CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
System rezerwacji myjni samochodowej w wersji 1.0 jest podatny na atak typu SQL Injection poprzez endpoint /ocwbs/classes/Master.php?f=delete_booking.
System rezerwacji myjni samochodowych online w wersji 1.0 jest podatny na atak typu SQL Injection poprzez endpoint /ocwbs/admin/?page=bookings/view_details&id=.
Simple Inventory System v1.0 is vulnerable to SQL Injection via /inventory/table_edit_ajax.php. Unsanitized input allows injection of malicious SQL code.
Simple Inventory System v1.0 is vulnerable to SQL Injection via /inventory/login.php. This allows an attacker to manipulate database queries.
Badminton Center Management System V1.0 is vulnerable to SQL Injection via the 'id' parameter in /bcms/admin/court_rentals/update_status.php. An attacker can exploit this flaw to execute unauthorized database queries.
A vulnerability in Flower, a web UI for the Celery framework, allows bypassing OAuth authentication. An attacker can access the Flower API to invoke arbitrary Celery RPC calls or shut down task nodes, causing denial of service.
A directory traversal vulnerability was found in Webbank WeCube version 3.2.2. Attackers can exploit this issue by uploading a crafted ZIP file to access files outside the intended directory.
libcurl has an issue with reusing previously created connections even when TLS or SSH-related options have been changed that should prohibit reuse. Several TLS and SSH settings were left out from the configuration match checks, making them match too easily.
libcurl provides the `CURLOPT_CERTINFO` option to allow applications to request details about a server's certificate chain. Due to an erroneous function, a malicious server could make libcurl built with NSS get stuck in a never-ending busy-loop when trying to retrieve that information.
An information disclosure vulnerability exists in curl versions 7.65.0 to 7.82.0 that allows reusing a connection using an IPv6 address with a different zone id.
A vulnerability in ACEweb Online Portal 3.5.065 allows an unauthenticated attacker to capture SMB hashes by specifying an external UNC path when uploading a file. The attacker can trick the victim server into disclosing the username and password hash of the user running the ACEweb Online software.
ACEweb Online Portal 3.5.065 was discovered to contain an External Controlled File Path and Name vulnerability via the txtFilePath parameter in attachments.awp.
ACEweb Online Portal 3.5.065 was found to have a SQL injection vulnerability via the 'criteria' parameter in showschedule.awp. An attacker can manipulate database queries, potentially leading to unauthorized data access.
ACEweb Online Portal 3.5.065 was discovered to contain an unrestricted file upload vulnerability via attachments.awp. This allows an attacker to upload arbitrary files to the server.
ACEweb Online Portal 3.5.065 was found to have a cross-site scripting (XSS) vulnerability via the txtNmName1 parameter in person.awp. An attacker can inject malicious JavaScript code that executes in the victim's browser.
The TOTOLINK EX1200T device with firmware version V4.1.2cu.5215 is affected by a command injection vulnerability that allows remote arbitrary code execution.
A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights.
Wersje Dell PowerScale OneFS od 8.2.0.x do 9.3.0.x zawierają lukę związaną z słabymi wymaganiami dotyczącymi haseł. Administrator może utworzyć konto bez hasła, co stwarza ryzyko dla bezpieczeństwa.
An out-of-bounds write issue in Apple systems was addressed with improved bounds checking. This affects tvOS 15.5, watchOS 8.6, macOS Big Sur 11.6.6, macOS Monterey 12.3.1, iOS 15.4.1, and iPadOS 15.4.1. An application may execute arbitrary code with kernel privileges.
An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in macOS Monterey 12.3.1, Security Update 2022-004 Catalina, macOS Big Sur 11.6.6. A local user may be able to read kernel memory.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS