CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In JetBrains YouTrack before version 2026.2.18991, missing authorization allowed users with read-only project access to overwrite project notification templates.
In JetBrains YouTrack before version 2026.2.18991, changing article visibility settings was possible without update permission.
In JetBrains YouTrack before version 2026.2.18991, mailbox integration allowed authentication after a password reset.
In JetBrains YouTrack before version 2026.2.18991, improper access control on Gantt chart allowed edits by users with view-only access.
In JetBrains YouTrack before version 2026.2.18991, missing authorisation allowed read-only users to read project settings.
In JetBrains YouTrack before version 2026.2.18991, SSRF via stored XHTML injection was possible during PDF export.
In JetBrains IntelliJ IDEA before version 2026.2.3, remote code execution (RCE) via Structural Search script constraints was possible in untrusted projects.
In JetBrains TeamCity before versions 2026.2, 2026.1.4, and 2025.11.8, administrator account takeover was possible via password reset.
In JetBrains TeamCity before versions 2026.2, 2026.1.4, and 2025.11.8, authenticated users can execute commands on Windows servers via CRLF injection in Pipeline Git connection settings.
In JetBrains TeamCity before versions 2026.2, 2026.1.4, and 2025.11.8, a sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL.
Authorization bypass through user-controlled key vulnerability in Pay with Vipps for WooCommerce allows exploiting incorrectly configured access control security levels. Affects versions from n/a through 6.2.4.
Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output, which can allow crafted values to be interpreted as SVG markup. Version 0.33.5 contains a patch.
Joomla Extension - JCTables 1.21.1 has unauthenticated SQL injection in read and write queries. The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. Table names, column names, and values are taken directly from request parameters and concatenated into SQL queries, allowing SQLi for reading and writing queries.
The Business Directory plugin (business-directory-plugin) in WPTasty contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in an SQL command. The issue affects versions from n/a through 6.4.27.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in User Submitted Posts allows Stored XSS. Affects versions from n/a through 20260810.
AJA HELO Plus firmware before version 2.1.7 contains an information disclosure vulnerability that allows unauthenticated attackers to decrypt sensitive diagnostics bundles by exploiting a static AES passphrase embedded in obfuscated form within the firmware.
Trex MES from Trex Digital Smart Manufacturing Systems Inc. contains a missing authentication for critical function vulnerability, allowing authentication bypass. The issue affects versions through 2026-09-29.
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Command Line Execution through SQL Injection. This issue affects Trex MES: through 2026-09-29.
OpenSave through version 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. Attackers can specify arbitrary directories outside configured save locations to read and write files through manifest and sync routes.
OpenSave before 2.4.0-beta.1 fails to validate sender identity in WAN relay requests, allowing unpaired room members to impersonate paired devices by spoofing the RelayMessage From field. Attackers who know the room code can join, read paired peer identifiers from announcements, and send forged requests to access protected sync routes including save data, snapshots, and file operations.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS