns incorrect use of privileged APIs in ESKOM's e-municipality module, allowing data collection as provided by users. This issue affects versions of the module before 105.
In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable if Reactor Netty HTTP Server built-in integration with Micrometer is enabled.
Wtyczka BookingPress dla WordPressa jest podatna na nieautoryzowane przesyłanie plików z powodu niewystarczającej walidacji plików w funkcji 'bookingpress_process_upload' w wersjach do 1.0.76 włącznie. Umożliwia to uwierzytelnionym atakującym z uprawnieniami administratora lub wyższymi przesyłanie dowolnych plików na serwerze dotkniętej witryny.
The Path Traversal vulnerability in Neutron IP Camera allows access to files through absolute paths. This issue affects IP Camera versions before b1130.1.0.1.
CVE-2023-3631 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in the Medart Notification Panel.
CVE-2023-3377 describes an improper neutralization of special elements used in SQL commands, leading to SQL Injection vulnerabilities in Veribilim Software Computer Veribase.
A heap overflow vulnerability was discovered in wasm-micro-runtime v1.2.3 in the wasm_loader_prepare_bytecode function. A remote attacker can exploit this flaw to cause a denial of service (DoS).
The Email Encoder plugin for WordPress by Jannis Thuemmig in version 2.1.8 and earlier contains a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation.
Vim prior to version 9.0.2121 has a heap-use-after-free vulnerability that can occur when executing the `:s` command for the first time using a sub-replace-special atom. This may lead to unsafe memory access and potential crashes of the Vim editor.
Wtyczka UserPro dla WordPressa jest podatna na eskalację uprawnień w wersjach do 5.1.4 włącznie, z powodu niewystarczających ograniczeń w funkcji 'userpro_update_user_profile'. Umożliwia to uwierzytelnionym atakującym, posiadającym minimalne uprawnienia, takie jak subskrybent, modyfikację swojej roli użytkownika poprzez dostarczenie parametru 'wp_capabilities' podczas aktualizacji profilu.
Wtyczka UserPro dla WordPressa jest podatna na nieautoryzowany dostęp do danych, ich modyfikację oraz utratę danych z powodu braku weryfikacji uprawnień w wielu funkcjach we wszystkich wersjach do i włącznie z 5.1.1. Umożliwia to nieautoryzowanym atakującym dodawanie, modyfikowanie lub usuwanie metadanych użytkowników oraz opcji wtyczki.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS