CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the devices_configuration view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
A low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dashboard view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
A low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the alarming view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
A low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getWidgetTags function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
A low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getProjectTags function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
A low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the VerifyCreateLicences function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
A low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getComponentScalings function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
A low-privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getDeviceScalings function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
A low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getProjectScalings function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
An SQL Injection vulnerability in the saveObjectFromData function is caused by improper neutralization of special elements in a SQL SELECT command. A low privileged remote attacker can exploit it without authentication.
An SQL Injection vulnerability in the getDevicegroups function is caused by improper neutralization of special elements in a SQL SELECT command. A low privileged remote attacker can exploit it without authentication.
In the Easy View component, a low-privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
A SQL Injection vulnerability in the UpdateParam function of admin.mbnetj.php arises from improper neutralization of special elements in a SQL UPDATE command. A high privileged remote attacker can read the entire database and change values in a non-critical table.
A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the view.html.php files UpdateParam function due to improper neutralization of special elements in a SQL UPDATE command, allowing reading the whole database and changing values in a non-critical table.
A SQL Injection vulnerability in the DeleteSysLogEntry function arises from improper neutralization of special elements in a SQL DELETE command. A high privileged remote attacker can read the entire database and delete entries in a non-critical table.
A SQL Injection vulnerability in the _RemoveRequest function arises from improper neutralization of special elements in a SQL DELETE command. A high privileged remote attacker can read the entire database and delete entries in a non-critical table.
Wersja pakietu Synology Storage Manager przed 1.0.1-1100 zawiera podatność na wykorzystanie metody żądania GET z wrażliwymi ciągami zapytań w szyfrowaniu wolumenów. Umożliwia to lokalnym użytkownikom systemu Windows uzyskanie wrażliwych informacji.
W podatności CVE-2025-66593 w Synology Assistant przed wersją 7.0.6-50085 występuje błąd walidacji pochodzenia, który pozwala lokalnym użytkownikom na zapis dowolnych plików z ograniczoną zawartością oraz przeprowadzenie ataku typu denial-of-service podczas instalacji.
W podatności CVE-2025-66592 w Synology Active Backup for Business Agent przed wersją 3.1.0-4967 występuje błąd walidacji pochodzenia, który pozwala lokalnym użytkownikom na zapis dowolnych plików z ograniczoną zawartością oraz przeprowadzenie ataku typu denial-of-service podczas instalacji.
W podatności CVE-2025-13593 w Synology ActiveProtect Agent przed wersją 1.1.0-0439 występuje błąd walidacji pochodzenia, który pozwala lokalnym użytkownikom na zapis dowolnych plików z ograniczoną zawartością oraz przeprowadzenie ataku typu denial-of-service podczas instalacji.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS