CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A critical vulnerability has been found in SourceCodester Online Jewelry Store 1.0, affecting unknown code in the login.php file. Manipulation of the username/password arguments leads to SQL injection, which can be executed remotely.
Several WordPress plugins by Inisev are vulnerable to Cross-Site Request Forgery, allowing unauthorized installation of plugins due to a missing nonce check in the handle_installation function. Attackers can exploit this vulnerability to install plugins if they can trick a site administrator.
An injection issue was addressed with improved input validation. This issue is fixed in macOS Ventura 13.5, where an app may be able to bypass certain Privacy preferences.
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in several versions of Apple operating systems.
This issue was addressed by removing the vulnerable code. An app may be able to modify protected parts of the file system.
A logic issue was addressed with improved state management. This vulnerability could allow a website to track sensitive user information.
A use-after-free issue was addressed with improved memory management. This issue is fixed in several versions of Apple operating systems.
A logic issue was addressed with improved restrictions. Processing web content may lead to arbitrary code execution. This issue is fixed in iOS 16.6, iPadOS 16.6, watchOS 9.6, tvOS 16.6, and macOS Ventura 13.5.
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in several versions of Apple operating systems.
The issue concerns improper validation of symlinks, which may allow an app to bypass user privacy preferences. It has been fixed in macOS Big Sur 11.7.9, macOS Monterey 12.6.8, and macOS Ventura 13.5.
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 15.7.8, iPadOS 15.7.8, macOS Big Sur 11.7.9, macOS Monterey 12.6.8, and macOS Ventura 13.5.
An integer overflow was addressed with improved input validation. This issue is fixed in several versions of Apple operating systems.
The issue concerns improper memory handling, which may allow an app to execute arbitrary code with kernel privileges. It has been fixed in several versions of Apple operating systems.
A critical vulnerability was found in phpscriptpoint RecipePoint 1.9, affecting an unknown part of the file /recipe-result. Manipulation of the arguments text/category/type/difficulty/cuisine/cooking_method leads to SQL injection.
Zoho ManageEngine Support Center Plus version 14001 and below is vulnerable to stored XSS in the products module.
An unhandled error in Vault Enterprise's namespace creation may cause the Vault process to crash, potentially resulting in denial of service.
TeleAdapt RoomCast TA-2400 versions 1.0 through 3.1 are vulnerable to improper privilege management. After establishing an adb connection, entering the su command provides root access without requiring a password.
TeleAdapt RoomCast TA-2400 devices from versions 1.0 to 3.1 suffer from the use of hard-coded passwords (PINs), including values: 385521, 843646, and 592671.
TeleAdapt RoomCast TA-2400 versions 1.0 through 3.1 is vulnerable to improper access control, specifically allowing access to Android Debug Bridge (adb).
TeleAdapt RoomCast TA-2400 versions 1.0 through 3.1 suffers from cleartext storage of sensitive information: RSA private key in Update.exe.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS