CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x, contain security restrictions using non-canonical URLs which can be circumvented. The flaw allows bypassing these restrictions.
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x, allow certain web services to set property values which contain Spring templates that are interpreted downstream. This can lead to server-side template injection.
CVE-2023-1765 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in Akbim Computer Panon. This issue affects Panon versions before 1.0.2.
A Server-Side Request Forgery (SSRF) vulnerability was discovered in request-baskets up to version 1.2.1 via the /api/baskets/{name} component. Attackers can access network resources and sensitive information by crafting a malicious API request.
A Server-Side Request Forgery (SSRF) vulnerability was discovered in openapi-generator up to version 6.4.0 in the /api/gen/clients/{language} component. It allows attackers to access network resources and sensitive information via a crafted API request.
An SSRF vulnerability in forem up to v2022.11.11 allows an attacker to send a crafted POST request to the /articles/{id} endpoint, enabling access to network resources and sensitive information.
Appwrite up to version 1.2.1 was found to contain a Server-Side Request Forgery (SSRF) vulnerability in the /v1/avatars/favicon component. This allows attackers to access network resources and sensitive information via a crafted GET request.
Podatność CVE-2023-1060 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w systemie YKM CRM, co pozwala na ataki typu Reflected XSS. Problem ten dotyczy wersji YKM CRM przed 23.03.30.
W curl w wersjach poniżej 8.0 występuje podatność związana z walidacją danych wejściowych podczas komunikacji za pomocą protokołu TELNET. Atakujący może przesłać złośliwie skonstruowaną nazwę użytkownika oraz 'opcje telnet' podczas negocjacji z serwerem.
The Infoline Project Management System has a Server-Side Request Forgery (SSRF) vulnerability that allows attackers to send malicious requests from the server. This issue affects versions before 4.09.31.125.
Podatność CVE-2023-1014 dotyczy niewłaściwej ochrony dla wychodzących komunikatów o błędach i sygnałów alarmowych w systemie Vira-Investing, co umożliwia przeprowadzenie ataku typu Account Footprinting. Problem ten dotyczy wersji Vira-Investing przed 1.0.84.86.
Podatność CVE-2023-1013 dotyczy niewłaściwej neutralizacji tagów HTML związanych z skryptami w aplikacji Vira-Investing, co umożliwia ataki typu Cross-Site Scripting (XSS). Problem ten występuje w wersjach przed 1.0.84.86.
A use-after-free flaw was found in nfsd4_ssc_setup_dul in the NFS filesystem in the Linux Kernel. This issue could allow a local attacker to crash the system or it may lead to a kernel information leak problem.
Suprema BioStar 2 v2.8.16 was discovered to contain a SQL injection vulnerability via the 'values' parameter at /users/absence?search_month=1. An attacker can exploit this flaw to manipulate database queries.
Wtyczka GMAce dla WordPressa jest podatna na atak typu Cross-Site Request Forgery w wersjach do 1.5.2 włącznie. Problem wynika z braku walidacji nonce w funkcji gmace_manager_server wywoływanej przez akcję AJAX wp_ajax_gmace_manager.
Problem z podniesieniem uprawnień w instalatorze M-Files w wersjach przed 22.6 na systemie Windows umożliwia użytkownikowi uzyskanie uprawnień SYSTEM poprzez atak DLL hijacking.
A Local File Inclusion (LFI) vulnerability in Stimulsoft Designer (Web) 2023.1.3 allows an attacker to read arbitrary files from the server. The flaw is due to improper validation of file paths in the application.
Stimulsoft Designer (Web) 2023.1.3 is vulnerable to SSRF. The server makes requests to external data sources, which can be exploited to leak data from the internal network.
In Stimulsoft Designer (Desktop) versions 2023.1.5 and 2023.1.4, after decompiling the Stimulsoft.report.dll library, an attacker can decrypt any connection string stored in .mrt files because a static secret is used. This secret is identical across all tested versions and operating systems.
A vulnerability in Stimulsoft products allows remote code execution. Versions 2023.1.4 (Designer Desktop) and 2023.1.3 (Designer Web and Viewer Web) do not restrict access to the local file system, enabling an attacker to read and write files and directories. The attacker can also prepare a report with a variable holding gathered data and render it.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS