CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.22)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Directory traversal vulnerability in SOY CMS versions 1.8.1 to 1.8.12 allows authenticated attackers to read arbitrary files via shop_id.
There is an untrusted search path vulnerability in the installers for JPKI user's software for individuals that allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
CSRF vulnerability in Uploader plugin version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
CSRF vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
The baserCMS Feed plugin version 3.0.10 and earlier has a cross-site request forgery (CSRF) vulnerability that allows remote attackers to hijack the authentication of administrators via unspecified vectors.
CSRF vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
CSRF vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
The Blog plugin in baserCMS version 3.0.10 and earlier has a cross-site request forgery (CSRF) vulnerability that allows remote attackers to hijack the authentication of administrators via unspecified vectors.
CSRF vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
The CSRF vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Version 3.0.10 and earlier of baserCMS contains a cross-site request forgery (CSRF) vulnerability that allows remote attackers to hijack the authentication of administrators and execute arbitrary PHP code via unspecified vectors.
H2O versions 2.0.3 and earlier and 2.1.0-beta2 and earlier allow remote attackers to cause a denial-of-service (DoS) via format string specifiers in a template file via fastcgi, mruby, proxy, redirect or reproxy.
Android Apps Money Forward prior to specified versions allow attackers to execute unintended operations via a specially crafted application.
CVE-2017-0623 is an elevation of privilege vulnerability in the HTC bootloader that allows a local malicious application to execute arbitrary code within the context of the bootloader. This issue is rated as High because it first requires compromising a privileged process.
CVE-2017-0622 describes an elevation of privilege vulnerability in the Goodix touchscreen driver that allows a local malicious application to execute arbitrary code within the kernel context. This issue is rated as High because it requires compromising a privileged process first.
A vulnerability in the Qualcomm camera driver allows a local malicious application to execute arbitrary code within the context of the kernel. It requires first compromising a privileged process.
CVE-2017-0620 is a privilege escalation vulnerability in the Qualcomm Secure Channel Manager driver that allows a local malicious application to execute arbitrary code within the kernel context. This issue is rated as High because it requires compromising a privileged process first.
The CVE-2017-0619 vulnerability in the Qualcomm pin controller driver may allow a local malicious application to execute arbitrary code within the kernel context. This issue is rated as High because it first requires compromising a privileged process.
CVE-2017-0618 is a vulnerability in the MediaTek command queue driver that allows a local malicious application to gain elevated privileges and execute arbitrary code within the kernel context. It requires compromising a privileged process first.
A vulnerability in the MediaTek video driver allows a local malicious application to execute arbitrary code within the context of the kernel. It first requires compromising a privileged process.