CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Insufficient access control restrictions in the file write tool in Amazon Kiro IDE before version 0.11 might allow remote unauthenticated actors to execute arbitrary commands via crafted instructions that cause writes to execution-sensitive paths (such as .vscode/tasks.json), enabling auto-execution on folder open.
An out-of-bounds write vulnerability in the Bitdefender Napoca hypervisor real-mode hook handler allows writing past the RealModeMemory buffer into the hypervisor heap using guest-controlled SS:SP values.
An out-of-bounds write vulnerability in the Bitdefender Napoca hypervisor BIOS INT 0x15 / E820 handler allows a malicious guest to write up to 20 bytes past the RealModeMemory buffer into the hypervisor heap.
Use of default credentials vulnerability in Roche Diagnostics navify Digital Pathology (RabbitMQ Management interface modules) allows Default Usernames and Passwords. This affects versions from 2.0.0 before 2.4.1.
CWE-522: Insufficiently Protected Credentials in web services in Progress Sitefinity versions 8.0.5700 to 13.3.7652. A remote authenticated attacker can obtain plain-text credentials used to connect to the Sitefinity Insight service. Requires active integration with Sitefinity Insight, non-default site configuration, and valid back-end authorization.
In Progress Sitefinity versions 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630, an authorization bypass vulnerability via user-controlled key exists. A remote authenticated attacker can modify account properties of other users.
Progress Sitefinity versions 14.1.x through 14.3.x, 14.4.x before 14.4.8152, 15.0.x before 15.0.8234, 15.1.x before 15.1.8335, 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 have an improper input validation vulnerability (CWE-20) in web services. A remote unauthenticated attacker can compromise user account integrity and confidentiality. User interaction and non-default site configuration are required.
Deserialization of Untrusted Data vulnerability in Elated-Themes Askka allows Object Injection. This issue affects Askka from n/a through 1.3.1.
Vulnerability in the WaveRide theme for WordPress (versions up to 1.4) due to improper control of filename in include/require statement, enabling PHP Local File Inclusion (LFI).
Vulnerability in the Blueprint plugin allows PHP Local File Inclusion (LFI) via improper filename control in include/require statements. Affects versions before 1.1.5.
Improper Authentication in REST API in Collibra Agent allows a remote unauthenticated attacker to access privileged functionality via exposed '/rest/* endpoints.
Path traversal vulnerability in the restore handler of Collibra Agent. An attacker can write arbitrary files outside the intended extraction directory via a crafted ZIP archive. The agent fails to properly validate and canonicalize file paths during extraction.
Vulnerability in the Racquet theme allows PHP Local File Inclusion (LFI) via improper filename control in include/require statements. Affects versions up to and including 1.12.0.
The Cookiteer theme by androThemes (versions up to 1.4.8) contains a PHP Local File Inclusion (LFI) vulnerability via improper control of filename in include/require statements.
The Fermentio theme by Axiomthemes (versions up to 1.5.0) contains a PHP Local File Inclusion (LFI) vulnerability via improper control of filename in include/require statements.
The Spin theme by Axiomthemes (versions up to 1.8) contains a PHP Local File Inclusion (LFI) vulnerability via improper control of filename in include/require statements.
Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitors running software versions VG4.1.1, VG4.0.3, and lower contain network message handling vulnerabilities. These allow network-adjacent attackers to spoof or tamper with data and cause denial-of-service conditions.
The WP Job Portal plugin by Ahmad versions up to 2.5.1 has a Reflected XSS vulnerability due to improper input neutralization during page generation. An attacker can inject malicious script via a crafted URL, which executes in the victim's browser.
Missing Authorization vulnerability in Etoile Web Design Incorporated Five Star Restaurant Reservations allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Five Star Restaurant Reservations: from n/a through 2.7.14.
Missing Authorization vulnerability in EventPrime allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects EventPrime: from n/a through 4.3.2.0.