CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in the wild in October 2021 for ransomware installation. SQL injection can, for example, use the txtID (aka username) parameter. Successful exploitation can include the ability to execute arbitrary code as MSSQLSERVER$ via xp_cmdshell.
In Oracle PeopleSoft Enterprise CS Campus Community (Notification Framework) versions 9.0 and 9.2, a low-privileged attacker with physical access to the communication segment can gain unauthorized access to critical data or all accessible data.
A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.5.1, iOS 14.7.1 and iPadOS 14.7.1, watchOS 7.6.1. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited.
An issue was discovered in the scanallsubs function in src/sbbs3/scansubs.cpp in Synchronet BBS, which may allow attackers to view sensitive information due to an uninitialized value.
Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication. The vulnerability enables remote execution of system commands with the highest privileges.
A Cross-Site Request Forgery (CSRF) vulnerability was discovered in PHPMyWind 5.6, allowing attackers to create a new administrator account without authentication.
A SQL injection vulnerability has been discovered in zz cms version 2019 in the subzs.php component. It allows attackers to retrieve sensitive data from the database.
A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.
A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.
Win32k Elevation of Privilege Vulnerability. Technical details are not provided in the description, but it is a vulnerability allowing privilege escalation.
Win32k Elevation of Privilege Vulnerability. Technical details are not provided in the description, but it is a vulnerability allowing privilege escalation.
Win32k Elevation of Privilege Vulnerability. Technical details are not provided in the description, but it is a vulnerability allowing privilege escalation.
SAP Business One w wersji 10.0 umożliwia atakującemu wstrzykiwanie formuł podczas eksportu danych do Excela (atak CSV) z powodu niewłaściwego oczyszczania danych podczas eksportu. Atakujący może w ten sposób wykonać dowolne polecenia na komputerze ofiary, pod warunkiem, że ofiara zezwoli na wykonywanie makr podczas otwierania pliku, a ustawienia zabezpieczeń Excela pozwolą na wykonanie poleceń.
An issue was discovered in aspeed_lpc_ctrl_mmap in the Linux kernel before 5.14.6. Local attackers with access to the Aspeed LPC control interface could overwrite kernel memory and potentially execute privileges. This occurs because a certain comparison uses values that are not memory sizes.
rConfig 3.9.6 is affected by a Local File Disclosure vulnerability. An authenticated user may successfully download any file on the server.
In rConfig 3.9.6, insecure permissions for the chmod command exist. After installation, the apache user can execute chmod as root without a password, allowing a low-privilege attacker to gain root access to the server.
SQL Injection vulnerability in rConfig 3.9.6 allows an authenticated attacker to inject malicious SQL code. If the MySQL server does not have --secure-file-priv set and is on the same host as rConfig, the attacker can upload a webshell and gain remote access.
Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Use-after-free vulnerability in Portals in Google Chrome prior to 94.0.4606.61. A remote attacker who compromised the renderer process could potentially perform a sandbox escape via a crafted HTML page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS