CVE Vulnerability Catalog

Translated CVE descriptions from NVD NIST - in English

Browse vulnerabilities by package

CISA KEV catalog updated: 06/11/2026(UTC) (v2026.11.06)

All Critical High Medium Low Actively exploited19,286 results

One email a week with newly published vulnerabilities worth knowing about. No account needed.

This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.

CriticalEPSS 62%

20/09/2023(UTC)

A Cross Site Scripting (XSS) vulnerability in Dolibarr ERP CRM version 17.0.1 and earlier allows a remote attacker to obtain sensitive information and execute arbitrary code via the REST API module, related to analyseVarsForSqlAndScriptsInjection and testSqlAndScriptInject functions.

CriticalActively exploited

19/09/2023(UTC)

In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible.

16/09/2023(UTC)

Wtyczka Allow PHP in Posts and Pages dla WordPressa jest podatna na zdalne wykonanie kodu w wersjach do 3.0.4 włącznie, poprzez użycie shortcode 'php'. Umożliwia to uwierzytelnionym atakującym z uprawnieniami na poziomie subskrybenta lub wyższymi, wykonanie kodu na serwerze.

15/09/2023(UTC)

CVE-2023-4835 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in CF Software Oil Management Software.

15/09/2023(UTC)

CVE-2023-4833 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in Besttem Network Marketing Software.

15/09/2023(UTC)

A vulnerability in Saphira Connect allows Remote Code Inclusion with unnecessary privileges. This issue affects Saphira Connect versions before 9.

15/09/2023(UTC)

CVE-2023-4661 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in Saphira Connect versions before 9.

15/09/2023(UTC)

CVE-2023-4670 describes an improper neutralization of special elements used in SQL commands, allowing for SQL Injection attacks in Innosa Probbys.

15/09/2023(UTC)

The Cevik Informatics Online Payment System has an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. This issue affects versions before 4.09.

15/09/2023(UTC)

CVE-2023-4830 describes an improper neutralization of special elements used in SQL commands, leading to SQL Injection vulnerabilities in the Tura Signalix application.

15/09/2023(UTC)

CVE-2023-4673 describes an improper neutralization of special elements used in SQL commands, allowing for SQL Injection attacks in the Sanalogy Turasistan application.

14/09/2023(UTC)

The vulnerability in Yepas Digital Yepas related to incorrect use of privileged APIs allows for collecting data provided by users. This issue affects versions before 1.0.1.

14/09/2023(UTC)

CVE-2023-4702 describes an authentication bypass vulnerability in Yepas Digital Yepas. This issue affects versions before 1.0.1.

14/09/2023(UTC)

CVE-2023-4766 describes an improper neutralization of special elements used in SQL commands, allowing for SQL Injection in the Movus system. This issue affects versions before 20230913.

14/09/2023(UTC)

A vulnerability in Exagate SYSGuard 3001 allows authentication bypass through assumed-immutable data. This issue affects versions before 3.2.20.0.

14/09/2023(UTC)

CVE-2023-4832 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in Aceka Company Management. This issue affects versions before 3072.

12/09/2023(UTC)

User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL Server, Enterprise Developer, and Enterprise Server (including variants such as Enterprise Test Server) in specific versions when LDAP-based authentication is used with certain configurations. The vulnerability allows authentication with any valid username regardless of password correctness, and sometimes even with an invalid username.

CriticalEPSS 75%

12/09/2023(UTC)

A command injection vulnerability was discovered in the D-Link DIR-816 A2 router running firmware version 1.10 B05. The flaw resides in the /goform/Diagnosis component.

11/09/2023(UTC)

W TSplus Remote Access w wersji do 16.0.2.14 odkryto problem, w którym dane uwierzytelniające są przechowywane w postaci niezaszyfrowanej w kodzie źródłowym HTML strony logowania.

11/09/2023(UTC)

W TSplus Remote Access w wersji do 16.0.2.14 odkryto problem związany z uprawnieniami. Niektóre katalogi w %PROGRAMFILES(X86)%\TSplus\UserDesktop\themes mają pełne uprawnienia kontrolne dla wszystkich użytkowników.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS