CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
There is a code injection vulnerability in the GitHub repository nuxt/nuxt prior to version 3.5.3.
PyBB is an open source bulletin board that was vulnerable to SQL Injection prior to commit dcaeccd37198ecd3e41ea766d1099354b60d69c2. This issue has been fixed in the mentioned commit.
The CKEditor v1.2.3 plugin for Redmine has an unrestricted file upload vulnerability in the 'Browse and upload images' feature, allowing arbitrary files to be uploaded to the server.
CVE-2023-35064 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection through SOAP parameter tampering in Satos Mobile.
The vulnerability in TMT Lockcell relies on cookies without validation and integrity checking, allowing privilege abuse and authentication bypass.
CVE-2023-3049 vulnerability in TMT Lockcell allows unrestricted upload of files with dangerous types, leading to command injection.
The vulnerability in TMT Lockcell allows authorization bypass through a user-controlled key, leading to authentication abuse and the ability to bypass authentication.
CVE-2023-3047 describes an improper neutralization of special elements used in SQL commands, leading to SQL Injection vulnerabilities in TMT Lockcell.
Heap-based buffer overflow in SSL-VPN in FortiOS and FortiProxy, allowing a remote attacker to execute arbitrary code or commands via specially crafted requests.
Wtyczka WP Directory Kit dla WordPressa jest podatna na atak Local File Inclusion w wersjach do 1.1.9 włącznie, poprzez funkcję 'wdk_public_action'. Umożliwia to nieautoryzowanym atakującym dołączanie i wykonywanie dowolnych plików na serwerze, co pozwala na wykonanie kodu PHP w tych plikach.
D-Link DIR-600 Hardware Version B5, Firmware Version 2.18 was discovered to contain a stack overflow via the gena.cgi binary.
A command injection vulnerability was discovered in D-Link DIR-600 Hardware Version B5, Firmware Version 2.18 via the ST parameter in the lxmldbc_system() function.
GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code via java.lang.Runtime.getRuntime().exec in wps:LiteralData within a wps:Execute request.
Sourcecodester Service Provider Management System v1.0 is vulnerable to SQL Injection via the ID parameter in /php-spms/?page=services/view&id=2.
SQL injection vulnerabilities have been found in the MOVEit Transfer web application before versions 2021.0.7, 2021.1.5, 2022.0.5, 2022.1.6, and 2023.0.2. An unauthenticated attacker could gain unauthorized access to MOVEit Transfer's database.
Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8 and Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8 allow remote code execution by unauthenticated users.
A buffer overflow was discovered in Progress DataDirect Connect for ODBC before version 08.02.2770 for Oracle. An overly large value for certain options of a connection string may overrun the buffer allocated to process the string value.
Improper restriction of excessive authentication attempts exists in GitHub repository froxlor/froxlor prior to version 2.0.20.
The Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn device was found to contain a stack overflow via the time parameter at /goform/saveParentControlInfo.
The BES--6024PB-I50H1 VideoPlayTool v2.0.1.0 has incorrect access control in its administrative functionalities, allowing attackers to execute arbitrary administrative commands via a crafted payload sent to the desired endpoints.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS