CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An inclusion of functionality from untrusted control sphere vulnerability in the MinGW DLL component in Synology Hyper Backup Explorer before version 3.0.1-0156 allows local users to execute arbitrary code.
An inclusion of functionality from untrusted control sphere vulnerability in the OpenSSL configuration in Synology Active Backup for Business Recovery Media Creator before version 2.5.0-2081 allows local users to execute arbitrary code.
A remote attacker with user privileges can exploit a stack buffer overflow in gdv-serverconfig to gain full system access as root.
A remote attacker with user privileges can exploit a stack buffer overflow in dali-devconfig to gain full system access as root.
A remote attacker with user privileges can exploit a stack buffer overflow to gain full system access as root.
Vulnerability in the ugw-logread method allows a remote attacker with user privileges to access arbitrary local files due to insufficient input validation.
The ugw-logstop method allows a remote attacker with user privileges to terminate arbitrary processes due to insufficient validation of user-supplied input.
The ugw-restoreinfo method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
The ugw-restore method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
The ugw-logstop method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
The ugw-delete-file method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
The bac-scanresult method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
SWUpdate before 2026.05 is affected by a time-of-check time-of-use (TOCTOU) race condition that allows local unprivileged attackers to escalate privileges to root or install untrusted contents using a signed update.
It is possible for an unauthenticated adjacent attacker to download log files of the controller, which may disclose some restricted information.
The School Management plugin for WordPress versions up to 93.2.0 has an incorrect privilege assignment vulnerability allowing privilege escalation.
The School Management plugin for WordPress versions up to 93.2.0 is vulnerable to SQL injection, allowing SQL query injection.
ABB T-MAC Plus version 4.0-24 suffers from an incorrect authorization vulnerability, allowing a user to access functions or data they should not be permitted to.
ABB T-MAC Plus version 4.0-24 is vulnerable to cross-site scripting (XSS) due to improper neutralization of input during web page generation. An attacker can inject malicious scripts that execute in the victim's browser.
Authorization bypass through User-Controlled key vulnerability in ABB T-MAC Plus version 4.0-24.
Vulnerability in mlflow/mlflow prior to 3.11.0 allows environment variable resolution in AI Gateway secrets, leading to exfiltration of sensitive server-side credentials.