CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Podatność w Microsoft Exchange Server umożliwia zdalne wykonanie kodu. Atakujący może wykorzystać tę lukę do przejęcia kontroli nad systemem.
Remote code execution vulnerability in Microsoft SQL Server. Could allow arbitrary code execution on the server.
An XML External Entity (XXE) vulnerability in ureport v2.2.9 allows attackers to execute arbitrary code by uploading a crafted XML file to /ureport/designer/saveReportFile.
W systemie zamawiania jedzenia w wersji 2.0 odkryto podatność na atak typu SQL injection poprzez parametr email.
W systemie zamówień żywności w wersji 2.0 występuje podatność na przesyłanie dowolnych plików w komponencie /fos/admin/ajax.php, co pozwala atakującym na wykonanie dowolnego kodu za pomocą spreparowanego pliku PHP.
Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_username=admin&password=password$(curl substring.
A directory traversal vulnerability was discovered in ureport version 2.2.9 within the deletion function, allowing arbitrary file deletion.
Comfast CF-WR6110N router version V2.3.1 has an improper input validation vulnerability. A remote attacker on the same network can send a crafted HTTP POST request and execute arbitrary code on the device.
In the Comfast CF-WR6110N router version V2.3.1, an incorrect access control vulnerability was found. A remote attacker on the same network can send any HTTP request to an unauthenticated page, forcing the server to generate a SESSION_ID. Using this SESSION_ID, the attacker can then perform authenticated requests.
CVE-2022-4557 describes an improper neutralization of special elements used in SQL commands, leading to SQL Injection vulnerability in Smartpower Web.
CVE-2022-45090 describes an improper input validation vulnerability in Group Arge Energy and Control Systems Smartpower Web, allowing for SQL Injection.
Improper Input Validation vulnerability in Group Arge Energy and Control Systems Smartpower Web allows SQL Injection. This issue affects Smartpower Web: before 23.01.01.
Improper Input Validation vulnerability in Group Arge Energy and Control Systems Smartpower Web allows PHP Local File Inclusion. This issue affects Smartpower Web: before 23.01.01.
Wtyczka ImageMagick Engine dla WordPressa jest podatna na deserializację nieufnych danych wejściowych poprzez parametr 'cli_path' w wersjach do 1.7.5 włącznie. Umożliwia to nieautoryzowanym użytkownikom wywoływanie plików za pomocą opakowania PHAR, pod warunkiem, że zdołają oszukać administratora strony do wykonania akcji, która deserializuje i wywołuje dowolne obiekty PHP.
Tinacms to system zarządzania treścią oparty na Git, który wspiera edycję wizualną. Wersje @tinacms/cli od 1.0.0 do 1.0.9, które przechowują wrażliwe dane w zmiennej process.env, są narażone na ujawnienie tych danych w pliku index.js.
An issue discovered in src/wallet/wallet.cpp in Ravencoin Core 4.3.2.1 and earlier allows attackers to view sensitive information via the CWallet::CreateTransactionAll() function.
TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.
An issue discovered in src/wallet/wallet.cpp in Dogecoin Core 1.14.3 and earlier allows attackers to view sensitive information via the CWallet::CreateTransaction() function.
SQL Injection vulnerability in the provisioning service of Talend ESB Runtime before versions 8.0.1-R2022-10-RT and 7.3.1-R2022-09-RT. An attacker can inject malicious SQL queries through this service.
Fortra GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS