CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A Use of Hard-coded Credentials issue was discovered in Korenix JetNet software, which may allow an attacker to gain remote access to devices.
A Use of Hard-coded Cryptographic Key issue was discovered in Korenix JetNet JetNet5018G, JetNet5310G, JetNet5428G-2G-2FX, JetNet5628G-R, JetNet5628G, JetNet5728G-24P, JetNet5828G, JetNet6710G-HVDC, and JetNet6710G. An attacker may gain access to hard-coded certificates and private keys allowing the attacker to perform man-in-the-middle attacks.
MongoDB versions 3.4.x before 3.4.10 and 3.5.x-development have a disabled-by-default configuration setting, networkMessageCompressors, which when enabled can be exploited by a malicious attacker to deny service or modify memory.
Versions of EMC Unisphere for VMAX Virtual Appliance, EMC Solutions Enabler Virtual Appliance, EMC VASA Virtual Appliance, and EMC VMAX Embedded Management prior to specified versions contain an authentication bypass vulnerability. This vulnerability may be exploited by malicious users to compromise the affected system.
A vulnerability in libcurl related to improper handling of IMAP FETCH responses when the data size is zero bytes. The deliver-data function may attempt to read data from a buffer that is not properly terminated, potentially leading to reading memory beyond the allocated area.
An SQL Injection vulnerability exists in HP ArcSight ESM and HP ArcSight ESM Express in any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1. This vulnerability could be exploited remotely to allow SQL injection.
Zomato Clone Script allows SQL Injection via the resid parameter in the restaurant-menu.php file.
Website Broker Script allows SQL Injection via the 'status_id' Parameter to status_list.php.
Vastal I-Tech Agent Zone (also known as The Real Estate Script) allows SQL Injection in searchCommercial.php via the property_type, city, or posted_by parameter, and in searchResidential.php via the property_type, city, or bedroom parameter.
Php Inventory & Invoice Management System allows Arbitrary File Upload via dashboard/edit_myaccountdetail/.
The Online Exam Test Application allows SQL Injection via the sort parameter in resources.php in a category action.
Nice PHP FAQ Script allows SQL Injection via the index.php nice_theme parameter, a different vulnerability than CVE-2008-6525.
Fake Magazine Cover Script allows SQL Injection via the rate.php value parameter or the content.php id parameter.
CPA Lead Reward Script allows SQL Injection via the username parameter.
CVE-2017-15985 affects the Basic B2B script, allowing SQL Injection via the pid or id parameters in the product_view1.php file.
Creative Management System (CMS) Lite version 1.4 is vulnerable to SQL Injection via the S parameter in index.php.
MyMagazine Magazine & Blog CMS version 1.0 allows SQL Injection via the id parameter in admin/admin_process.php for form editing.
Dynamic News Magazine & Blog CMS version 1.0 allows SQL Injection via the id parameter in admin/admin_process.php for form editing.
Responsive Newspaper Magazine & Blog CMS version 1.0 allows SQL Injection via the id parameter in admin/admin_process.php for form editing.
US Zip Codes Database Script 1.0 allows SQL Injection via the state parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS