CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Wtyczka UserPro dla WordPressa jest podatna na nieautoryzowane resetowanie haseł w wersjach do 5.1.1 włącznie. Problem wynika z niewystarczającej walidacji funkcji resetowania hasła, która używa wartości w postaci czystego tekstu zamiast wartości haszowanej.
Wtyczka UserPro dla WordPressa jest podatna na obejście uwierzytelnienia w wersjach do 5.1.1 włącznie. Problem wynika z niewystarczającej weryfikacji użytkownika podczas logowania przez Facebooka, co umożliwia nieautoryzowanym atakującym logowanie się jako dowolny istniejący użytkownik na stronie.
CVE-2023-2889 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in Veon Computer Service Tracking Software before crm version 2.0.
CVE-2023-5047 describes an improper neutralization of special elements used in SQL commands, leading to SQL Injection vulnerabilities in the DRDrive system.
In ownCloud core before version 10.13.1, an attacker can access, modify, or delete any file without authentication if the victim's username is known and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no signing-key is configured for the file owner. The earliest affected version is 10.6.0.
An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment (phpinfo). This information includes all the environment variables of the webserver. In containerized deployments, these environment variables may include sensitive data such as the ownCloud admin password, mail server credentials, and license key.
In Firefox for iOS, an attacker could access internal pages or data by exfiltrating a security key from ReaderMode via the referrerpolicy attribute. This affects Firefox for iOS versions prior to 120.
An issue was discovered in MISP before version 2.4.176 related to mishandling parameter parsing in app/Controller/AppController.php.
An issue was discovered in MISP before version 2.4.176 related to the lack of a checkParam function in app/Model/AppModel.php, which should validate alphanumerics, underscores, dashes, periods, and spaces.
An issue was discovered in MISP before version 2.4.176 related to mishandling filters in app/Model/AppModel.php.
An issue was discovered in MISP before version 2.4.176 related to mishandling order clauses in app/Model/AppModel.php.
An issue was discovered in MISP before version 2.4.176, where the IndexFilterComponent.php does not properly filter out query parameters.
Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backend server that hosts the repository application.
Urządzenia dotknięte tą podatnością nieprawidłowo sanitizują pole wejściowe. Może to umożliwić zdalnemu atakującemu z uprawnieniami administratora wstrzyknięcie kodu lub uruchomienie powłoki systemowej z uprawnieniami roota.
Incorrect access control in the Forgot Your Password function of eMudhra emSigner v2.8.7 allows unauthenticated attackers to access accounts of all registered users, including administrators, via a crafted password reset token.
OpenVPN versions 2.6.0 to 2.6.6 contain a use after free vulnerability that may lead to undefined behavior, leaking memory buffers, or remote code execution when sending network buffers to a remote peer.
Path traversal vulnerability in SysAid On-Premise before 23.3.36, allowing file write to Tomcat webroot leading to code execution. Exploited in the wild in November 2023.
Videolan VLC prior to version 3.0.20 contains an incorrect offset read that leads to a Heap-Based Buffer Overflow in function GetPacket() and results in memory corruption.
W podatności CVE-2023-38382 występuje niewłaściwa neutralizacja specjalnych elementów używanych w poleceniu SQL, co prowadzi do możliwości ataku typu SQL Injection w aplikacji Subscribe to Category. Problem ten dotyczy wersji od n/a do 2.7.4.
Podatność CVE-2023-36529 dotyczy niewłaściwej neutralizacji specjalnych elementów używanych w poleceniach SQL w motywie Houzez - Real Estate dla WordPressa, co umożliwia atak typu SQL Injection. Problem ten dotyczy wersji motywu od n/a do 1.3.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS