CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A locally exploitable buffer overflow bug can cause a local denial-of-service attack on Zscaler Client Connector on Android and ChromeOS.
A remotely exploitable buffer overflow bug can cause a local and kernel denial-of-service attack on Zscaler Client Connector on Windows.
A local privilege escalation vulnerability exists in the Restricted Access (Kiosk) Mode implementation of Scheidt & Bachmann entervo HMI prior to V2 R5 P0 M5. The vulnerability affects the external PDF viewer used to display the application manual and its interaction with Windows. An authenticated low-privileged user can escape the kiosk environment by abusing the print functionality, allowing arbitrary command execution with local administrator privileges.
HCL Hive is affected by a cryptographic primitive with a risky implementation which could allow an attacker unauthorized lateral compromise or widespread credential leakage if a single internal component is breached.
SQL injection vulnerability in SourceCodester Simple Online Food Ordering System 1.0 in the file /fos/admin/ajax.php?action=confirm_order. Manipulation of the argument ID allows remote attack. The exploit has been made public.
HCL Hive is affected by a broken access control vulnerability which could allow an attacker or unauthorized user to introduce unverified, malicious, or broken code directly into production environments.
SQL injection vulnerability in FluentCRM Pro versions up to 3.1.12. An attacker can exploit it to manipulate database queries.
SQL injection vulnerability in Online Clinic Management System 1.0, in success/login.php, in the Admin Login component. Manipulation of the Username argument leads to SQL injection. Remote exploitation is possible.
Firmware in KAON PG5298A and PG5298B routers allows an unauthenticated user to query a specific endpoint and acquire sensitive information such as the admin portal password. Fixed in firmware versions 3.0.82 (PG5298A) and 4.0.82 (PG5298B).
Unauthenticated Local File Inclusion in Verdure Core versions up to 1.2. Allows reading sensitive files from the server.
Unauthenticated Local File Inclusion in Måne versions up to 1.7. Allows reading sensitive files from the server.
Unauthenticated Cross Site Scripting (XSS) in Social Media & Share Icons versions up to 2.9.9. Allows injecting malicious script into the page.
Unauthenticated Cross Site Scripting (XSS) in Urna versions up to 2.6.2. Allows injecting malicious script into the page.
Unauthenticated Cross Site Scripting (XSS) in WPComplete versions up to 2.9.5.6. Allows injecting malicious script into the page.
Unauthenticated Sensitive Data Exposure in WP Cafe Pro versions before 3.0.15. Allows access to confidential information without authentication.
Unauthenticated Cross Site Scripting (XSS) in 12 Step Meeting List versions up to 3.19.16. Allows injecting malicious script into the page.
SQL Injection vulnerability in WP Project Manager Pro versions up to 4.0.1, exploitable by a user with Subscriber role.
Unauthenticated arbitrary file deletion vulnerability in ShopBuilder Pro – Elementor WooCommerce Builder Addons versions up to 2.2.0.
Unauthenticated Cross Site Scripting (XSS) vulnerability in Brave Conversion Engine (PRO) versions up to 0.8.6.
SQL Injection vulnerability in ProLancer Element versions up to 1.4.8, exploitable by a user with Subscriber role.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS