CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.01)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Version 0.0.245 of the LanChain-ai Langchain library contains a vulnerability that allows a remote attacker to execute arbitrary code via the evaluate function in the numexpr library.
SQL Injection vulnerability in Chamilo LMS versions 1.11 through 1.11.20 allows a remote privileged attacker to obtain sensitive information via the import sessions functions.
Integer Overflow vulnerability in mp_grow in libtommath before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9 allows attackers to execute arbitrary code and cause a denial of service (DoS).
CVE-2023-36327 describes an integer overflow vulnerability in the RELIC library before commit 421f2e91cf2ba42473d4d54daf24e295679e290e, allowing attackers to execute arbitrary code and cause a denial of service in the pos argument of the bn_get_prime function.
An Integer Overflow vulnerability in RELIC before commit 34580d840469361ba9b5f001361cad659687b9ab allows attackers to execute arbitrary code, cause a denial of service, and escalate privileges when calling the realloc function in the bn_grow function.
CVE-2023-36187 describes a buffer overflow vulnerability in NETGEAR R6400v2 devices before version 1.0.4.118, allowing remote unauthenticated attackers to execute arbitrary code via a crafted URL to httpd.
An issue was discovered in IceCMS version 2.0.1, allowing attackers to escalate privileges and gain sensitive information via the UserID parameter in api/User/ChangeUser.
SSRF vulnerability in NebulaGraph Studio version 3.7.0 allows remote attackers to send requests from the server to internal resources, potentially leading to disclosure of sensitive information.
Version 3.1.9 and earlier of smanga contains an SQL Injection vulnerability that allows remote attackers to execute arbitrary code and gain sensitive information via mediaId, mangaId, and userId parameters in php/history/add.php.
Multiple cross-site scripting (XSS) vulnerabilities in the Inventory Management System v1.0 allow attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the Name, Address, and Company parameters under the Add Customer section.
A cross site scripting (XSS) vulnerability in the Markdown Editor component of Typora v1.6.7 allows attackers to execute arbitrary code via uploading a crafted Markdown file.
A cross-site scripting (XSS) vulnerability in General Solutions Steiner GmbH CASE 3 Taskmanagement V 3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name parameter.
The XSS vulnerability in General Solutions Steiner GmbH CASE 3 Taskmanagement V 3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the notification.message parameter.
The XSS vulnerability in General Solutions Steiner GmbH CASE 3 Taskmanagement V 3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Tasktyp parameter.
The XSS vulnerability in General Solutions Steiner GmbH CASE 3 Taskmanagement V 3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the executionBlockName parameter.
The XSS vulnerability in General Solutions Steiner GmbH CASE 3 Taskmanagement V 3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the fieldname parameter.
The Dharmesh Patel Post List With Featured Image plugin versions <= 1.2 has an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious scripts.
The Art Decoration Shortcode plugin versions <= 1.5.6 has a stored Cross-Site Scripting (XSS) vulnerability for users with contributor+ privileges.
The miniOrange YourMembership Single Sign On – YM SSO Login plugin versions up to 1.1.3 has a stored Cross-Site Scripting (XSS) vulnerability with authentication (admin+).
The Chop-Chop Coming Soon plugin versions up to 2.2.4 has an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious JavaScript code.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS