CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CVE-2023-3333 describes an improper neutralization of special elements used in OS commands vulnerability in NEC Corporation Aterm devices, allowing an attacker to execute arbitrary OS commands with root privileges after obtaining high privileges by exploiting CVE-2023-3330 and CVE-2023-3331 vulnerabilities.
A vulnerability in NEC Aterm devices allows an attacker to execute arbitrary scripts after obtaining high privileges by exploiting the previous vulnerabilities CVE-2023-3330 and CVE-2023-3331.
The CVE-2023-3331 vulnerability in NEC Corporation Aterm products has an improper limitation of a pathname to a restricted directory, allowing an attacker to delete specific files in the product.
CVE-2023-3330 describes an improper limitation of a pathname to a restricted directory vulnerability in NEC Corporation products, allowing an attacker to access specific files on the device.
The pypdf library, an open-source pure-Python library, has a vulnerability that can lead to an infinite loop when processing a malicious PDF file. This issue occurs in versions where the `__parse_content_stream` method is executed.
Xpdf version 4.04 can deadlock when processing a PDF object stream whose 'Length' field is in another object stream.
Meldekarten generator is an open source project that allows creating, storing, and printing registration cards for volunteers. All text fields on the webpage are vulnerable to XSS attacks as user input isn't (fully) sanitized after submission.
A CSRF vulnerability in Issabel issabel-pbx v.4.0.0-6 allows a remote attacker to gain privileges via a Custom CSRF exploit to create new user function in the application.
A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execute arbitrary code via a crafted script to the Description parameter.
A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execute arbitrary code via a vulnerable parameter GrpPath.
A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execute arbitrary code via a crafted script to the Dtltyp and ListName parameters.
A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execute arbitrary JavaScript code via a vulnerable delete_file parameter.
Stormshield Endpoint Security Evolution versions 2.0.0 through 2.4.2 has insecure permissions. An ACL entry on the SES Evolution agent directory containing the agent logs displayed in the GUI allows interactive users to read data, which could allow access to information reserved for administrators.
Stormshield Endpoint Security Evolution versions 2.0.0 through 2.3.2 have insecure permissions. An interactive user can use the SES Evolution agent to create arbitrary files with local system privileges.
i-doit Open v24 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the timeout parameter on the login page.
Cloudexplorer-lite is an open source cloud software stack that did not enforce strong passwords in versions prior to 1.2.0. Weak passwords can be easily guessed, making the system vulnerable to brute force attacks.
Shopware is an open source e-commerce software. The mail validation in the registration process had some flaws, allowing the construction of different email addresses that ultimately resulted in the same address shared by multiple accounts.
Shopware is an open source e-commerce software. Due to an incorrect configuration in the `.htaccess` file, the configuration file of the Javascript (`themes/package-lock.json`) could be read in production environments, allowing attackers to determine the specific Shopware version in a deployment.
There is a Server-Side Request Forgery (SSRF) vulnerability in the GitHub repository plantuml/plantuml prior to version 1.2023.9. This may lead to unauthorized access to internal server resources.
Improper access control exists in the GitHub repository plantuml/plantuml prior to version 1.2023.9.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS