CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.01)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in Neutron Smart VMS allows authentication bypass via spoofing. This affects versions before b1130.1.0.1.
A SQL Injection vulnerability in Digita Information Technology's Smartrise Document Management System due to improper neutralization of special elements used in SQL commands. This issue affects versions before Hvl-2.0.
The Mava Software Hotel Management System has an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. This issue affects versions of the system before 2.0.
CVE-2023-35072 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in the Coyav Travel Proagent application. This issue affects Proagent versions before 20230904.
The BMA Personnel Tracking System has an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. This issue affects versions before 20230904.
CVE-2023-35065 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in Osoft Paint Production Management. This issue affects versions before 2.1.
CVE-2023-3375 vulnerability in Unisign Bookreen allows unrestricted upload of files with dangerous types, leading to OS command injection. This issue affects Bookreen versions before 3.0.0.
CVE-2023-3374 vulnerability in Unisign Bookreen allows for privilege escalation due to an incomplete list of disallowed inputs. This issue affects Bookreen versions before 3.0.0.
Audimexee v14.1.7 was discovered to contain a SQL injection vulnerability via the p_table_name parameter. An attacker can manipulate database queries, potentially leading to unauthorized data access.
A Use After Free vulnerability exists in the GitHub repository vim/vim prior to version 9.0.1858. It may lead to undefined behavior, a crash, or potential code execution.
A Use After Free vulnerability exists in the GitHub repository vim/vim prior to version 9.0.1857.
There is a Use After Free vulnerability in the GitHub repository vim/vim prior to version 9.0.1840.
Wtyczka Pixelgrade PixTypes w wersjach do 1.4.15 zawiera podatność na nieautoryzowane odzwierciedlone ataki typu Cross-Site Scripting (XSS). Atakujący może wykorzystać tę lukę do wstrzyknięcia złośliwego kodu JavaScript.
In vowifiservice, there is a possible missing permission check, which could lead to local information disclosure with no additional execution privileges.
In vowifiservice, there is a possible missing permission check, which could lead to local information disclosure with no additional execution privileges.
In vowifiservice, there is a possible missing permission check, which could lead to local information disclosure with no additional execution privileges.
In vowifiservice, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges.
In the LTE protocol stack, there is a possible missing permission check, which could lead to remote information disclosure without the need for additional execution privileges.
In the NIA0 algorithm in Security Mode Command, there may be a missing verification of incorrect input. This could lead to remote information disclosure without the need for additional execution privileges.
A critical vulnerability was found in SourceCodester Inventory Management System version 1.0. Manipulation of the 'page' argument in the index.php file leads to file inclusion, allowing for remote attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS