CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.01)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.
A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to upload and download arbitrary files via J-Web, leading to loss of integrity or confidentiality, and may allow chaining to other vulnerabilities.
The MRV Tech Logging Administration Panel has an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. This issue affects versions before 20230915.
A flaw was found in Red Hat's AMQ-Streams, which affects the OKHttp component. The issue involves information disclosure via an exception triggered by a header containing an illegal value.
A CSRF vulnerability in admin_manager.php of Seacms up to v12.8 allows attackers to arbitrarily add an admin account without authorization.
An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the `h->nets` array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.
A cross-site scripting (XSS) vulnerability in Froala Editor v4.1.1 allows remote attackers to execute arbitrary code via the 'Insert link' parameter in the 'Insert Image' component.
In TOTOLINK A3700R and N600R routers, a vulnerability related to incorrect access control has been discovered. This flaw may allow an unauthorized user to bypass security mechanisms.
XSS vulnerability in Roundcube before 1.4.14, 1.5.4, and 1.6.3 allows XSS via text/plain email messages with crafted links.
In PrestaShop opartfaq version 1.0.3 and below, there is an SQL injection vulnerability in updatepos.php that allows remote attackers to execute arbitrary SQL commands.
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.
The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7, iOS 16.7 and iPadOS 16.7, macOS Ventura 13.6. A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.
A certificate validation issue was addressed. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A malicious app may be able to bypass signature validation. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.
In versions of sudo-rs prior to 0.2.1, an issue was discovered where usernames containing '.' and '/' characters could lead to corruption of specific files on the filesystem. A user with such a name could delete a binary file, resulting in its removal from the system.
Moduł SimpleImportProduct dla Prestashop w wersji 6.2.9 zawiera podatność na wstrzykiwanie SQL poprzez parametr key w pliku send.php.
PrestaShop version 2.0.7 has an SQL injection vulnerability in the opartsavecart module. Remote attackers can execute arbitrary SQL commands via the initContent() and displayAjaxSendCartByEmail() methods.
W module MyPrestaModules dla Prestashop w wersji 6.2.9 oraz module UpdateProducts w wersji 3.6.9 odkryto podatność na ujawnienie informacji PHPInfo poprzez plik send.php.
Podatność CVE-2023-5042 dotyczy ujawnienia wrażliwych informacji z powodu niebezpiecznych uprawnień do folderów. Dotyczy to produktów Acronis Cyber Protect Home Office (Windows) przed wersją 40713 oraz Acronis True Image OEM (Windows) przed wersją 42575.
A flaw in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. An attacker could bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.
A Cross Site Scripting (XSS) vulnerability in Dolibarr ERP CRM version 17.0.1 and earlier allows a remote attacker to obtain sensitive information and execute arbitrary code via the REST API module, related to analyseVarsForSqlAndScriptsInjection and testSqlAndScriptInject functions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS