CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.01)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.
A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory.
Wtyczka OpenHook dla WordPressa jest podatna na zdalne wykonanie kodu w wersjach do 4.3.0 włącznie, poprzez shortcode 'php'. Umożliwia to uwierzytelnionym atakującym z uprawnieniami na poziomie subskrybenta lub wyższymi, wykonanie kodu na serwerze, pod warunkiem, że ustawienie shortcode [php] jest włączone na podatnej stronie.
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
The AjaxNewsTicker plugin version 1.0.5 contains a vulnerability that allows a remote attacker to execute arbitrary code via a crafted payload in the 'reque' parameter. The issue stems from insufficient input validation.
A Cross Site Scripting (XSS) vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload in the subcmd parameter of the index.php component.
A Cross Site Scripting (XSS) vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary JavaScript code via a crafted title parameter in the index.php component.
W podatności CVE-2023-43314 występuje przepełnienie bufora w oprogramowaniu układowym Zyxel PMG2005-T20B w wersji V1.00(ABNK.2)b11_C0. Może to pozwolić nieautoryzowanemu atakującemu na spowodowanie stanu odmowy usługi poprzez odpowiednio skonstruowany identyfikator uid.
A Cross Site Scripting (XSS) vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary JavaScript code via a crafted payload in the 'cmd' parameter of the index.php component.
A CSRF vulnerability in phpkobo AjaxNewTicker version 1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload in the txt parameter of the index.php component.
A Cross Site Scripting (XSS) vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary JavaScript code via a crafted payload in the 'txt' parameter of the index.php component.
The AjaxNewsTicker plugin version 1.0.5 contains a vulnerability that allows a remote attacker to execute arbitrary code via a crafted payload in the 'reque' parameter. The issue stems from insufficient input validation.
A Cross Site Scripting (XSS) vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary JavaScript code via a crafted payload to the ID parameter in the index.php component.
A Cross Site Scripting (XSS) vulnerability in phpkobo AjaxNewTicker version 1.0.5 allows a remote attacker to execute arbitrary JavaScript code via a crafted payload in the index.php component.
A vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS and IOS XE Software could allow an authenticated, remote attacker with administrative control of a group member or key server to execute arbitrary code or cause a device crash. It is due to insufficient validation of attributes in GDOI and G-IKEv2 protocols.
CVE-2023-4934 describes an Authorization Bypass Through User-Controlled Key vulnerability in Usta AYBS, allowing for Authentication Abuse and Authentication Bypass.
The Hedef Tracking Admin Panel has an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. This issue affects Admin Panel versions before 1.2.
Dreamer CMS version 4.1.3 contains an arbitrary file read vulnerability in the /admin/TemplateController.java component. An attacker can exploit this flaw to read sensitive files from the server.
DedeBIZ v6.2.11 was found to have multiple remote code execution (RCE) vulnerabilities in /admin/file_manage_control.php via the $activepath and $filename parameters.
A stored cross-site scripting (XSS) vulnerability was found in DedeBIZ v6.2.11 in the Website column management function. Attackers can inject malicious JavaScript or HTML into the title parameter, leading to script execution in the victim's browser.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS