CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Vulnerability related to missing input length verification in the distributed file system. Successful exploitation of this vulnerability may lead to out-of-bounds read.
A SQL injection vulnerability has been identified in the MOVEit Transfer web application before version 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4). An attacker could exploit this vulnerability to gain unauthorized access to the MOVEit Transfer database.
Versions of protobuf.js (protobufjs) from 6.10.0 to 7.x before 7.2.5 are vulnerable to Prototype Pollution. An attacker can exploit a user-controlled protobuf message to modify the Object.prototype, allowing for the addition and overwriting of data and functions.
Key management vulnerability on system. Successful exploitation of this vulnerability may affect service availability and integrity.
The Ultimate Member WordPress plugin before version 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will.
An issue in LangChain before version 0.0.236 allows an attacker to execute arbitrary code. The ability to use os.system, exec, or eval in Python code poses a significant risk.
CVE-2023-35797 describes an improper input validation vulnerability in Apache Airflow Hive Provider before version 6.1.1. This allows bypassing security checks and remote code execution (RCE) via the principal parameter.
OpenTSDB, an open-source, distributed time series database, is vulnerable to remote code execution by writing user-controlled input to a Gnuplot configuration file and running Gnuplot with the generated configuration.
There is an SQL Injection vulnerability in the GitHub repository fossbilling/fossbilling prior to version 0.5.3.
XWiki Platform allows users with edit rights to modify all pages in the `CKEditor` space, which can lead to the removal of technical documents and editing the JavaScript configuration of CKEditor, resulting in persistent XSS.
An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3, where an attempt to block a user fails after a temporary browser hang, resulting in a DBQueryDisconnectedError error message.
Certain HP LaserJet Pro print products are potentially vulnerable to Remote Code Execution and/or Elevation of Privilege via Server-Side Request Forgery (SSRF) using the Web Service Eventing model.
The Web3 – Crypto wallet Login & NFT token gating plugin for WordPress is vulnerable to authentication bypass in versions up to and including 2.6.0. This is due to incorrect authentication checking in the 'hidden_form_data' function.
Wtyczka BookIt dla WordPressa jest podatna na obejście uwierzytelniania w wersjach do 2.3.7 włącznie. Problem wynika z niewystarczającej weryfikacji użytkownika podczas rezerwacji wizyty przez wtyczkę.
XWiki Platform allows attackers to inject XWiki syntax and Velocity code by editing documents with an icon set, leading to remote code execution. Various attack vectors, including the use of the icon set in HTML, can be exploited.
XWiki Platform allows users to edit their profiles and notification settings, enabling the execution of arbitrary script macros, including Groovy and Python, leading to remote code execution. Versions 14.10.6 and 15.2RC1 contain patches for this vulnerability.
A vulnerability in XWiki Platform allows remote code execution even after upgrading to a version that includes fixes. The issue arises when old document versions containing vulnerabilities are not removed from history, allowing for their reuse.
XWiki commons had a vulnerability in HTML sanitization that allowed the use of form and input tags. An attacker could create phishing forms or inject malicious code that could be executed by an admin.
Sealos is an open source cloud operating system distribution based on the Kubernetes kernel. In versions of Sealos prior to 4.2.1-rc4 an improper configuration of RBAC permissions allowed an attacker to obtain cluster control permissions, enabling control over the entire cluster and hundreds of pods and other resources.
The password reset function in ILIAS versions 7.0_beta1 through 7.20 and 8.0_beta1 through 8.1 allows remote attackers to take over the account.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS