CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A use of externally-controlled format string in Fortinet FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager allows an attacker to execute unauthorized code or commands via specially crafted packets.
The UNI-PA University Information System has an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. This issue affects versions of the system before 12.12.2023.
Remote code execution vulnerability in Microsoft Outlook. Allows an attacker to execute code remotely on the victim's machine.
Microsoft Exchange Server Elevation of Privilege Vulnerability. Technical details are not provided in the description.
A vulnerability in Microsoft Azure Kubernetes Service Confidential Container allows elevation of privilege. An attacker could exploit it to gain higher privileges in the confidential container environment.
Elevation of privilege vulnerability in the Microsoft Entra Jira Single-Sign-On plugin. It allows an attacker to elevate privileges in the Jira application.
A vulnerability in Microsoft Azure Kubernetes Service Confidential Container allows remote code execution. An attacker could exploit it to execute arbitrary code within the confidential container context.
A vulnerability in Microsoft Azure Site Recovery allows elevation of privilege. An attacker could exploit it to gain higher privileges in the Azure Site Recovery environment.
Podatność związana z deserializacją niezaufanych danych w dodatku G5Theme ERE Recently Viewed – Essential Real Estate. Problem ten dotyczy wersji dodatku od n/a do 1.3.
Podatność CVE-2024-25100 dotyczy programu poleceń kuponów WP Swings, który pozwala na deserializację niezaufanych danych, co prowadzi do wstrzyknięcia obiektów. Problem ten dotyczy wersji programu przed 1.8.4.
CVE-2023-6677 describes an improper neutralization of special elements used in SQL commands, leading to SQL Injection vulnerabilities in Oduyo Financial Technology Online Collection. This issue affects versions of Online Collection before 1.0.2.
An issue was discovered in MISP before version 2.4.184, allowing a client to start an export generation process without needing to use POST. This is related to app/Controller/JobsController.php and app/View/Events/export.ctp.
An issue was discovered in MISP before version 2.4.184 related to insecure organization logo uploads due to a lack of checks for file extension and MIME type.
An out-of-bounds write vulnerability in Fortinet FortiOS and FortiProxy across multiple versions. It allows an attacker to execute unauthorized code or commands via specifically crafted requests.
An issue in Dlink DIR-816A2 v.1.10CNB05 allows a remote attacker to execute arbitrary code via the wizardstep4_ssid_2 parameter in the sub_42DA54 function.
Wtyczka WP Booking Calendar dla WordPressa jest podatna na atak typu SQL Injection poprzez parametr 'calendar_request_params[dates_ddmmyy_csv]' we wszystkich wersjach do i włącznie z 9.9. Problem wynika z niewystarczającego zabezpieczenia dostarczonego przez użytkownika oraz braku odpowiedniego przygotowania istniejącego zapytania SQL.
An OS command injection vulnerability in Hardy Barth cPH2 eCharge charging station version 1.87.0 and earlier. An unauthenticated remote attacker can execute arbitrary commands on the system via specially crafted arguments passed to the connectivity check feature.
A Directory Traversal vulnerability in Stimulsoft Dashboard.JS before version 2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload in the fileName parameter of the Save function.
Wtyczka Photo Gallery by 10Web – Mobile-Friendly Image Gallery dla WordPressa jest podatna na atak typu Directory Traversal we wszystkich wersjach do i włącznie z 1.8.19 poprzez funkcję rename_item. Umożliwia to uwierzytelnionym atakującym zmianę nazw dowolnych plików na serwerze.
Wtyczka Shield Security – Smart Bot Blocking & Intrusion Prevention dla WordPressa jest podatna na Local File Inclusion we wszystkich wersjach do 18.5.9 włącznie, poprzez parametr render_action_template. Umożliwia to nieautoryzowanemu atakującemu dołączenie i wykonanie plików PHP na serwerze.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS