CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
There is a NULL pointer dereference bug in the GitHub repository gpac/gpac prior to version 2.3-DEV.
Heap-based buffer overflow exists in the GitHub repository gpac/gpac prior to version 2.3-DEV.
There is a NULL Pointer Dereference vulnerability in the GitHub repository gpac/gpac prior to version 2.3-DEV.
There is a divide by zero error in the GitHub repository gpac/gpac prior to version 2.3-DEV.
Versions 3.6.1.25 and prior of Zscaler Proxy have inappropriate file type control, allowing local attackers to bypass file download/upload restrictions.
Multiple reflected XSS vulnerabilities in the ErroreNonGestito.aspx component of GruppoSCAI RealGimm 1.1.37p38 allow attackers to execute arbitrary Javascript in the context of a victim user's browser via a crafted payload injected into the VIEWSTATE parameter.
A XML External Entity (XXE) vulnerability in the VerifichePeriodiche.aspx component of GruppoSCAI RealGimm v1.1.37p38 allows attackers to read any file in the filesystem via supplying a crafted XML file.
IBM Security Verify Information Queue versions 10.0.4 and 10.0.5 could allow a remote attacker to obtain sensitive information that could aid in further attacks against the system.
IBM Security Verify Information Queue versions 10.0.4 and 10.0.5 could allow a remote attacker to obtain sensitive information that could aid in further attacks against the system.
CVE-2023-41741 describes a vulnerability that exposes sensitive information to unauthorized actors in the cgi component of Synology Router Manager (SRM) before version 1.3.1-9346-6. Remote attackers can obtain sensitive information via unspecified vectors.
CVE-2023-41740 describes an improper limitation of a pathname to a restricted directory in the cgi component of Synology Router Manager (SRM) before version 1.3.1-9346-6. This allows remote attackers to read specific files via unspecified vectors.
CVE-2023-41739 in Synology Router Manager (SRM) before version 1.3.1-9346-6 has an uncontrolled resource consumption vulnerability that can be exploited by remote authenticated users to conduct denial-of-service attacks.
The Order Tracking Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the order status parameter in versions up to and including 3.3.6 due to insufficient input sanitization and output escaping. This allows authenticated attackers (admin or higher) to inject arbitrary web scripts on pages.
The Order Tracking Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) via the start_date and end_date parameters in versions up to and including 3.3.6 due to insufficient input sanitization and output escaping.
The Woo Custom Emails for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wcemails_edit' parameter in versions up to and including 2.2 due to insufficient input sanitization and output escaping.
The WooCommerce PDF Invoice Builder for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the GetInvoiceDetail function in versions up to and including 1.2.89. This allows subscribers to view arbitrary invoices if they can guess the order id and invoice id.
The WooCommerce PDF Invoice Builder for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the SaveCustomField function in versions up to and including 1.2.90. This allows unauthenticated attackers to create invoice fields if they can trick an admin into performing an action such as clicking on a link.
The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via admin settings in versions up to and including 1.2.90 due to insufficient input sanitization and output escaping.
The Waiting: One-click countdowns plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 0.6.2. This is due to missing or incorrect nonce validation on its AJAX actions, allowing unauthenticated attackers to create and delete countdowns.
The Waiting: One-click countdowns plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on its AJAX calls in versions up to and including 0.6.2. This allows authenticated attackers with subscriber-level permissions and above to create and delete countdowns as well as manipulate other plugin settings.