CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.09)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The CformsII WordPress plugin is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to 15.1.3. An attacker can trick an administrator into performing unwanted actions.
The Broadcast Live Video plugin by VideoWhisper.Com for WordPress before version 7.1.3 contains a Code Injection vulnerability. This allows an attacker to inject and execute arbitrary code.
Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7 have insufficient HTML sanitization that could lead to CSS injection via an SVG document with an animate element using the attributeName attribute.
Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1 have insecure code evaluation logic in the LDAP autovalues option that could lead to code injection. Support for code evaluation has been removed in versions 1.6.16 and 1.7.1.
Roundcube Webmail versions 1.6.x between 1.6.14 and 1.6.16, and 1.7.x before 1.7.1 have insufficient CSS sanitization in HTML emails, which may lead to SSRF or information disclosure if stylesheet links point to local network hosts. The issue stems from an incomplete fix for CVE-2026-35540.
Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1 contain a pre-authentication SQL injection vulnerability in the virtuser_query plugin. The vulnerability is due to a backslash escape bypass in preg_replace().
Stack-based buffer overflow vulnerability in the formSDHCP function in /goform/formSDHCP on Edimax EW-7438RPn 1.31. Manipulating the submit-url argument can lead to buffer overflow.
Stack-based buffer overflow vulnerability in the formStats function in /goform/formStats on Edimax EW-7438RPn 1.31. Manipulating the submit-url argument can lead to buffer overflow.
A vulnerability was detected in Edimax EW-7438RPn 1.31. The function formrefresh in the file /goform/formrefresh is vulnerable to stack-based buffer overflow via the submit-url argument. The attack can be launched remotely, and the exploit is public. The vendor did not respond.
Stack-based buffer overflow vulnerability in the formLogout function in /goform/formLogout on Edimax EW-7438RPn 1.31. Manipulating the submit-url argument can lead to buffer overflow.
SQL Injection vulnerability in /studentdel.php of StudentManagementSystem (yashpokharna2555). Manipulation of ID argument in confirm_logged_in function leads to SQL injection. Remote attack, exploit public. Rolling release, no version details.
SQL Injection vulnerability in student_trans.php of StudentManagementSystem (yashpokharna2555). Manipulation of FIRST_NAME/Last_Name/EMAIL arguments in confirm_logged_in function leads to SQL injection. Remote attack, exploit public. Rolling release, no version details.
SQL Injection vulnerability in /success.php of StudentManagementSystem (yashpokharna2555). Manipulation of User argument in an unknown function leads to SQL injection. Remote attack, exploit public. Rolling release, no version details.
Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can create a malicious Groovy class containing untrusted code reaching a non-sandboxed execution path via the class static initializer. This affects versions 3.0 through 3.0.16, 4.0 through 4.0.5, and 4.1.0. Fixed in 4.0.6 and 4.1.1.
SQL Injection vulnerability in /Easy7/apps/WebService/GetDBDataEx.jsp of Tiandy Easy7 Integrated Management Platform 7.17.0. Manipulation of strTBName argument leads to SQL injection. Remote attack, exploit public. Vendor did not respond.
Stack-based buffer overflow vulnerability in the formLicence function in /goform/formLicence on Edimax EW-7438RPn 1.31. Manipulating the submit-url argument can lead to buffer overflow.
Stack-based buffer overflow vulnerability in the formWpsProxyEnable function in /goform/formWpsProxyEnable on Edimax EW-7438RPn 1.31. Manipulating the submit-url argument can lead to buffer overflow.
A vulnerability in the hackney library (versions 2.0.0 through 4.0.1) allows a Flooding attack due to missing size limits on the HTTP/3 response buffer. A malicious server can send small chunks, resetting the timeout, leading to unbounded memory growth and exhaustion of the BEAM process heap.
hackney before version 4.0.1 does not percent-encode CR (\r) and LF (\n) characters in the URL query component, enabling HTTP Request Splitting. An attacker controlling the URL can inject raw CRLF sequences into the query string, allowing arbitrary HTTP headers or request splitting.
A vulnerability in the hackney library (versions 2.0.0 through 4.0.1) allows memory exhaustion by an attacker-controlled WebSocket server. The WebSocket client does not limit buffer sizes in three code paths, enabling a Flooding attack.