CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In bloofox v0.5.2, an arbitrary file deletion vulnerability was discovered via the delete_file() function. An attacker can exploit this flaw to delete critical system files.
Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account. This does not provide access to stored survey or response data.
Wtyczka WCFM Membership dla WordPressa jest podatna na eskalację uprawnień w wersjach do 2.10.0 włącznie, z powodu braku sprawdzenia uprawnień w akcji AJAX wp_ajax_nopriv_wcfm_ajax_controller, która kontroluje ustawienia członkostwa. Umożliwia to nieautoryzowanym atakującym modyfikację formularza rejestracji członkostwa, co pozwala im ustawić rolę rejestracji na dowolnego użytkownika, w tym administratora.
An authentication vulnerability in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.
An issue found in Zend Framework v.3.1.3 and before allows a remote attacker to execute arbitrary code via the unserialize function. However, this has been disputed by third parties as incomplete and incorrect, and the framework does not have a version that surpasses 2.x.x and was deprecated in early 2020.
A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code.
The vulnerability in Fernus Informatics LMS allows unrestricted upload of files with dangerous types, potentially leading to OS Command Injection and Server Side Include (SSI) Injection.
CVE-2023-1765 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in Akbim Computer Panon. This issue affects Panon versions before 1.0.2.
Vulnerability in the package net.sourceforge.htmlunit:htmlunit before version 3.0.0 allows remote code execution (RCE) via XSTL when browsing the attacker's webpage.
A Server-Side Request Forgery (SSRF) vulnerability was discovered in openapi-generator up to version 6.4.0 in the /api/gen/clients/{language} component. It allows attackers to access network resources and sensitive information via a crafted API request.
The Infoline Project Management System has a Server-Side Request Forgery (SSRF) vulnerability that allows attackers to send malicious requests from the server. This issue affects versions before 4.09.31.125.
A vulnerability in Stimulsoft products allows remote code execution. Versions 2023.1.4 (Designer Desktop) and 2023.1.3 (Designer Web and Viewer Web) do not restrict access to the local file system, enabling an attacker to read and write files and directories. The attacker can also prepare a report with a variable holding gathered data and render it.
The vulnerability in ComponentSpace.Saml2 4.4.0 is missing SSL certificate validation. The vendor does not consider this a vulnerability because certificates are exchanged in a controlled manner within trust relationships, and validation at the application layer is less critical than at the transport layer.
Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI.
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.
W systemie raportowania internetowego As Koc Energy występuje podatność na wstrzykiwanie SQL z powodu niewłaściwej neutralizacji specjalnych elementów używanych w poleceniach SQL. Problem dotyczy wersji przed 23.03.10.
W podatności CVE-2023-1153 w aplikacji Pacsrapor przed wersją 1.22 występuje niewłaściwa neutralizacja specjalnych elementów używanych w poleceniach SQL, co umożliwia atak typu SQL Injection oraz wykonanie poleceń systemowych przez SQL Injection.
W podatności CVE-2023-1152 występuje niewłaściwa neutralizacja specjalnych elementów używanych w poleceniach SQL, co prowadzi do możliwości ataku typu SQL Injection w systemie Persolus firmy Utarit Information Technologies. Problem dotyczy wersji Persolus przed 2.03.93.
The vulnerability in ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.
OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS