CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Wtyczka MStore API dla WordPressa jest podatna na obejście uwierzytelniania w wersjach do 3.9.0 włącznie. Problem wynika z niewystarczającej weryfikacji użytkownika dostarczanego podczas żądania REST API dotyczącego realizacji kuponu przez wtyczkę.
Wtyczka MStore API dla WordPressa jest podatna na obejście uwierzytelniania w wersjach do 3.9.2 włącznie. Problem wynika z niewystarczającej weryfikacji użytkownika dostarczanego podczas żądania REST API dodawania ogłoszenia przez wtyczkę.
A vulnerability in Netbox v3.5.1 allows unauthenticated attackers to execute queries against the GraphQL database, potentially granting access to sensitive data stored in the database.
Remote command injection vulnerability in Barracuda Email Security Gateway (appliance form factor only) affecting versions 5.1.3.001-9.2.0.006. It arises from incomplete input validation of user-supplied .tar file names, allowing a remote attacker to execute a system command with the privileges of the product. Fixed in patch BNSF-36456, automatically applied to all customer appliances.
In RocketMQ versions 5.1.0 and below, there is a risk of remote command execution under certain conditions. Several components of RocketMQ, including NameServer, Broker, and Controller, are exposed on the extranet and lack permission verification.
CVE-2023-2064 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in Minova Technology eTrace. This issue affects eTrace versions before 23.05.20.
CVE-2023-2045 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in Ipekyolu Auto Damage Tracking Software versions before 4.
CVE-2023-33010 describes a buffer overflow vulnerability in the ID processing function in the firmware of Zyxel ATP series, USG FLEX, USG20(W)-VPN, VPN series, and ZyWALL/USG. This could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even remote code execution on an affected device.
CVE-2023-33009 describes a buffer overflow vulnerability in the notification function in the firmware of Zyxel ATP series, USG FLEX series, USG20(W)-VPN, VPN series, and ZyWALL/USG series. This could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even remote code execution on an affected device.
CVE-2023-2750 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in the Cityboss E-municipality system. This issue affects E-municipality versions before 6.05.
Podatność CVE-2023-1508 dotyczy oprogramowania Mobilmen Terminal w systemach Adam Retail Automation, które jest podatne na atak typu SQL Injection. Problem występuje w wersjach przed 3.
Piwigo version 13.6.0 is vulnerable to SQL Injection in the 'profile' function.
Piwigo version 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php.
Old Age Home Management version 1.0 is vulnerable to SQL Injection via the username parameter.
An issue was discovered in KaiOS 3.0 before 3.1 related to the /system/bin/tctweb_server binary that exposes a local web server. This server accepts arbitrary Bash commands and executes them as root, posing a serious security risk to the device.
MXsecurity version 1.0 is vulnerable to hardcoded credential vulnerability. This vulnerability allows crafting arbitrary JWT tokens, enabling bypassing authentication for web-based APIs.
A vulnerability in the Rental Module developed by a third party for Ideasoft's e-commerce platform allows authorization bypass through a user-controlled key, leading to authentication abuse.
The vulnerability in the Rental Module developed by a third party for Ideasoft's e-commerce platform allows unrestricted upload of files with dangerous types, leading to command injection and the ability to upload malicious files, including web shells to a server.
Wtyczka WCFM Membership – WooCommerce Memberships dla Multivendor Marketplace w WordPressie jest podatna na niebezpieczne bezpośrednie odniesienia do obiektów w wersjach do 2.10.7 włącznie. Problem wynika z tego, że wtyczka umożliwia użytkownikom kontrolowany dostęp do obiektów, co pozwala na ominięcie autoryzacji i dostęp do zasobów systemowych.
Wtyczka BP Social Connect dla WordPressa jest podatna na obejście uwierzytelniania w wersjach do 1.5 włącznie. Problem wynika z niewystarczającej weryfikacji użytkownika podczas logowania przez Facebooka, co umożliwia nieautoryzowanym atakującym logowanie się jako dowolny istniejący użytkownik na stronie.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS