CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
File upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to execute arbitrary code via a crafted web.config and asp file.
The vulnerability in BG-TEK COSLAT Firewall related to improper handling of parameters allows for Remote Code Inclusion. This affects COSLAT Firewall versions from 5.24.0.R.20180630 to before 5.24.0.R.20210727.
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to fail when multiple URLs are requested serially. The HSTS mechanism is ignored by subsequent transfers on the same command line because the state is not properly carried on.
CVE-2022-2504 describes an improper neutralization of special elements used in SQL commands, allowing for SQL Injection attacks in SDD-Baro software before version 2.8.432.
W podatności CVE-2023-0939 występuje niewłaściwa neutralizacja specjalnych elementów używanych w poleceniach SQL, co pozwala na atak typu SQL Injection w oprogramowaniu NTN Information Technologies Online Services Software w wersjach przed 1.17.
A vulnerability in the Chamberlain myQ iOS application version v5.222.0.32277 is due to a lack of rate limiting on the password reset endpoint. This allows attackers to perform a brute-force attack to compromise user accounts.
MISP before 2.4.166 unsafely allows users to use the 'order' parameter, which may lead to unauthorized access to data.
The app/Controller/Component/IndexFilterComponent.php in MISP before version 2.4.167 mishandles ordered_url_params and additional_delimiters.
IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2.
Remote code execution vulnerability in Windows iSCSI Discovery Service. An attacker could exploit this flaw to execute arbitrary code.
Remote code execution vulnerability in Microsoft Word. An attacker could exploit this vulnerability to execute arbitrary code in the context of the logged-on user.
Remote code execution vulnerability in Microsoft Protected Extensible Authentication Protocol (PEAP). An attacker could exploit it to execute code in the context of the service.
Remote code execution vulnerability in Microsoft Protected Extensible Authentication Protocol (PEAP). An attacker could exploit it to execute code in the context of the service.
Remote code execution vulnerability in Microsoft Protected Extensible Authentication Protocol (PEAP). Allows an attacker to execute arbitrary code.
W systemie zamówień żywności w wersji 2.0 występuje podatność na przesyłanie dowolnych plików w komponencie /fos/admin/ajax.php, co pozwala atakującym na wykonanie dowolnego kodu za pomocą spreparowanego pliku PHP.
Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_username=admin&password=password$(curl substring.
A directory traversal vulnerability was discovered in ureport version 2.2.9 within the deletion function, allowing arbitrary file deletion.
CVE-2022-4557 describes an improper neutralization of special elements used in SQL commands, leading to SQL Injection vulnerability in Smartpower Web.
Improper Input Validation vulnerability in Group Arge Energy and Control Systems Smartpower Web allows PHP Local File Inclusion. This issue affects Smartpower Web: before 23.01.01.
sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct buffer size. It may write beyond the bounds of the destination buffer when attempting to write a padded, thousands-separated string representation of a number, if the buffer is allocated the exact size required to represent that number as a string.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS