CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Team Heateor Super Socializer plugin versions up to 7.13.52 contains a stored Cross-Site Scripting (XSS) vulnerability for users with contributor permissions and above.
The Extra User Details plugin by Vadym K. in versions up to 0.5 has a stored Cross-Site Scripting (XSS) vulnerability with authentication (admin+).
The EventPrime plugin versions up to 3.0.5 contain an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious scripts.
The CMS Commander plugin for WordPress is vulnerable to authorization bypass due to the use of an insufficiently unique cryptographic signature on the 'cmsc_add_site' function in versions up to and including 2.287. This allows unauthenticated attackers to change the '_cmsc_public_key' in the plugin config, providing access to the plugin's remote control functionalities.
The WP Sticky Social plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.0.1. This is due to missing nonce validation in the ~/admin/views/admin.php file, allowing unauthenticated attackers to modify the plugin's settings and inject malicious web scripts via a forged request.
Missing permission checks in Jenkins Team Concert Plugin 2.4.1 and earlier allow attackers with Overall/Read permission to check for the existence of a specified file path on the Jenkins controller file system.
A vulnerability was found in the cpufreq subsystem in the Linux Kernel, specifically in drivers/cpufreq/qcom-cpufreq-hw.c. This flaw, during device unbind, leads to a double release problem resulting in denial of service.
A flaw was found in the IPv6 module of the Linux kernel, involving inconsistent use of arg.result in fib6_rule_lookup. This may lead to a kernel panic in fib6_rule_suppress.
NocoDB through 0.106.0 (or 0.109.1) has a path traversal vulnerability that allows an unauthenticated attacker to access arbitrary files on the server by manipulating the path parameter of the /download route.
PyBB is an open source bulletin board software that contains a vulnerability allowing users to submit any type of HTML tag, which could lead to the execution of malicious JavaScript code on the client side. The issue has been patched in version 0.1.1, and users are advised to upgrade.
Vulnerability of spoofing trustlists of Huawei desktop. Successful exploitation of this vulnerability can cause third-party apps to hide app icons on the desktop to prevent them from being uninstalled.
A vulnerability related to abnormal callbacks passed to APIs, which may lead to system restarts. Successful exploitation of this vulnerability may cause the system to restart.
There is a permission control vulnerability in the window management module. Successful exploitation of this vulnerability may cause features to perform abnormally.
There is a version update determination vulnerability in the user profile module. Successful exploitation of this vulnerability may lead to repeated HMS Core updates and service failures.
There is an inappropriate authorization vulnerability in the SettingsProvider module. Successful exploitation of this vulnerability may cause features to perform abnormally.
Vulnerability of spoofing trustlists of Huawei desktop. Successful exploitation of this vulnerability can cause third-party apps to hide app icons on the desktop to prevent them from being uninstalled.
There is a vulnerability in the Notepad app related to improper permission control. Successful exploitation of this vulnerability may lead to privilege escalation, affecting availability and confidentiality.
Vulnerability of spoofing trustlists of Huawei desktop. Successful exploitation of this vulnerability can cause third-party apps to hide app icons on the desktop to prevent them from being uninstalled.
Vulnerability in services related to early fingerprint APIs on HarmonyOS products. Successful exploitation of this vulnerability may lead to denial of service.
Vulnerability of unauthorized calling on HUAWEI phones and tablets. Successful exploitation of this vulnerability may affect availability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS