CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A SQL injection vulnerability in SonicWall SSLVPN SMA100 allows a remote unauthenticated attacker to perform SQL queries to access usernames, passwords, and other session-related information. This affects SMA100 build version 10.x.
The vulnerability has been reported to affect earlier versions of QTS. If exploited, this improper access control vulnerability could allow attackers to compromise the security of the software by gaining privileges or reading sensitive information. This issue affects QNAP Systems Inc. Helpdesk versions prior to 3.0.3.
D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system_mgr.cgi component, which can lead to remote arbitrary code execution.
An issue was discovered on D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20. A buffer overflow in the web interface allows attackers to achieve pre-authentication remote code execution.
W jądrze Linuxa do wersji 5.10.11 odkryto problem związany z używaniem zwolnionego stosu jądra podczas obsługi błędów w PI futexach. Umożliwia to lokalnym użytkownikom wykonanie kodu w jądrze.
In the OpenWire protocol of Apache ActiveMQ Artemis 2.15.0, a vulnerability was found that allowed bypassing policy-based access control when creating advisory messages for the entire session. The production of these messages was not subject to access control in error.
The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid user's password in error, resulting in no check on the password.
A stored XSS vulnerability was found in BDTASK Multi-Store Inventory Management System 1.0. A local admin can inject arbitrary JavaScript code via the Customer Name field.
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow. This allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
In CKEditor 4 before 4.16, it was possible to execute a ReDoS-type attack by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin).
In CKEditor 4 before 4.16, it was possible to execute a ReDoS-type attack by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the Advanced Tab for Dialogs plugin).
A cross-site scripting (XSS) vulnerability exists in the Add Patient Form of QDOCS Smart Hospital Management System 3.1. A remote attacker can inject arbitrary JavaScript code via fields such as Name, Guardian Name, Email, Address, Remarks, or Any Known Allergies.
Textpattern 4.8.4 is affected by cross-site scripting (XSS) in the Body parameter, allowing an attacker to inject malicious scripts. This can lead to session theft or user redirection.
A vulnerability in reset-password.php in ProjectSend before r1295 allows remote attackers to reset a user's password due to incorrect business logic. Errors are not properly considered, specifically an invalid token parameter.
A cross-site scripting (XSS) vulnerability exists in MISP v2.4.128 in the SetHomePage() function in app/Controller/UserSettingsController.php. Due to a lack of controller validation in the 'path' parameter, an attacker can execute malicious JavaScript code.
Serwer API Kubernetes we wszystkich wersjach pozwala atakującemu, który potrafi stworzyć usługę ClusterIP i ustawić pole spec.externalIPs, na przechwycenie ruchu do tego adresu IP. Dodatkowo, atakujący, który ma możliwość modyfikacji statusu usługi LoadBalancer, może ustawić status.loadBalancer.ingress.ip w podobny sposób.
A vulnerability in the STM32 cryptographic firmware library (UM1924) allows a Bleichenbacher attack on PKCS #1 v1.5 padding for RSA. An attacker can remotely decrypt encrypted ciphertext by making successive queries to the server using the vulnerable library.
The Stockdio Historical Chart plugin for WordPress before version 2.8.1 is vulnerable to Cross-Site Scripting (XSS). The stockdio_eventer function listens for postMessage events without validating the origin, allowing an attacker to execute arbitrary JavaScript in the victim's browser.
A flaw in jackson-databind before 2.9.10.7 mishandles the interaction between serialization gadgets and typing. The highest threat is to data confidentiality, integrity, and system availability.
MISP version 2.4.136 has an XSS vulnerability that can be exploited via a crafted URL to the user homepage favourite button in app/View/Elements/global_menu.ctp.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS