CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An XSS issue was discovered in MDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message with JavaScript in an img tag, which could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window.
A flaw was found within the parsing of extended attributes in the kernel ksmbd module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this to disclose sensitive information on affected installations of Linux. Only systems with ksmbd enabled are vulnerable to this CVE.
W podatności CVE-2024-9477 występuje niewłaściwa neutralizacja danych wejściowych podczas generowania stron internetowych w oprogramowaniu AirTies Air4443, co umożliwia ataki typu Cross-Site Scripting (XSS). Problem ten dotyczy oprogramowania Air4443 do 14 października 2024 roku.
A session fixation vulnerability in Fortinet FortiOS 7.4.0 through 7.4.3, FortiOS 7.2.0 through 7.2.7, FortiOS 7.0.0 through 7.0.13 allows attacker to execute unauthorized code or commands via phishing SAML authentication link.
NTLM Hash Disclosure Spoofing Vulnerability allows for the disclosure of NTLM hashes. An attacker could exploit this to impersonate a user or system.
In mutt and neomutt, PGP encryption does not use the --hidden-recipient mode which may leak the Bcc email header field by inferring from the recipients info.
In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an unencrypted but signed email message to impersonate the original sender.
In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their value and include himself as a one of the recipients to compromise message confidentiality.
A flaw in Ansible-Core allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content, leading to arbitrary code execution.
A vulnerability in CloudPanel versions 2.0.0 through 2.4.2 allows low-privilege users to bypass access controls and gain unauthorized access to sensitive configuration files and administrative functionality.
An incorrect access control issue in the HomeServe Home Repair Android app version 3.3.4 allows a physically proximate attacker to escalate privileges via the fingerprint authentication function.
A vulnerability in the Bluetooth Low Energy implementation of Realtek RTL8762E BLE SDK version 1.4.0 allows an attacker to cause a Denial of Service (DoS) by sending a crafted ll_terminate_ind packet.
In 1C-Bitrix Bitrix24 version 23.300.100, a vulnerability was found due to insufficiently protected credentials in DAV server settings. A remote administrator can read Exchange account passwords via an HTTP GET request.
In 1C-Bitrix Bitrix24 version 23.300.100, a vulnerability was found due to insufficiently protected credentials in SMTP server settings. A remote administrator can read SMTP account passwords via an HTTP GET request.
Insufficiently protected credentials in AD/LDAP server settings in 1C-Bitrix Bitrix24 23.300.100 allow remote administrators to send AD/LDAP administrators account passwords to an arbitrary server via HTTP POST request.
In 1C-Bitrix Bitrix24 version 23.300.100, a vulnerability was found due to insufficiently protected credentials in DAV server settings. A remote administrator can read proxy-server account passwords via an HTTP GET request.
In 1C-Bitrix Bitrix24 version 23.300.100, a vulnerability was found due to insufficiently protected credentials in SMTP server settings. A remote administrator can send SMTP account passwords to an arbitrary server via an HTTP POST request.
Podatność CVE-2024-9147 dotyczy niewłaściwej neutralizacji tagów HTML związanych z skryptami w aplikacji Bna Informatics PosPratik, co pozwala na ataki typu XSS poprzez ciągi zapytań HTTP. Problem ten dotyczy wersji PosPratik przed 3.2.1.
A vulnerability in the login authentication of the Remote Access SSL VPN feature of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to deny further VPN user authentications for several minutes, resulting in a temporary DoS. This is due to ineffective memory resource handling during authentication. An attacker could send crafted packets to cause resource exhaustion.
A vulnerability in the VPN web server of Cisco ASA and FTD Software allows an authenticated local attacker with administrator privileges to execute arbitrary code with root privileges. This is due to improper validation of a specific file when read from system flash memory.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS