CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
ToUI is a Python package for creating user interfaces that uses Flask-Caching to store user variables. Versions 2.0.1 to 2.4.0 are affected by an issue with the `Website.user_vars` property. This issue has been patched in version 2.4.1.
In Moov signedxml through 1.0.0, parsing the raw XML can result in different output than parsing the canonicalized XML. This allows for bypassing signature validation via a Signature Wrapping attack (XSW).
The scquickaccounting module in Store Commander for PrestaShop up to version 3.7.3 allows multiple sensitive SQL calls to be executed with a trivial HTTP request, potentially leading to a blind SQL injection vulnerability.
The scfixmyprestashop module in Store Commander through 2023-05-09 for PrestaShop allows sensitive SQL calls to be executed with a trivial HTTP request, potentially leading to blind SQL injection.
The scexportcustomers module in Store Commander for PrestaShop up to version 3.6.1 allows sensitive SQL calls to be executed with a trivial HTTP request, potentially leading to a blind SQL injection vulnerability.
CVE-2023-2851 describes an improper neutralization of special elements used in SQL commands, allowing command line execution through SQL Injection. This issue affects all versions of AGT Tech Ceppatron software.
CVE-2023-2887 vulnerability affects the CBOT Chatbot, allowing authentication bypass through spoofing. This issue exists in versions Chatbot before Core: v4.0.3.4 and Panel: v4.0.3.7.
The vulnerability in CBOT Chatbot is related to the use of a cryptographically weak pseudo-random number generator, allowing signature spoofing through key recreation.
The vulnerability in CBOT Chatbot related to the generation of incorrect security tokens allows for token impersonation and privilege abuse.
Wtyczka MStore API dla WordPressa jest podatna na obejście uwierzytelniania w wersjach do 3.9.1 włącznie. Problem wynika z niewystarczającej weryfikacji użytkownika podczas synchronizacji koszyka z mobilnego żądania REST API przez wtyczkę.
Wtyczka MStore API dla WordPressa jest podatna na obejście uwierzytelniania w wersjach do 3.9.0 włącznie. Problem wynika z niewystarczającej weryfikacji użytkownika dostarczanego podczas żądania REST API dotyczącego realizacji kuponu przez wtyczkę.
Wtyczka MStore API dla WordPressa jest podatna na obejście uwierzytelniania w wersjach do 3.9.2 włącznie. Problem wynika z niewystarczającej weryfikacji użytkownika dostarczanego podczas żądania REST API dodawania ogłoszenia przez wtyczkę.
A vulnerability in Netbox v3.5.1 allows unauthenticated attackers to execute queries against the GraphQL database, potentially granting access to sensitive data stored in the database.
Remote command injection vulnerability in Barracuda Email Security Gateway (appliance form factor only) affecting versions 5.1.3.001-9.2.0.006. It arises from incomplete input validation of user-supplied .tar file names, allowing a remote attacker to execute a system command with the privileges of the product. Fixed in patch BNSF-36456, automatically applied to all customer appliances.
In RocketMQ versions 5.1.0 and below, there is a risk of remote command execution under certain conditions. Several components of RocketMQ, including NameServer, Broker, and Controller, are exposed on the extranet and lack permission verification.
CVE-2023-2064 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in Minova Technology eTrace. This issue affects eTrace versions before 23.05.20.
CVE-2023-2045 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in Ipekyolu Auto Damage Tracking Software versions before 4.
CVE-2023-33010 describes a buffer overflow vulnerability in the ID processing function in the firmware of Zyxel ATP series, USG FLEX, USG20(W)-VPN, VPN series, and ZyWALL/USG. This could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even remote code execution on an affected device.
CVE-2023-33009 describes a buffer overflow vulnerability in the notification function in the firmware of Zyxel ATP series, USG FLEX series, USG20(W)-VPN, VPN series, and ZyWALL/USG series. This could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even remote code execution on an affected device.
CVE-2023-2750 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in the Cityboss E-municipality system. This issue affects E-municipality versions before 6.05.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS