CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.09)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The getAccountData function has an SQL Injection vulnerability that can be exploited by an unauthenticated remote attacker. Improper neutralization of special elements in a SQL SELECT command leads to a total loss of confidentiality.
The inmessage model has a SQL Injection vulnerability that can be exploited by a low privileged attacker. Due to improper neutralization of special elements in a SQL DELETE command, the attacker can read the entire database and delete entries in a non-critical table.
The dash_layout.php file's saveDashboardLayout function has a remote SQL Injection vulnerability that can be exploited by a low privileged attacker. The flaw is due to improper neutralization of special elements in a SQL INSERT command, allowing for reading the entire database and inserting entries into a non-critical table.
There is an SQL Injection vulnerability in the saveDashboardLayout function of the dash.php files that can be exploited by a low privileged remote attacker. The flaw is due to improper neutralization of special elements in a SQL INSERT command, allowing for reading the entire database and inserting entries into a non-critical table.
CVE-2025-52747 describes an improper neutralization of input during web page generation in Jthemes Themebox - Digital Products Ecommerce, allowing for Reflected XSS attacks.
Podatność w Active Backup for Business umożliwia nieautoryzowanym zdalnym atakującym odczyt dowolnych plików. To stwarza poważne zagrożenie dla poufności danych przechowywanych w systemie.
CVE-2025-22741 describes an improper neutralization of input during web page generation in the RiceTheme Felan Framework, allowing for Reflected XSS attacks.
W pakiecie Synology C2 Identity Edge Server w DSM przed wersją 1.76.0-0307 występuje podatność związana z ujawnioną niebezpieczną metodą lub funkcją, która pozwala zdalnym atakującym na uzyskanie poświadczeń użytkowników z serwera brzegowego.
W podatności CVE-2025-13392 w Synology DiskStation Manager (DSM) przed wersją 7.2.2-72806-5 i 7.3.1-86003-1 występuje niewłaściwe sprawdzanie nietypowych lub wyjątkowych warunków w SSO, co pozwala zdalnym atakującym na ominięcie uwierzytelnienia przy wcześniejszej znajomości nazwy wyróżniającej (DN).
W podatności CVE-2023-52945 występuje niekontrolowany element ścieżki wyszukiwania w komponencie DLL OpenSSL w Synology BeeDrive dla systemu desktop przed wersją 1.3.2-13814. Umożliwia to lokalnym użytkownikom wykonanie dowolnego kodu za pomocą nieokreślonych wektorów.
The WPCode - Insert Headers and Footers + Custom Code Snippets plugin for WordPress is vulnerable to Remote Code Execution in versions up to and including 2.3.5. The issue arises from the 'wpcode' custom post type being registered without proper capability restrictions, allowing attackers to exploit standard post capabilities.
The HBook plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'hb_country_iso', 'hb_usa_state_iso', and 'hb_canada_province_iso' parameters in all versions up to and including 2.1.6 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page (the HBook Customers admin page).
The affiliate-toolkit plugin for WordPress is vulnerable to remote code execution in all versions up to and including 3.8.5. This is due to the plugin using the BladeOne templating engine's runString() method which compiles user-supplied template content into PHP code and executes it via eval() without sanitization or sandboxing.
CVE-2026-40819 identifies an unauthenticated SQL Injection vulnerability in the sync_data24 task due to improper neutralization of special elements in a SQL SELECT command. An attacker can exploit this flaw, leading to a total loss of confidentiality.
The _mb24confi_getDevice function has an unauthenticated SQL Injection vulnerability due to improper neutralization of special elements in a SQL SELECT command. An attacker can exploit this flaw, resulting in a total loss of confidentiality.
The getAlarmProfiles function has an SQL Injection vulnerability that can be exploited by an unauthenticated remote attacker. Improper neutralization of special elements in a SQL SELECT command leads to a total loss of confidentiality.
The mb24alarm.php files have a remote SQL Injection vulnerability in the _mb24confi_getTagAlarm function, allowing unauthorized access to data.
The _mb24api_getUserAccount function has an unauthenticated SQL Injection vulnerability due to improper neutralization of special elements in a SQL SELECT command. This can lead to a total loss of confidentiality.
The dataapi.php file in the _mb24confi_getTagAlarm function has an unauthenticated SQL Injection vulnerability due to improper neutralization of special elements in a SQL SELECT command. This can lead to a total loss of confidentiality.
CVE-2026-40813 describes an unauthenticated remote SQL Injection vulnerability in the tagid parameter of the getLiveValues function. Improper neutralization of special elements in a SQL SELECT command can lead to a total loss of confidentiality.