CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Simple Customer Relationship Management version 1.0 is vulnerable to SQL Injection via the email parameter.
Vulnerability in HwWatchHealth that can be exploited to hijack the application. Successful exploitation may lead to repeated pop-up windows of the app.
A SQL injection vulnerability has been identified in the MOVEit Transfer web application before version 2021.0.8 that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content.
D-Link Go-RT-AC750 revA_v101b03 was discovered to contain a command injection vulnerability via the service parameter at genacgi_main.
PublicCMS versions up to 4.0.202302 are vulnerable to insecure permissions, potentially allowing unauthorized access to resources.
In cmseasy v7.7.7.7 20230520, a path traversal vulnerability was discovered in the add_action method in lib/admin/language_admin.php. This vulnerability allows attackers to execute arbitrary code and perform local file inclusion.
Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection, allowing remote code execution by a user with page editing privileges.
The cpdb-libs libraries, used in the Common Printing Dialog Backends project, are vulnerable to buffer overflows in versions 1.0 through 2.0b4 due to improper use of `scanf(3)`. The issue arises because the length of read strings is not limited, leading to buffer overflows when a string exceeds 1023 characters.
Langchain versions before v0.0.225 contain a remote code execution (RCE) vulnerability in the JiraAPIWrapper component. This vulnerability allows attackers to execute arbitrary code via crafted input.
CVE-2023-34865 in ujcms 6.0.2 has a directory traversal vulnerability that allows attackers to move files via the rename feature.
Version 0.5.2.1 of the bloofox application was found to contain a SQL injection vulnerability via the cid parameter in admin/index.php?mode=settings&page=charset&action=edit.
Version 0.5.2.1 of the bloofox application was found to contain a SQL injection vulnerability via the userid parameter in admin/index.php?mode=user&action=edit.
Version 0.5.2.1 of bloofox was found to contain a SQL injection vulnerability via the pid parameter in admin/index.php?mode=settings&page=plugins&action=edit.
Version 0.5.2.1 of bloofox was found to contain a SQL injection vulnerability via the tid parameter in admin/index.php?mode=settings&page=tmpl&action=edit.
A SQL injection vulnerability was discovered in bloofox v0.5.2.1 via the lid parameter in admin/index.php. An attacker can exploit this flaw to manipulate database queries.
Version 0.5.2.1 of bloofox was found to contain a SQL injection vulnerability via the gid parameter in admin/index.php?mode=user&page=groups&action=edit.
Version 0.5.2.1 of bloofox was found to contain a SQL injection vulnerability via the cid parameter in admin/index.php?mode=settings&page=projects&action=edit.
There is a file upload vulnerability in ujcms version 6.0.2 via the endpoint /api/backend/core/web-file-upload/upload.
Elevation of Privilege vulnerability in Microsoft SharePoint Server. Technical details are not provided in the description.
An arbitrary file upload vulnerability in the /fileUpload.lib.php component of Chamilo versions 1.11.* up to 1.11.18 allows attackers to upload crafted SVG files. This can lead to arbitrary code execution on the server.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS