CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
There is an unauthenticated SQL Injection vulnerability in JetSmartFilters versions up to 3.8.1.
The Backpropagate library in versions 1.1.0 and 1.1.1 has a vulnerability that allows access to the user interface without authentication. This enables attackers to upload data, trigger training runs, and access models without any security.
Postiz is an AI social media scheduling tool. In versions prior to 2.21.8, an attacker could exploit a vulnerability in the Skool integration to forge a SUPERADMIN session, allowing impersonation of arbitrary organizations.
The Traccar Client app, used for GPS tracking, is vulnerable in versions 9.7.19 and below to an attack that allows hijacking GPS tracking parameters via a crafted deep link. Such a link can change the app's configuration without confirmation, redirecting telemetry data to an attacker-controlled server.
Rocket.Chat versions below 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 have an access control vulnerability in Livechat files. The authorization process for downloading protected files does not verify that rc_rid matches the requested file, allowing unauthenticated discovery of all uploaded files.
In Streambert versions 2.4.0 and prior, a Zip Slip vulnerability was identified in the subtitle extraction logic. The application does not sanitize archive entry filenames during extraction, allowing for path traversal attacks and writing arbitrary files to the host filesystem.
AI Lab versions below 5.4.2 are vulnerable to unauthenticated PHP object injection.
Versions of Blocksy Companion Pro up to 2.1.37 have a vulnerability allowing remote code execution (RCE) by unauthorized users.
In Charity Zone versions <= 1.1.1, there is a vulnerability that allows subscribers to upload arbitrary files.
In Kids Gift Shop versions <= 0.5.4, there is a vulnerability allowing arbitrary file uploads by subscribers.
In Ecommerce Zone versions <= 0.9.7, there is a vulnerability that allows subscribers to upload arbitrary files.
In Restaurant Zone versions <= 0.7.8, there is a vulnerability allowing arbitrary file uploads by subscribers.
There is an unauthenticated PHP Object Injection vulnerability in WooCommerce Product Filters versions below 2.0.6.
There is an unauthenticated SQL injection vulnerability in Blocksy Companion Pro versions below 2.1.29.
In Webenvo versions <= 0.0.6, there is a vulnerability that allows subscribers to upload arbitrary files.
There is an unauthenticated PHP Object Injection vulnerability in Elementra versions <= 1.0.9.
Unauthenticated SQL Injection exists in ListingPro versions <= 2.9.10.
Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinScheduler. This issue affects versions before 3.4.2.
Missing authorization check in DataSource API leads to arbitrary data source metadata disclosure in Apache DolphinScheduler.
Nifty versions up to 1.4.1 are vulnerable to unauthenticated PHP object injection.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS