CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CVE-2023-4832 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in Aceka Company Management. This issue affects versions before 3072.
User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL Server, Enterprise Developer, and Enterprise Server (including variants such as Enterprise Test Server) in specific versions when LDAP-based authentication is used with certain configurations. The vulnerability allows authentication with any valid username regardless of password correctness, and sometimes even with an invalid username.
A command injection vulnerability was discovered in the D-Link DIR-816 A2 router running firmware version 1.10 B05. The flaw resides in the /goform/Diagnosis component.
W TSplus Remote Access w wersji do 16.0.2.14 odkryto problem, w którym dane uwierzytelniające są przechowywane w postaci niezaszyfrowanej w kodzie źródłowym HTML strony logowania.
W TSplus Remote Access w wersji do 16.0.2.14 odkryto problem związany z uprawnieniami. Niektóre katalogi w %PROGRAMFILES(X86)%\TSplus\UserDesktop\themes mają pełne uprawnienia kontrolne dla wszystkich użytkowników.
An issue was discovered in MoFi Network MOFI4500-4GXeLTE-V2 3.5.6-xnet-5052 allows attackers to bypass authentication and execute arbitrary code via crafted HTTP request.
Wtyczka Media Library Assistant dla WordPressa jest podatna na lokalne włączenie plików oraz zdalne wykonanie kodu w wersjach do 3.09 włącznie. Problem wynika z niewystarczających zabezpieczeń dotyczących ścieżek plików przekazywanych do parametru 'mla_stream_file'.
A file upload vulnerability in bolo-solo version 2.6 allows a remote attacker to execute arbitrary code by sending a crafted script in the authorization header. This can lead to full server compromise.
CVE-2023-4531 describes an improper neutralization of special elements used in SQL commands, leading to SQL Injection vulnerabilities in Mestav's e-commerce software. This issue affects versions of the software before 20230901.
A vulnerability in Neutron Smart VMS allows authentication bypass via spoofing. This affects versions before b1130.1.0.1.
A SQL Injection vulnerability in Digita Information Technology's Smartrise Document Management System due to improper neutralization of special elements used in SQL commands. This issue affects versions before Hvl-2.0.
The Mava Software Hotel Management System has an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. This issue affects versions of the system before 2.0.
CVE-2023-35072 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in the Coyav Travel Proagent application. This issue affects Proagent versions before 20230904.
The BMA Personnel Tracking System has an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. This issue affects versions before 20230904.
CVE-2023-35065 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in Osoft Paint Production Management. This issue affects versions before 2.1.
CVE-2023-3374 vulnerability in Unisign Bookreen allows for privilege escalation due to an incomplete list of disallowed inputs. This issue affects Bookreen versions before 3.0.0.
Audimexee v14.1.7 was discovered to contain a SQL injection vulnerability via the p_table_name parameter. An attacker can manipulate database queries, potentially leading to unauthorized data access.
A critical vulnerability was found in Tenda AC8 version 16.03.34.06_cn_TDC01 in the formSetDeviceName function, leading to stack-based buffer overflow. The vulnerability can be exploited remotely.
Proscend Advice ICR Series routers FW version 1.76 have a vulnerability related to the use of default credentials, which may lead to unauthorized access.
There is a vulnerability in MXsecurity versions prior to 1.0.1 that can be exploited to bypass authentication. A remote attacker might access the system if the web service authenticator has insufficient random values.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS