CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Domyślna konfiguracja Crimson 3.1 (wersje kompilacji przed 3119.001) pozwala użytkownikowi na odczyt i modyfikację bazy danych bez uwierzytelnienia.
A change introduced in Apache Flink 1.11.0 allows attackers to read any file on the local filesystem of the JobManager through the REST interface. Access is restricted to files accessible by the JobManager process. The issue was fixed in Flink 1.11.3 and 1.12.0.
Wtyczka Divi Builder oraz motywy Divi i Divi Extra przed wersją 4.5.3 dla WordPressa mają lukę, która pozwala uwierzytelnionym atakującym z uprawnieniami co najmniej na poziomie współpracownika na przesyłanie dowolnych plików, w tym plików .php. Problem wynika z tego, że sprawdzenie rozszerzeń plików odbywa się po stronie klienta.
EGavilanMedia User Registration and Login System With Admin Panel 1.0 is vulnerable to cross-site scripting (XSS) in the Admin Profile Page. An attacker can inject a malicious JavaScript payload into the 'Admin Full Name' field, which triggers every time the admin visits the profile page.
EGavilanMedia User Registration and Login System With Admin Panel 1.0 is vulnerable to cross-site scripting (XSS) in the Admin Panel - Manage User tab via the Full Name field. An attacker can inject a malicious JavaScript payload during user registration, which triggers when the admin visits the manage user section, potentially stealing session cookies.
EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by SQL injection in the User Login Page. An attacker can manipulate input fields to execute unauthorized SQL queries against the database.
Invision Community 4.5.4 is affected by a cross-site scripting (XSS) vulnerability in the Field Name field. An attacker can inject a malicious JavaScript payload that executes whenever a user opens that field.
The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerability could allow a remote attacker to bypass authentication and execute API commands which may result in a compromise of the SolarWinds instance. SolarWinds Orion Platform versions 2019.4 HF 5, 2020.2 with no hotfix installed, and 2020.2 HF 1 are affected.
An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.
FasterXML jackson-databind w wersjach 2.x przed 2.9.10.8 niewłaściwie obsługuje interakcję między gadżetami serializacji a typowaniem, co jest związane z com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (znanym jako osadzony Xalan w org.glassfish.web/javax.servlet.jsp.jstl).
WonderCMS 3.1.3 is vulnerable to cross-site scripting (XSS) in the Admin Panel. An attacker can inject a malicious JavaScript payload in the Page keywords field, which triggers on every visit to the website, allowing theft of session cookies.
A vulnerability in TerraMaster TOS version 4.2.06 and earlier allows remote authenticated attackers to bypass read-only restrictions and gain full access to any folder on the NAS.
Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.
EgavilanMedia ECM Address Book 1.0 is vulnerable to SQL injection. An attacker can bypass the Admin Login panel and gain full administrative access.
CoasterCMS version 5.8.18 is vulnerable to Cross-Site Scripting (XSS). An attacker can steal a user's session cookie and redirect them to a malicious website, as the vulnerability is triggered on the main home page of the application.
DotCMS Add Template with admin panel 20.11 is affected by stored Cross-Site Scripting (XSS) that allows an attacker to steal cookies and gain remote privileges. This compromises the security of the web application.
A CSRF vulnerability in EgavilanMedia User Registration & Login System with Admin Panel 1.0 allows an attacker to remotely gain privileges in the User Profile panel. The attacker can update any user's account without their knowledge.
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource.
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource.
Wersje curl od 7.21.0 do 7.73.0 są podatne na niekontrolowaną rekurencję z powodu problemu z przepełnieniem stosu podczas analizy dopasowania dzikich kart w FTP.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS