CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Podatność w powłoce U-Boot prowadzi do eskalacji uprawnień na urządzeniach produkcyjnych. Atakujący może wykorzystać tę lukę, aby uzyskać wyższe uprawnienia w systemie.
Podatność CVE-2023-35039 dotyczy niewłaściwego ograniczenia nadmiernych prób uwierzytelnienia w wtyczce Be Devious Web Development Password Reset with Code dla WordPress REST API. Problem ten występuje w wersjach od n/a do 0.0.15.
VisiLogic w wersjach przed 9.9.00, używany w PLC i HMI Vision oraz Samba, korzysta z domyślnego hasła administracyjnego. Nieautoryzowany atakujący z dostępem do sieci może przejąć kontrolę administracyjną nad podatnym systemem.
The vulnerability in ArslanSoft Education Portal allows unrestricted file uploads of dangerous types, leading to command injection.
CVE-2023-5634 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in the ArslanSoft Education Portal. This issue affects versions of the Education Portal before v1.1.
Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file.
A command injection vulnerability was discovered in Zumtobel Netlink CCD Onboard firmware versions 3.74-3.80 via the NetHostname parameter. An attacker can remotely execute arbitrary system commands.
Hardcoded credentials for the Administrator account were discovered in Zumtobel Netlink CCD Onboard firmware versions 3.74-3.80.
A vulnerability in JumpServer GPLv3 v.3.8.0 allows a remote attacker to bypass command filtering and execute arbitrary code. Note that the vendor disputes this, stating that command filtering is not intended to restrict authorized users.
CVE-2023-3631 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in the Medart Notification Panel.
CVE-2023-3377 describes an improper neutralization of special elements used in SQL commands, leading to SQL Injection vulnerabilities in Veribilim Software Computer Veribase.
A vulnerability in Autodesk AutoCAD 2024 and 2023 involves an out-of-bounds write when parsing a maliciously crafted CATPART file. An attacker can exploit this to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
A vulnerability in Autodesk AutoCAD 2024 and 2023 involves a heap-based buffer overflow when parsing a maliciously crafted MODEL file. An attacker can exploit this to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Wtyczka UserPro dla WordPressa jest podatna na nieautoryzowane resetowanie haseł w wersjach do 5.1.1 włącznie. Problem wynika z niewystarczającej walidacji funkcji resetowania hasła, która używa wartości w postaci czystego tekstu zamiast wartości haszowanej.
Wtyczka UserPro dla WordPressa jest podatna na obejście uwierzytelnienia w wersjach do 5.1.1 włącznie. Problem wynika z niewystarczającej weryfikacji użytkownika podczas logowania przez Facebooka, co umożliwia nieautoryzowanym atakującym logowanie się jako dowolny istniejący użytkownik na stronie.
CVE-2023-2889 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in Veon Computer Service Tracking Software before crm version 2.0.
CVE-2023-5047 describes an improper neutralization of special elements used in SQL commands, leading to SQL Injection vulnerabilities in the DRDrive system.
In ownCloud core before version 10.13.1, an attacker can access, modify, or delete any file without authentication if the victim's username is known and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no signing-key is configured for the file owner. The earliest affected version is 10.6.0.
An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment (phpinfo). This information includes all the environment variables of the webserver. In containerized deployments, these environment variables may include sensitive data such as the ownCloud admin password, mail server credentials, and license key.
In Firefox for iOS, an attacker could access internal pages or data by exfiltrating a security key from ReaderMode via the referrerpolicy attribute. This affects Firefox for iOS versions prior to 120.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS