CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Wtyczka MStore API dla WordPressa jest podatna na obejście uwierzytelniania w wersjach do 3.9.0 włącznie. Problem wynika z niewystarczającej weryfikacji użytkownika dostarczanego podczas żądania REST API dotyczącego realizacji kuponu przez wtyczkę.
Wtyczka MStore API dla WordPressa jest podatna na obejście uwierzytelniania w wersjach do 3.9.2 włącznie. Problem wynika z niewystarczającej weryfikacji użytkownika dostarczanego podczas żądania REST API dodawania ogłoszenia przez wtyczkę.
The IC Realtime ICIP-P2012T camera version 2.420 is vulnerable to incorrect access control via an exposed HTTP channel using VLC network. This allows unauthorized access to the video stream.
Wtyczka Go Pricing - WordPress Responsive Pricing Tables jest podatna na wstrzyknięcie obiektów PHP w wersjach do 3.3.19 włącznie, poprzez deserializację niezaufanego wejścia z parametru 'data' shortcode 'go_pricing'. Umożliwia to uwierzytelnionym atakującym z uprawnieniami na poziomie subskrybenta i wyżej wstrzyknięcie obiektu PHP.
Amazon Alexa software version 8960323972 on Echo Dot 2nd generation and 3rd generation devices potentially allows attackers to deliver security-relevant commands via an audio signal between 16 and 22 kHz, often outside the range of human adult hearing.
A stored cross-site scripting (XSS) vulnerability in Cloudogu GmbH SCM Manager versions 1.2 to 1.60 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description text field.
Netbox v3.5.1 has a stored XSS vulnerability in the Create Regions (/dcim/regions/) function that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
A stored cross-site scripting (XSS) vulnerability in the Create Contacts (/tenancy/contacts/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
A stored cross-site scripting (XSS) vulnerability in the Create Rack (/dcim/rack/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
A stored cross-site scripting (XSS) vulnerability in the Create Sites (/dcim/sites/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
A vulnerability in Netbox v3.5.1 allows unauthenticated attackers to execute queries against the GraphQL database, potentially granting access to sensitive data stored in the database.
A stored XSS vulnerability in the Create Contact Roles function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
A stored cross-site scripting (XSS) vulnerability in the Create Tenants (/tenancy/tenants/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
Netbox v3.5.1 has a stored XSS vulnerability in the Create Power Panels function that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
A stored XSS vulnerability in the Create Site Groups function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
A stored XSS vulnerability in the Create Provider Accounts function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
A stored cross-site scripting (XSS) vulnerability in the Create Locations (/dcim/locations/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
A stored cross-site scripting (XSS) vulnerability in the Create Contact Groups (/tenancy/contact-groups/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
A stored cross-site scripting (XSS) vulnerability in the Create Providers (/circuits/providers/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
A stored XSS vulnerability in the Create Tenant Groups (/tenancy/tenant-groups/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS