CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SmartVista SVFE2 v2.2.22 was found to contain a SQL injection vulnerability via the UserForm:j_id90 parameter at /feegroups/tgrt_group.jsf. An attacker can exploit this flaw to manipulate database queries.
An issue in MSI Feature Navigator v1.0.1808.0901 allows attackers to download arbitrary files from the system, regardless of file type or size.
A vulnerability in MSI Feature Navigator v1.0.1808.0901 allows attackers to write arbitrary files to the \PromoPhoto\ directory, regardless of file type or size.
A vulnerability in the Feature Navigator of Micro-Star International MSI Feature Navigator version 1.0.1808.0901 allows attackers to cause a Denial of Service (DoS) via a crafted image or video file.
Leptonica linked library version 1.79.0 contains a flaw that allows attackers to trigger an arithmetic exception via a crafted JPEG file. This results in a Denial of Service (DoS) of the application using the library.
Netmaker prior to version 0.15.1 had an improper authorization issue that allowed non-privileged users to execute privileged API calls. Users added to the Netmaker platform without admin privileges could use their auth tokens to run admin-level functions via the API.
SmartVista SVFE2 v2.2.22 was found to contain multiple SQL injection vulnerabilities in the UserForm:j_id88, UserForm:j_id90, and UserForm:j_id92 parameters at /SVFE2/pages/feegroups/service_group.jsf. An attacker can exploit these flaws to manipulate database queries.
A vulnerability in the IGB Files and OutfileService features of SmartVista Cardgen v3.28.0 allows attackers to list and download arbitrary files by modifying the PATH parameter.
A Path Traversal vulnerability in SmartVista Cardgen v3.28.0 allows authenticated attackers to read arbitrary files on the system.
A command injection vulnerability was discovered in Netgear R6200 v2 firmware up to version R6200v2-V1.0.3.12 in the binary /sbin/acos_service. It allows remote authenticated attackers to modify values in the vulnerable parameter.
An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, this could allow an attacker to modify system files. The vulnerability has been fixed in specific versions of Photo Station for various QTS versions.
A vulnerability in the PlexTrac platform prior to version 1.28.0 allows username enumeration via HTTP response time differences on invalid login attempts for accounts configured with the PlexTrac authentication provider. An unauthenticated remote attacker can identify valid, unlocked user accounts.
The PlexTrac platform prior to version 1.17.0 does not restrict excessive authentication attempts for accounts using the built-in authentication provider. An unauthenticated remote attacker can perform a brute-force attack on the login page with no time or attempt limitations.
The PlexTrac platform prior to API version 1.17.0 does not restrict excessive MFA TOTP submission attempts. An unauthenticated remote attacker in possession of a valid username and password can bruteforce their way past MFA protections to login as the targeted user.
CVE-2022-36083 affects JWE key management algorithms based on PBKDF2, which can be exploited to perform brute-force attacks by manipulating the `p2c` parameter. If misconfigured, an attacker can force disproportionate CPU resource consumption during JWE decryption.
A vulnerability in NETGEAR R6200v2 and R6300v2 router firmware allows remote authenticated attackers to execute arbitrary system commands by sending crafted parameters to the ipv6_fix.cgi script.
Outbyte PC Repair Installer version 1.7.112.7856 is vulnerable to DLL hijacking. The missing iertutil.dll allows an attacker to place a malicious DLL with the same name, leading to privilege escalation to administrator level.
Use-after-free in Vim prior to version 9.0.0389.
Wtyczka JoomSport – dla sportów: drużyny i ligi, piłka nożna, hokej i inne dla WordPressa jest podatna na atak typu SQL Injection poprzez parametr 'orderby' na stronie joomsport-page-extrafields w wersjach do 5.2.5 włącznie. Problem wynika z niewystarczającego zabezpieczenia dostarczonego przez użytkownika parametru oraz braku odpowiedniego przygotowania istniejącego zapytania SQL.
Wtyczka JoomSport – dla sportów: drużyny i ligi, piłka nożna, hokej i inne dla WordPressa jest podatna na atak typu SQL Injection poprzez parametr 'orderby' na stronie joomsport-events-form w wersjach do 5.2.5 włącznie. Problem wynika z niewystarczającego zabezpieczenia parametru dostarczonego przez użytkownika oraz braku odpowiedniego przygotowania istniejącego zapytania SQL.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS