CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Zabbix before 2.2.14 and 3.0 before 3.0.4 has an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php.
IBM Integration Bus versions 9.0 and 10.0 and WebSphere Message Broker SOAP FLOWS are vulnerable to a denial of service due to an XML External Entity Injection (XXE) error when processing XML data.
Multiple SQL injection vulnerabilities in modified eCommerce Shopsoftware 2.0.0.0 revision 9678, when the easybill-module is not installed, allow remote attackers to execute arbitrary SQL commands via the orders_status or customers_status parameter to api/easybill/easybillcsv.php.
IBM Websphere MQ JMS client versions 7.0.1, 7.1, 7.5, 8.0, and 9.0 allow deserialization of objects from untrusted sources, which could enable a malicious user to execute arbitrary Java code by adding vulnerable classes to the classpath.
Heap-based buffer overflow in the ALGnew function in block_templace.c in Python Cryptography Toolkit (pycrypto) allows remote attackers to execute arbitrary code, as demonstrated by a crafted iv parameter to cryptmsg.py.
Adobe Digital Editions versions 4.5.3 and earlier have an exploitable heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution.
Adobe Campaign versions 16.4 Build 8724 and earlier have a code injection vulnerability.
An issue was discovered in Smiths-Medical CADD-Solis Medication Safety Software (versions 1.0, 2.0, 3.0, and 3.1) that allows an authenticated user to gain elevated privileges on the SQL database. This enables modification of drug libraries, addition and deletion of users, and changes to user permissions.
An INFORMATION EXPOSURE flaw was discovered in the BINOM3 Universal Multifunctional Electric Power Quality Meter. This vulnerability can be exploited to gain privileged access to the device.
An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter related to lack of authentication for remote service, allowing access to application setup and configuration.
An issue was discovered on Phoenix Contact mGuard devices updated to Version 8.4.0, where updating the device resets the admin user's password to its default value.
A SQL injection vulnerability was discovered in Advantech WebAccess Version 8.1. To exploit this vulnerability, an attacker must supply malformed input to the WebAccess software.
An issue was discovered in Advantech WebAccess Version 8.1 that allows authentication bypass. A malicious user can access pages unrestricted by accessing a specific URL on the web server.
An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11_U05, and VMU-C PV prior to firmware Version A17. Successful exploitation of this CROSS-SITE REQUEST FORGERY (CSRF) vulnerability can allow execution of unauthorized actions on the device such as configuration parameter changes, and saving modified configuration.
An access control flaw was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11_U05 and VMU-C PV prior to firmware Version A17, allowing access to most application functions without authentication.
An issue was discovered in Honeywell XL Web II controller XL1000C500 and XLWeb 500 related to improper privilege management. A user with low privileges can access a specific URL and change system parameters.
An issue was discovered in Honeywell XL Web II controller (XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior) related to storing passwords in clear text.
An issue exists in Honeywell XL Web II controllers, specifically XL1000C500 and XLWeb 500, related to the plaintext storage of passwords. Any user can disclose a password by accessing a specific URL.
Wykryto problem w różnych wersjach urządzeń Moxa NPort, który pozwala na aktualizację oprogramowania układowego przez sieć bez uwierzytelnienia. To może prowadzić do zdalnego wykonania kodu.
W urządzeniach Moxa NPort występuje problem z autoryzacją w wersjach przed określonymi numerami. Atakujący może wykorzystać atak brute force, aby określić parametry potrzebne do ominięcia uwierzytelnienia.