CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An authentication bypass vulnerability in FortiOS, FortiProxy, and FortiSwitchManager allows an unauthenticated attacker to perform operations on the administrative interface via crafted HTTP or HTTPS requests.
An issue in GX Group GPON ONT Titanium 2122A T2122-V1.26EXL allows attackers to escalate privileges via a brute force attack at the login page. The lack of rate limiting or account lockout mechanisms enables repeated password guessing.
WiJungle NGFW version U250 was found to have no rate limit on login requests, allowing an attacker to brute force the admin password and take over the account.
PJSIP is a free and open source multimedia communication library that may incorrectly switch from using SRTP media transport to basic RTP upon SRTP restart. This leads to media being sent insecurely.
Bus Pass Management System 1.0 was found to have a SQL injection vulnerability in the searchdata parameter at /buspassms/download-pass.php. An attacker can exploit this flaw to execute arbitrary SQL queries on the database.
Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio.
A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.
SourceCodester Simple Task Managing System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at changeStatus.php. An attacker can manipulate this parameter to execute unauthorized database queries.
The library automation system KOHA, developed by Parantez Teknoloji, before version 19.05.03 had an unauthenticated SQL Injection vulnerability. This issue has been fixed in version 19.05.03.01.
The Database Software Accreditation Tracking/Presentation Module product before version 2 has an unauthenticated SQL Injection vulnerability. This issue is fixed in version 2.
SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j_id90 parameter at /SVFE2/pages/feegroups/mcc_group.jsf. An attacker can manipulate this parameter to execute unauthorized database queries.
Kayrasoft product before version 2 has an unauthenticated SQL Injection vulnerability. This issue is fixed in version 2.
The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module does not correctly restrict login when a user tries to connect from an IP address that is not resolvable via DNS — in such conditions, a user with denied access to a machine can still get access.
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
DIAEnergy, system zarządzania energią przemysłową firmy Delta Industrial Automation, jest podatny na CWE-798, czyli użycie wbudowanych poświadczeń. Wersje przed 1.9.03.009 mają tę podatność, co umożliwia przesyłanie plików wykonywalnych do określonych katalogów przy użyciu wbudowanej autoryzacji typu bearer, co prowadzi do zdalnego wykonania kodu.
A vulnerability in the post_applogin.php component of Syncovery 9 for Linux version 9.47x and below allows attackers to escalate privileges by crafting malicious session tokens.
A prototype pollution vulnerability was discovered in stealjs library version 2.2.4 in the convertLater function in npm-convert.js. The issue is caused by the requestedVersion variable that can be manipulated by an attacker.
An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, this could allow an attacker to modify system files. The vulnerability has been fixed in specific versions of Photo Station for various QTS versions.
Podatność CVE-2022-34882 dotyczy Hitachi RAID Manager Storage Replication Adapter i pozwala zdalnym uwierzytelnionym użytkownikom na uzyskanie wrażliwych informacji poprzez komunikaty o błędach. Problem dotyczy wersji 02.01.04 przed 02.03.02 oraz 02.05.00 przed 02.05.01 na systemach Windows i Docker.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS