CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.01)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Wtyczka AppPresser dla WordPressa jest podatna na nieautoryzowane resetowanie haseł w wersjach do 4.2.5 włącznie. Problem wynika z generowania zbyt słabego kodu resetującego oraz braku limitu prób i czasu na jego użycie.
The joaquimserafim/json-web-token library in versions prior to 4.0.0 is vulnerable to a JWT algorithm confusion attack. An attacker can craft a malicious JWT token using the HS256 algorithm, signed with the public RSA key of the victim application.
An issue was discovered in MISP before version 2.4.176 related to mishandling parameter parsing in app/Controller/AppController.php.
An issue was discovered in MISP before version 2.4.176 related to the lack of a checkParam function in app/Model/AppModel.php, which should validate alphanumerics, underscores, dashes, periods, and spaces.
An issue was discovered in MISP before version 2.4.176 related to mishandling filters in app/Model/AppModel.php.
An issue was discovered in MISP before version 2.4.176 related to mishandling order clauses in app/Model/AppModel.php.
An issue was discovered in MISP before version 2.4.176, where the IndexFilterComponent.php does not properly filter out query parameters.
Vim is an open source command line text editor. In affected versions when shifting lines in operator pending mode and using a very large value, it may be possible to overflow the size of integer.
Vim is an open source command line text editor. When using the z= command, the user may overflow the count with values larger than MAX_INT, which may lead to a crash, although this does not happen in all situations.
Vim is an open source command line text editor that may cause an overflow when parsing relative ex addresses. The issue occurs in the existing overflow check when the line number becomes negative. The impact is low, user interaction is required.
Vim is an open source command line text editor. When getting the count for a normal mode z command, it may overflow for large counts given, which may lead to a crash, although this does not happen in all situations.
Vim is an open source command line text editor. If the count after the :s command is larger than what fits into a (signed) long variable, abort with e_value_too_large. This issue has been addressed in release version 9.0.2108.
Vim is an open source command line text editor. A floating point exception may occur when calculating the line offset for overlong lines and smooth scrolling is enabled with the cpo-settings including the 'n' flag. This issue leads to application crashes.
Vim is an open source command line text editor. When closing a window, vim may try to access already freed window structure.
Podatność CVE-2023-28621 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych, co prowadzi do ataków typu Cross-site Scripting (XSS) w motywach Raise Mag oraz Wishful Blog. Problem ten dotyczy wersji Raise Mag od n/a do 1.0.7 oraz Wishful Blog od n/a do 2.0.1.
Wtyczka Gravity Master Product Enquiry dla WooCommerce w wersjach do 3.0 zawiera podatność na nieautoryzowane odzwierciedlone ataki typu Cross-Site Scripting (XSS). Atakujący może wykorzystać tę lukę do wstrzyknięcia złośliwego kodu JavaScript.
PyPinkSign v0.5.1 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption. This vulnerability can lead to the disclosure of information and communications.
Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backend server that hosts the repository application.
Podatność CVE-2023-5245 dotyczy funkcji FileUtil.extract(), która enumeruje wszystkie wpisy w plikach zip i wydobywa każdy plik bez weryfikacji, czy ścieżki plików w archiwum znajdują się poza zamierzonym katalogiem. Przy tworzeniu instancji TensorflowModel z użyciem formatu saved_model, funkcja apply() wywołuje podatną implementację FileUtil.extract().
In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack. Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured to serve static resources.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS