CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Inavitas Solar Log product has an unauthenticated SQL Injection vulnerability.
W pliku sqclass.cpp w Squirrel w wersjach do 2.2.5 oraz 3.x do 3.1 występuje podatność na odczyt poza zakresem, co może prowadzić do wykonania kodu. W przypadku, gdy ofiara uruchomi skrypt Squirrel kontrolowany przez atakującego, możliwe jest wydostanie się z piaskownicy skryptu, nawet jeśli wszystkie niebezpieczne funkcje, takie jak operacje na systemie plików, zostały wyłączone.
Joplin version 2.8.8 contains a vulnerability that allows arbitrary command execution. The attack is performed by injecting a crafted payload into note titles.
Wtyczka Osamaesh WP Visitor Statistics w wersjach do 5.7 zawiera wiele podatności na nieautoryzowane wstrzyknięcia SQL (SQLi). Atakujący może wykorzystać te luki do manipulacji danymi w bazie danych.
The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group. This user account is created when installing versions 2.7.34, 2.7.35, and 3.0.2 of the app.
Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)
Wtyczka Feed Them Social – dla Twittera, YouTube i innych, w wersjach do 2.9.8.5 włącznie, jest podatna na deserializację niezaufanego wejścia poprzez parametr 'fts_url'. Umożliwia to nieautoryzowanym atakującym wywoływanie plików za pomocą wrappera PHAR, co może prowadzić do wykonania złośliwych działań.
In dotCMS 3.0 through 22.02, the ContentResource API has a vulnerability that allows an attacker to bypass filename sanitization in a multipart request. This enables directory traversal, saving files outside the intended location. If anonymous content creation is enabled, an unauthenticated attacker can upload an executable file such as .jsp, leading to remote code execution.
W Mbed TLS przed wersją 2.28.1 oraz 3.x przed wersją 3.2.0 odkryto problem, który pozwala nieautoryzowanemu atakującemu wysłać nieprawidłową wiadomość ClientHello do serwera DTLS, co prowadzi do nadmiernego odczytu bufora w pamięci heap do 255 bajtów. Może to skutkować awarią serwera lub ujawnieniem informacji w zależności od odpowiedzi błędów.
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name. In that rename operation, it might accidentally *widen* the permissions for the target file, leaving the updated file accessible to more users than intended.
A heap buffer overflow after free (use-after-free) vulnerability was discovered in OTFCC v0.10.4 in the otfccbuild.c file. This flaw could lead to program crashes or potential arbitrary code execution.
A buffer overflow vulnerability was discovered in the Tenda AC23 router firmware version v16.03.07.44 in the fromAdvSetMacMtuWan function. An attacker could exploit this flaw to execute arbitrary code or cause a denial of service.
A stack overflow vulnerability was discovered in the Tenda AC23 router running firmware version v16.03.07.44. This allows a remote attacker to execute arbitrary code on the device.
The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect on such machines and memory corruption will happen during the computation. As a consequence of the memory corruption an attacker may be able to trigger a remote code execution on the machine performing the computation.
In Das U-Boot through version 2022.07-rc5, an integer signedness error and resultant stack-based buffer overflow in the 'i2c md' command enables the corruption of the return address pointer of the do_i2c_md function.
Dell PowerScale OneFS w wersjach od 8.2.x do 9.3.0.x zawiera komunikat o błędzie, który ujawnia wrażliwe informacje. Administrator może wykorzystać tę podatność, co prowadzi do ujawnienia poufnych danych.
W Jorani v1.0 odkryto podatność na wstrzykiwanie SQL poprzez parametr id w pliku application/controllers/Leaves.php.
An XML External Entity (XXE) vulnerability in ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 by ASG Technologies (a Rocket Software Company) allows an attacker to read server files or perform SSRF attacks by processing a malicious XML document.
In IOBit IOTransfer 4.3.1.1561, an unauthenticated attacker can send GET and POST requests to Airserv, gaining arbitrary read/write access to the entire file system (with admin privileges) on the victim's endpoint, leading to data theft and remote code execution.
Directory Management System v1.0 was found to have a SQL injection vulnerability in the fullname parameter of add-directory.php. An attacker can exploit this flaw to execute unauthorized database queries.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS