CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Netskope was notified about a potential gap in its agent (NS Client) on Windows systems. If exploited, a local, authenticated user with Administrator privileges can improperly load the driver as a generic kernel service, causing a system crash (Blue-Screen-of-Death) and resulting in a Denial of Service (DoS).
A stack-based buffer overflow vulnerability in ABB Terra AC wallbox (up to 1.8.33) may allow an attacker to execute code or cause a crash.
WebITR developed by Uniong has an Arbitrary File Read vulnerability, allowing authenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files.
WebITR developed by Uniong has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
WebITR developed by Uniong has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
app/Model/EventReport.php in MISP before 2.5.27 allows path traversal in view picture for a site-admin.
Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration. When validating XML-based invoices, the XML parser could read files from the filesystem and expose their content to a remote host.
Kivitendo before 3.9.2 allows XXE injection. By uploading an electronic invoice in ZUGFeRD format, it is possible to read and exfiltrate files from the server's filesystem.
Permission control vulnerability in the file management module. Successful exploitation of this vulnerability may affect service confidentiality.
A use-after-free (UAF) vulnerability exists in the USB driver module. Successful exploitation will affect availability and confidentiality.
Identity authentication bypass vulnerability in the Gallery app. Successful exploitation of this vulnerability may affect service confidentiality.
Permission control vulnerability in the file management module. Successful exploitation may affect service confidentiality.
The Nextend Social Login and Register plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 3.1.21. This is due to missing or incorrect nonce validation on the 'unlinkUser' function, allowing unauthenticated attackers to unlink a user's social login via a forged request if they can trick a site administrator into performing an action like clicking a link.
Configuration defect vulnerability in the file management module. Successful exploitation may affect app data confidentiality and integrity.
A denial of service (DoS) vulnerability exists in the office service. Successful exploitation of this vulnerability may affect availability.
Permission control vulnerability in the Notepad module. Successful exploitation may affect service confidentiality.
Permission control vulnerability in the Wi-Fi module. Successful exploitation may affect service confidentiality.
Vulnerability of accessing invalid memory in the component driver module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.
Permission control vulnerability in the App Lock module. Successful exploitation may affect availability.
Permission control vulnerability in the startup recovery module. Successful exploitation will affect availability and confidentiality.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS