CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An issue was discovered in GeoVision GV-Edge Recording Manager 2.2.3.0 for Windows, which contains improper permissions within the default installation. This vulnerability allows attackers to execute arbitrary code and gain escalated privileges.
GL.iNET MT3000 version 4.1.0 Release 2 is vulnerable to OS command injection via the /usr/lib/oui-httpd/rpc/logread endpoint. An attacker can remotely execute arbitrary commands on the system.
Certain HP LaserJet Pro print products are potentially vulnerable to Heap Overflow and/or Remote Code Execution.
Certain HP LaserJet Pro print products are potentially vulnerable to Buffer Overflow and/or Remote Code Execution.
Certain HP LaserJet Pro print products are potentially vulnerable to Buffer Overflow and/or Elevation of Privilege.
Nanoleaf firmware version 7.1.1 and below lacks TLS verification, allowing attackers to execute arbitrary code via a DNS hijacking attack.
Wtyczka Profile Builder – User Profile & User Registration Forms dla WordPress jest podatna na nieautoryzowane resetowanie haseł w wersjach do 3.9.0 włącznie. Problem wynika z niewystarczającej walidacji funkcji resetowania hasła, która używa wartości w postaci czystego tekstu zamiast wartości haszowanej.
A remote code execution (RCE) vulnerability was discovered in the Aigital Wireless-N Repeater Mini_Router firmware version v0.131229 via the sysCmd parameter in the formSysCmd function. This flaw can be exploited by sending a crafted HTTP request.
Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series 4.60 through 5.35, USG FLEX series 4.60 through 5.35, and ATP series 4.60 through 5.35. An unauthenticated attacker could execute OS commands remotely by sending crafted packets to an affected device.
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required. The flaw exists within the SetupCompleted class due to improper access control. An attacker can bypass authentication and execute arbitrary code in the context of SYSTEM.
Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
A command injection vulnerability was discovered in the Nanoleaf Desktop App before version 1.3.1, which is exploited via a crafted HTTP request.
CVE-2023-1873 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in the Faturamatik Bircard system. This issue affects Bircard versions before 23.04.05.
CVE-2023-1723 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in the Veragroup Mobile Assistant application. This issue affects Mobile Assistant versions before 21.S.2343.
Wtyczka ZM Ajax Login & Register dla WordPressa jest podatna na obejście uwierzytelniania w wersjach do 2.0.2 włącznie. Problem wynika z niewystarczającej weryfikacji użytkownika podczas logowania przez Facebooka, co umożliwia nieautoryzowanym atakującym logowanie się jako dowolny istniejący użytkownik na stronie.
CVE-2023-1833 vulnerability in DTS Electronics Redline Router firmware allows Authentication Bypass due to a primary weakness. This issue affects Redline Routers before version 7.17.
The Authentication Bypass vulnerability in the firmware of DTS Electronics Redline Router allows for an authentication bypass attack. This issue affects Redline Routers before version 7.17.
CVE-2023-1863 describes an improper neutralization of special elements used in SQL commands, allowing command line execution through SQL Injection in Eskom Water Metering Software. This issue affects versions prior to 23.04.06.
Auto Dealer Management System v1.0 contains a SQL injection vulnerability. An attacker can exploit this flaw to execute unauthorized database queries.
AM Presencia v3.7.3 was discovered to contain a SQL injection vulnerability in the login form. An attacker can manipulate the 'user' parameter to execute unauthorized database queries.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS