CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Nanoleaf firmware version 7.1.1 and below lacks TLS verification, allowing attackers to execute arbitrary code via a DNS hijacking attack.
Wtyczka Profile Builder – User Profile & User Registration Forms dla WordPress jest podatna na nieautoryzowane resetowanie haseł w wersjach do 3.9.0 włącznie. Problem wynika z niewystarczającej walidacji funkcji resetowania hasła, która używa wartości w postaci czystego tekstu zamiast wartości haszowanej.
A remote code execution (RCE) vulnerability was discovered in the Aigital Wireless-N Repeater Mini_Router firmware version v0.131229 via the sysCmd parameter in the formSysCmd function. This flaw can be exploited by sending a crafted HTTP request.
Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series 4.60 through 5.35, USG FLEX series 4.60 through 5.35, and ATP series 4.60 through 5.35. An unauthenticated attacker could execute OS commands remotely by sending crafted packets to an affected device.
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required. The flaw exists within the SetupCompleted class due to improper access control. An attacker can bypass authentication and execute arbitrary code in the context of SYSTEM.
Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
XWiki Platform is vulnerable to code injection in the `since` parameter of the `/xwiki/bin/view/XWiki/Notifications/Code/LegacyNotificationAdministration` endpoint. This allows an XWiki syntax injection attack that can escalate privileges from view to programming rights and subsequently execute arbitrary code. The vulnerability is patched in XWiki 15.0-rc-1, 14.10.3, 14.4.8 and 14.10.3.
A command injection vulnerability was discovered in the Nanoleaf Desktop App before version 1.3.1, which is exploited via a crafted HTTP request.
CVE-2023-1873 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in the Faturamatik Bircard system. This issue affects Bircard versions before 23.04.05.
CVE-2023-1723 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in the Veragroup Mobile Assistant application. This issue affects Mobile Assistant versions before 21.S.2343.
Wtyczka ZM Ajax Login & Register dla WordPressa jest podatna na obejście uwierzytelniania w wersjach do 2.0.2 włącznie. Problem wynika z niewystarczającej weryfikacji użytkownika podczas logowania przez Facebooka, co umożliwia nieautoryzowanym atakującym logowanie się jako dowolny istniejący użytkownik na stronie.
CVE-2023-1833 vulnerability in DTS Electronics Redline Router firmware allows Authentication Bypass due to a primary weakness. This issue affects Redline Routers before version 7.17.
The Authentication Bypass vulnerability in the firmware of DTS Electronics Redline Router allows for an authentication bypass attack. This issue affects Redline Routers before version 7.17.
CVE-2023-1863 describes an improper neutralization of special elements used in SQL commands, allowing command line execution through SQL Injection in Eskom Water Metering Software. This issue affects versions prior to 23.04.06.
Auto Dealer Management System v1.0 contains a SQL injection vulnerability. An attacker can exploit this flaw to execute unauthorized database queries.
AM Presencia v3.7.3 was discovered to contain a SQL injection vulnerability in the login form. An attacker can manipulate the 'user' parameter to execute unauthorized database queries.
In bloofox v0.5.2, an arbitrary file deletion vulnerability was discovered via the delete_file() function. An attacker can exploit this flaw to delete critical system files.
Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account. This does not provide access to stored survey or response data.
Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. If a template contains a Go template action within a Javascript template literal, the contents of the action can be used to terminate the literal, injecting arbitrary Javascript code into the Go template. With the fix, Template.Parse returns an Error when it encounters templates like this.
Wtyczka WCFM Membership dla WordPressa jest podatna na eskalację uprawnień w wersjach do 2.10.0 włącznie, z powodu braku sprawdzenia uprawnień w akcji AJAX wp_ajax_nopriv_wcfm_ajax_controller, która kontroluje ustawienia członkostwa. Umożliwia to nieautoryzowanym atakującym modyfikację formularza rejestracji członkostwa, co pozwala im ustawić rolę rejestracji na dowolnego użytkownika, w tym administratora.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS