CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.08)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the remark parameter in /manage/ipsec/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the page.
Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the REMARK parameter in /cgi-bin/openvpnclient.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the remark parameter in /manage/dnsmasq/localdomains/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the page.
Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the ADDRESS BCC parameter in /cgi-bin/smtprouting.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the page.
Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the domain parameter in /manage/smtpscan/domainrouting/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the page.
Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the DOMAIN parameter in /cgi-bin/smtpdomains.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the page.
Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the group parameter in /cgi-bin/proxygroup.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the page.
Endian Firewall version 3.3.25 and prior have a stored XSS vulnerability via the user parameter in /cgi-bin/proxyuser.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the mimetypes parameter in /cgi-bin/proxypolicy.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the page.
Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the remark parameter in /cgi-bin/xtaccess.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the page.
Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the remark parameter in /cgi-bin/vpnfw.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the page.
Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the remark parameter in /cgi-bin/zonefw.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the page.
Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the remark parameter in /cgi-bin/outgoingfw.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
In Endian Firewall version 3.3.25 and prior, a stored XSS vulnerability was found in the remark parameter in /cgi-bin/incoming.cgi. An authenticated attacker can inject JavaScript that executes when other users view the page.
Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the remark parameter in /cgi-bin/snat.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the remark parameter in /cgi-bin/dnat.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the dscp parameter in /manage/qos/rules/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the name parameter in /manage/qos/classes/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the remark user ham spam parameter in /cgi-bin/salearn.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
In Endian Firewall version 3.3.25 and prior, a stored XSS vulnerability was found in the remark parameter in /manage/dhcp/fixed_leases/. An authenticated attacker can inject JavaScript that executes when other users view the page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS