CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.01)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CVE-2023-4702 describes an authentication bypass vulnerability in Yepas Digital Yepas. This issue affects versions before 1.0.1.
A flaw was found in GLib related to GVariant deserialization. A crafted GVariant can cause excessive processing, leading to denial of service.
CVE-2023-4766 describes an improper neutralization of special elements used in SQL commands, allowing for SQL Injection in the Movus system. This issue affects versions before 20230913.
A vulnerability in Exagate SYSGuard 3001 allows authentication bypass through assumed-immutable data. This issue affects versions before 3.2.20.0.
CVE-2023-4832 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in Aceka Company Management. This issue affects versions before 3072.
Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.
There is a failure in the -fstack-protector feature in GCC-based toolchains targeting AArch64, allowing an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without detection. This issue only affects C99-style dynamically-sized local variables or those created using alloca().
Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Wtyczka Logowanie za pomocą numeru telefonu dla WordPressa jest podatna na atak typu Cross-Site Request Forgery w wersjach do 1.5.6 włącznie. Brak walidacji nonce w funkcji 'lwp_update_password_action' umożliwia nieautoryzowanym atakującym zmianę hasła użytkownika poprzez sfałszowane żądanie, jeśli uda im się nakłonić administratora strony do wykonania określonej akcji, na przykład kliknięcia w link.
Wtyczka Simplr Registration Form Plus+ dla WordPressa jest podatna na niebezpieczne bezpośrednie odniesienia do obiektów w wersjach do 2.4.5 włącznie. Problem wynika z tego, że wtyczka umożliwia użytkownikom kontrolowany dostęp do obiektów, co pozwala na ominięcie autoryzacji i dostęp do zasobów systemowych.
Wtyczka BAN Users dla WordPressa jest podatna na eskalację uprawnień w wersjach do 1.5.3 włącznie, z powodu braku sprawdzenia uprawnień w funkcji 'w3dev_save_ban_user_settings_callback'. Umożliwia to uwierzytelnionym atakującym, posiadającym minimalne uprawnienia, takie jak subskrybent, modyfikację ustawień wtyczki w celu uzyskania dostępu do funkcji blokowania i odblokowywania użytkowników oraz ustawienia roli odblokowanego użytkownika.
User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL Server, Enterprise Developer, and Enterprise Server (including variants such as Enterprise Test Server) in specific versions when LDAP-based authentication is used with certain configurations. The vulnerability allows authentication with any valid username regardless of password correctness, and sometimes even with an invalid username.
Podatność CVE-2023-38156 dotyczy usługi Azure HDInsight, w której występuje luka w zabezpieczeniach związana z wstrzykiwaniem JDBC w Apache Ambari. Może to prowadzić do podniesienia uprawnień przez atakującego.
Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability. Technical details are not provided in the description.
Microsoft Word Information Disclosure Vulnerability. Details of the vulnerability are not provided in the description.
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
Cross Site Scripting (XSS) vulnerability in the Webmail Calendar of IceWarp 10.3.1 allows remote attackers to inject arbitrary web script or HTML via the "p4" field.
A command injection vulnerability was discovered in the D-Link DIR-816 A2 router running firmware version 1.10 B05. The flaw resides in the /goform/Diagnosis component.
Xpand IT Write-back manager v2.3.1 uses a hardcoded salt in the license class configuration, leading to the generation of hardcoded and predictable symmetric encryption keys for license generation and validation. This allows an attacker to reconstruct the keys and forge licenses.
The issue was addressed with improved handling of caches. This issue is fixed in tvOS 16.3, iOS 16.3 and iPadOS 16.3, macOS Monterey 12.6.8, macOS Big Sur 11.7.9, iOS 15.7.8 and iPadOS 15.7.8, macOS Ventura 13.2, watchOS 9.3. Processing a font file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS