CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple vulnerabilities in the per-user-override feature of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to bypass a configured ACL and allow traffic that should be denied. These vulnerabilities are due to a logic error in constructing and applying per-user-override rules. A successful exploit could allow the attacker to bypass the interface ACL and access protected resources.
A vulnerability in the SSL file policy implementation of Cisco FTD Software during SSL/TLS inspection with a URL Category could allow an unauthenticated, remote attacker to cause the Snort 3 detection engine to unexpectedly restart. This is due to a logic error when inspecting SSL/TLS connections with URL Category configured. An attacker could send a crafted SSL/TLS connection to trigger a reload, resulting in bypass or DoS.
Vim has a use-after-free vulnerability in memory allocated in the `ga_grow_inner` function. This issue can occur when using the `:history` command, leading to an integer overflow and potential use-after-free.
A use-after-free flaw was found in the xorg-x11-server that may lead to an X server crash in a specific multi-screen configuration. The issue occurs when the pointer is warped from a window on one screen to the root window of another screen, followed by the destruction of the original window and then another window.
When opening a page in reader mode, the redirect URL could have caused attacker-controlled script to execute in a reflected Cross-Site Scripting (XSS) attack. This vulnerability affects Firefox for iOS < 119.
An out-of-bounds read flaw was found in the GRUB2 NTFS filesystem driver. A physically present attacker can present a specially crafted NTFS image to read arbitrary memory locations. A successful attack allows sensitive data cached in memory or EFI variable values to be leaked, posing a high confidentiality risk.
A vulnerability in the ArchiveBox web archiving system allows malicious JavaScript execution in the context of an admin session. The issue affects users who use the `wget` extractor and view archived pages. Malicious code can hijack admin privileges and perform arbitrary operations on the archive.
Stored XSS vulnerability in Roundcube before 1.4.15, 1.5.5, and 1.6.4 allows a remote attacker to load arbitrary JavaScript code via an HTML email with a crafted SVG document.
Multiple Stored Cross Site Scripting (XSS) vulnerabilities in Opart opartmultihtmlblock before version 2.0.12 and Opart multihtmlblock* version 1.0.0, allow remote authenticated users to inject arbitrary web script or HTML via the body_text or body_text_rude field in /sourcefiles/BlockhtmlClass.php and /sourcefiles/blockhtml.php.
Exposure of Sensitive Information to an Unauthorized Actor in WordPress in many versions from 4.1 to 6.3.1. The exact mechanism is not described, but it involves data exposure.
Elevation of Privilege vulnerability in Skype for Business. Technical details are not available in the description.
Security Feature Bypass vulnerability in Windows Mark of the Web. Technical details are not available in the description.
Information Disclosure vulnerability in Microsoft WordPad. Technical details are not available in the description.
A client-side enforcement of server-side security [CWE-602] vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiAnalyzer version 7.4.0 and before 7.2.3 may allow a remote attacker with low privileges to access a privileged web console via client side code execution.
Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an authenticated file disclosure vulnerability. A remote and authenticated attacker can read arbitrary system files using the svpn_html/loadfile.php endpoint. This issue is exploitable by a remote and unauthenticated attacker when paired with CVE-2023-30803.
A memory leak flaw was found in Libtiff's tiffcrop utility that occurs when processing a TIFF image file. An attacker can pass a crafted TIFF image file to the tiffcrop utility, causing this memory leak issue, resulting in application crashes and ultimately leading to denial of service.
A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory.
A Cross Site Scripting (XSS) vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload in the subcmd parameter of the index.php component.
A Cross Site Scripting (XSS) vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary JavaScript code via a crafted title parameter in the index.php component.
A Cross Site Scripting (XSS) vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary JavaScript code via a crafted payload in the 'cmd' parameter of the index.php component.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS