CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Memory safety bug fixed in Firefox 152. This vulnerability also affects Firefox ESR 140.12 and Thunderbird 152 and 140.12.
Memory safety bug fixed in Firefox 152. This vulnerability was also fixed in Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
A memory safety bug was fixed in Firefox 152. This vulnerability was also fixed in Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
A vulnerability in the Web Audio component of Firefox and Thunderbird is caused by incorrect boundary conditions. The flaw was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
A use-after-free vulnerability was found in the Networking: HTTP component of Firefox and Thunderbird. It was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
A memory safety bug was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. This vulnerability could allow remote code execution or data leakage.
A privilege escalation vulnerability exists in the Graphics: WebRender component. It was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
The syracom AG Secure Login (2FA) plugin for Atlassian Jira, Confluence, and Bitbucket version 3.4.0.x contains an authentication bypass vulnerability. An attacker with valid login credentials can bypass the two-factor authentication process by sending crafted HTTP requests with a specific User-Agent header.
A stack-based buffer overflow vulnerability has been found in the NPort W2150A-W4/W2250A-W4 Series version 1.5 and earlier. This vulnerability stems from insufficient input validation of user-supplied input in the 'Server location' parameter on the Basic settings page.
The WP Review Slider Pro plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 12.6.8. Missing authorization checks and insufficient path validation allow attackers to delete files on the server.
The LatePoint – Calendar Booking Plugin for Appointments and Events for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to and including 5.5.1. The plugin chains three independent flaws that allow an authenticated Agent (Agent+) to overwrite a WordPress Administrator's password without invoking an Administrator-only API.
Due to the improper neutralization of special elements used in a name parameter, a low privileged remote attacker can exploit a command injection vulnerability in the Managed Ethernet Switch, resulting in full system compromise.
An unauthenticated Cross Site Scripting (XSS) vulnerability has been identified in Media Library Assistant versions up to 3.35. An attacker can exploit this flaw to inject malicious JavaScript code.
Versions of Pods <= 3.3.8 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
There is a SQL Injection vulnerability in Attendance Manager versions <= 0.6.2 that can be exploited by subscribers.
WooCommerce POS versions up to 1.8.14 have an issue with unauthenticated access that allows for broken access control.
The WP Sessions Time Monitoring Full Automatic plugin versions up to 1.1.4 is vulnerable to SQL Injection, allowing unauthorized users to access the database.
JupiterX Core versions up to 4.14.1 have a vulnerability in access control that allows unauthorized access to resources.
Versions of Min Max Step Quantity Limits Manager for WooCommerce up to 5.2.2 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious scripts.
A denial-of-service vulnerability exists in the WebSocket API due to insufficient validation and handling of JSON-based requests. A low-privileged authenticated attacker can send a specially crafted request that causes service disruption and may result in an unexpected device reboot.