CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in Microsoft Azure Kubernetes Service Confidential Container allows remote code execution. An attacker could exploit it to execute arbitrary code within the confidential container context.
A vulnerability in Microsoft Azure Site Recovery allows elevation of privilege. An attacker could exploit it to gain higher privileges in the Azure Site Recovery environment.
Podatność związana z deserializacją niezaufanych danych w dodatku G5Theme ERE Recently Viewed – Essential Real Estate. Problem ten dotyczy wersji dodatku od n/a do 1.3.
Podatność CVE-2024-25100 dotyczy programu poleceń kuponów WP Swings, który pozwala na deserializację niezaufanych danych, co prowadzi do wstrzyknięcia obiektów. Problem ten dotyczy wersji programu przed 1.8.4.
CVE-2023-6677 describes an improper neutralization of special elements used in SQL commands, leading to SQL Injection vulnerabilities in Oduyo Financial Technology Online Collection. This issue affects versions of Online Collection before 1.0.2.
An issue was discovered in MISP before version 2.4.184, allowing a client to start an export generation process without needing to use POST. This is related to app/Controller/JobsController.php and app/View/Events/export.ctp.
An issue was discovered in MISP before version 2.4.184 related to insecure organization logo uploads due to a lack of checks for file extension and MIME type.
An out-of-bounds write in Fortinet FortiOS and FortiProxy allows an attacker to execute unauthorized code or commands via specifically crafted requests. Affects multiple versions of FortiOS and FortiProxy.
An issue in Dlink DIR-816A2 v.1.10CNB05 allows a remote attacker to execute arbitrary code via the wizardstep4_ssid_2 parameter in the sub_42DA54 function.
Wtyczka WP Booking Calendar dla WordPressa jest podatna na atak typu SQL Injection poprzez parametr 'calendar_request_params[dates_ddmmyy_csv]' we wszystkich wersjach do i włącznie z 9.9. Problem wynika z niewystarczającego zabezpieczenia dostarczonego przez użytkownika oraz braku odpowiedniego przygotowania istniejącego zapytania SQL.
An OS command injection vulnerability in Hardy Barth cPH2 eCharge charging station version 1.87.0 and earlier. An unauthenticated remote attacker can execute arbitrary commands on the system via specially crafted arguments passed to the connectivity check feature.
A Directory Traversal vulnerability in Stimulsoft Dashboard.JS before version 2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload in the fileName parameter of the Save function.
Wtyczka Photo Gallery by 10Web – Mobile-Friendly Image Gallery dla WordPressa jest podatna na atak typu Directory Traversal we wszystkich wersjach do i włącznie z 1.8.19 poprzez funkcję rename_item. Umożliwia to uwierzytelnionym atakującym zmianę nazw dowolnych plików na serwerze.
Wtyczka Shield Security – Smart Bot Blocking & Intrusion Prevention dla WordPressa jest podatna na Local File Inclusion we wszystkich wersjach do 18.5.9 włącznie, poprzez parametr render_action_template. Umożliwia to nieautoryzowanemu atakującemu dołączenie i wykonanie plików PHP na serwerze.
Podatność typu SQL Injection w systemie zarządzania zapasami w wersji 1.0 umożliwia zdalnemu atakującemu wykonanie dowolnego kodu poprzez parametr id w pliku manage_bo.php.
An issue in the Plone Docker Official Image 5.2.13 (5221) where a package listed in ++plone++static/components does not exist in the public npm package index, potentially allowing remote code execution.
CVE-2023-6675 vulnerability affects CyberMath, allowing unrestricted upload of files with dangerous types, enabling the upload of a web shell to a web server.
Vinchin Backup & Recovery v7.2 was discovered to be configured with default root credentials. This means the system comes with easily guessable login credentials out of the box.
Vinchin Backup & Recovery v7.2 was found to use default MySQL credentials. This allows an attacker to gain unauthorized access to the database without password cracking.
Remote command execution vulnerability in SE-elektronic GmbH E-DDC3.3 affecting versions 03.07.03 and higher. An attacker can send operating system commands to the device via the web configuration functionality.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS