CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in php-censor up to version 2.1.6, in the file src/Model/Build/GitBuild.php, allows remote OS command injection via manipulation of the commitId argument in the Webhook endpoint.
In D-Link DI-7001 MINI up to version 19.09.19A1, the sprintf function in /httpd_debug.asp (API component) is vulnerable to stack-based buffer overflow via the Time argument. The attack can be performed remotely and the exploit is publicly available.
Integer overflow in Poppler's Splash backend tilingPatternFill function leads to undersized heap allocation and out-of-bounds write. Remote code execution, information disclosure, or denial of service possible.
Tychon includes an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory that may be controllable by an unprivileged user on Windows. Tychon contains a privileged service that uses this OpenSSL component. A user who can place a specially-crafted openssl.cnf file at an appropriate path may be able to achieve arbitrary code execution with SYSTEM privileges.
LearnPress WordPress plugin is vulnerable to Reflected XSS due to improper input neutralization during page generation. Affects versions up to 4.3.6.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP Statistics allows DOM-Based XSS. This issue affects WP Statistics: from n/a through 14.16.6.
The VikBooking Hotel Booking Engine & PMS WordPress plugin (versions up to 1.8.8) has a DOM-Based Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation.
The e2pdf WordPress plugin (versions up to 1.32.14) has a Reflected Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation.
Use of hard-coded credentials in KS-SOMED allowed an unauthorized attacker access to the FTP server hosting application update packages. The attacker could upload a malicious update file, which could then be distributed and installed as a legitimate update.
FlexRIC v2.0.0 crashes when receiving a RIC_SUBSCRIPTION_RESPONSE with an unknown ric_id that has no pending event. The near-RT RIC uses assert() to enforce a pending event. A remote unauthenticated attacker can send a forged response to port 36421, causing SIGABRT (Debug) or NULL pointer dereference (SIGSEGV) in Release builds.
FlexRIC v2.0.0 crashes when an SCTP association is closed before an E2_SETUP_REQUEST is sent. The near-RT RIC assumes a mapping between SCTP association and E2 node always exists and enforces this via assert(). A remote unauthenticated attacker can crash the near-RT RIC (port 36421) by completing an SCTP handshake and immediately disconnecting without sending any E2AP message.
SourceCodester Computer Repair Shop Management System up to version 1.0 has an SQL injection vulnerability in /admin/products/manage_product.php via manipulation of the ID argument. The attack can be launched remotely, and the exploit has been made public.
Real State Services 1.0 by code-projects has an SQL injection vulnerability in /loginuser.php of the Login component via manipulation of the Username argument. The attack can be initiated remotely, and the exploit has been disclosed to the public.
A SQL injection vulnerability was found in CodeAstro Online Job Portal 1.0 in the file /users/application_status.php. Manipulating the ID argument can lead to unauthorized database access. The attack can be performed remotely and the exploit is publicly available.
A SQL injection vulnerability was found in CodeAstro Online Job Portal 1.0 in the file /admin/jobs-admins/delete-jobs.php. Manipulating the ID argument can lead to unauthorized database access. The attack can be performed remotely and the exploit is publicly available.
In H3C Magic B0 up to version 100R002, a vulnerability exists in the SetMobileAPInfoById function of the /goform/aspForm file. Manipulation of the param argument leads to a stack-based buffer overflow, which can be exploited remotely. The exploit has been publicly disclosed.
Vertex, a management tool for PT (Private Tracker) users to manage streaming and watching videos, is vulnerable to path traversal in versions prior to commit fbde301b97986d5913fc4bc95f5445750d282e11. An attacker can exploit this to read or write files outside the intended directory.
A SQL injection vulnerability was found in itsourcecode Online House Rental System 1.0 in the file /manage_payment.php. Manipulating the ID argument can lead to unauthorized database access. The attack can be performed remotely and the exploit is publicly available.
A SQL injection vulnerability was found in itsourcecode Online House Rental System 1.0 in the file /manage_tenant.php. Manipulating the ID argument can lead to unauthorized database access. The attack can be performed remotely and the exploit is publicly available.
A SQL injection vulnerability was found in itsourcecode Online House Rental System 1.0 in the file /ajax.php?action=login. Manipulating the Username argument can lead to unauthorized database access. The attack can be performed remotely and the exploit is publicly available.