CVE Vulnerability Catalog

Translated CVE descriptions from NVD NIST - in English

Browse vulnerabilities by package

CISA KEV catalog updated: 01/10/2026(UTC) (v2026.10.01)

All Critical High Medium Low Actively exploited136,435 results

One email a week with newly published vulnerabilities worth knowing about. No account needed.

This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.

18/09/2023(UTC)

An issue in xui-xray v1.8.3 allows attackers to obtain sensitive information via a default password.

16/09/2023(UTC)

Wtyczka Dropbox Folder Share dla WordPressa jest podatna na atak typu Server-Side Request Forgery w wersjach do 1.9.7 włącznie, poprzez parametr 'link'. Atakujący bez uwierzytelnienia mogą wysyłać żądania webowe do dowolnych lokalizacji, co może prowadzić do zapytań i modyfikacji informacji z wewnętrznych usług.

16/09/2023(UTC)

Wtyczka Allow PHP in Posts and Pages dla WordPressa jest podatna na zdalne wykonanie kodu w wersjach do 3.0.4 włącznie, poprzez użycie shortcode 'php'. Umożliwia to uwierzytelnionym atakującym z uprawnieniami na poziomie subskrybenta lub wyższymi, wykonanie kodu na serwerze.

15/09/2023(UTC)

OP-TEE to środowisko zaufane (TEE) zaprojektowane jako towarzyszące dla niesecure'nego jądra Linux działającego na rdzeniach Arm Cortex-A. W wersjach od 3.20 do 3.22 funkcja `shdr_verify_signature` może prowadzić do podwójnego zwolnienia pamięci, co może skutkować nieprzewidywalnym zachowaniem systemu.

15/09/2023(UTC)

CVE-2023-4835 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in CF Software Oil Management Software.

15/09/2023(UTC)

CVE-2023-4833 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in Besttem Network Marketing Software.

15/09/2023(UTC)

CVE-2023-4665 describes an incorrect execution-assigned permissions vulnerability in Saphira Connect that allows privilege escalation.

15/09/2023(UTC)

CVE-2023-4664 describes an Incorrect Default Permissions vulnerability in Saphira Saphira Connect that allows Privilege Escalation. This issue affects Saphira Connect versions before 9.

15/09/2023(UTC)

A vulnerability in Saphira Connect allows Remote Code Inclusion with unnecessary privileges. This issue affects Saphira Connect versions before 9.

15/09/2023(UTC)

CVE-2023-4661 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in Saphira Connect versions before 9.

15/09/2023(UTC)

CVE-2023-4670 describes an improper neutralization of special elements used in SQL commands, allowing for SQL Injection attacks in Innosa Probbys.

15/09/2023(UTC)

The Cevik Informatics Online Payment System has an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. This issue affects versions before 4.09.

15/09/2023(UTC)

CVE-2023-4830 describes an improper neutralization of special elements used in SQL commands, leading to SQL Injection vulnerabilities in the Tura Signalix application.

15/09/2023(UTC)

CVE-2023-4673 describes an improper neutralization of special elements used in SQL commands, allowing for SQL Injection attacks in the Sanalogy Turasistan application.

15/09/2023(UTC)

A reflected cross-site scripting (XSS) vulnerability exists in the File Manager function of Webmin v2.100. It allows attackers to execute malicious scripts by injecting a crafted payload into the 'Find in Results' file.

15/09/2023(UTC)

Webmin version 2.100 contains a stored cross-site scripting (XSS) vulnerability. An attacker can inject malicious HTML or JavaScript code via the cloned module name parameter.

15/09/2023(UTC)

A stored XSS vulnerability was found in Webmin v2.100 in the Usermin Configuration function. Attackers can inject malicious JavaScript or HTML into the Custom field, leading to script execution in the victim's browser.

15/09/2023(UTC)

In Webmin 2.100, a Cross-Site Scripting (XSS) vulnerability was found in the File Manager functionality. An attacker can inject malicious code that executes in the victim's browser during file search or replace operations.

15/09/2023(UTC)

A reflected cross-site scripting (XSS) vulnerability exists in the File Manager function of Webmin v2.100. It allows attackers to execute malicious scripts by injecting a crafted payload into the 'Replace in Results' file.

14/09/2023(UTC)

The vulnerability in Yepas Digital Yepas related to incorrect use of privileged APIs allows for collecting data provided by users. This issue affects versions before 1.0.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS