CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A SQL injection vulnerability was discovered in Jeecg-boot v3.4.3 within the updateNullByEmptyString component. Attackers can exploit this flaw to manipulate database queries.
A SQL injection vulnerability was discovered in Jeecg-boot version 3.4.3 via the /sys/duplicate/check component. An attacker can exploit this flaw to execute unauthorized database queries.
Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability in the /sys/dict/queryTableData component. An attacker can exploit this flaw to execute unauthorized database queries.
PyroCMS 3.9 is vulnerable to a stored XSS attack, allowing a low-privileged user (e.g., author) to inject malicious HTML and JavaScript into blog post content. This can lead to full admin account takeover or privilege escalation.
Orchard CMS 1.10.3 is vulnerable to Cross-Site Scripting (XSS). A low-privileged user (author or publisher) can inject malicious HTML and JavaScript into a blog post, leading to full admin account takeover or privilege escalation when the post is viewed by an administrator.
W systemach Wind River VxWorks 6.9 i 7 odkryto problem, który pozwala na wysłanie specjalnie skonstruowanego pakietu przez serwer Radius, co może prowadzić do awarii usługi podczas procedury dostępu IP Radius.
Heap-based buffer overflow in Vim 9.0.0946 and below, allowing an attacker to use CTRL-W gf in the expression used on the RHS of the substitute command.
An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvbdev.c has a use-after-free, related to dvb_register_device dynamically allocating fops.
Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
The Amasty Blog Pro plugin versions 2.10.3 and 2.10.4 for Magento 2 contain a Stored Cross-site Scripting (XSS) vulnerability due to the duplicate post function.
The vulnerability in Maarch RM 2.8.3 is due to improper restriction of excessive authentication attempts, manifested by overly verbose responses from the application. An unauthenticated remote attacker could exploit this flaw to perform brute-force attacks on user accounts.
Amasty Blog version 2.10.3 is vulnerable to Cross-Site Scripting (XSS) via the leave comment functionality. This allows an attacker to inject malicious JavaScript code into the page.
A broken access control vulnerability was found in Maarch RM 2.8.3. When previewing documents (PDF, email) from an archive, the application generates a URL containing an MD5 hash of the file, which is accessible without authentication.
An authenticated SQL Injection vulnerability in the statistics page (/statistics/retrieve) of Maarch RM 2.8, via the filter parameter, allows the complete disclosure of all databases.
A buffer overflow vulnerability was discovered in Netgear R7000P firmware version V1.3.0.8. The issue occurs when processing the apmode_dns1_pri and apmode_dns1_sec parameters.
ERP Sankhya before version v4.11b81 was found to contain a cross-site scripting (XSS) vulnerability in the Caixa de Entrada component. This allows an attacker to inject malicious JavaScript code into the page.
The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via crafted data due to insufficient restrictions on the database data type.
The NdkAdvancedCustomizationFields plugin version 3.5.0 for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via the rotateimg.php file. An attacker can exploit this to send requests from the server to internal network resources.
A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker with internal network access to conduct a command-injection attack, due to insufficient restriction of URL parameters.
Fusiondirectory 1.3 is vulnerable to Cross Site Scripting (XSS) via URL parameters. An attacker can inject malicious script through the message and plug parameters in several application paths.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS