CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A Cross Site Scripting (XSS) vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary JavaScript code via a crafted payload in the 'txt' parameter of the index.php component.
A Cross Site Scripting (XSS) vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary JavaScript code via a crafted payload to the ID parameter in the index.php component.
A Cross Site Scripting (XSS) vulnerability in phpkobo AjaxNewTicker version 1.0.5 allows a remote attacker to execute arbitrary JavaScript code via a crafted payload in the index.php component.
A vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS and IOS XE Software could allow an authenticated, remote attacker with administrative control of a group member or key server to execute arbitrary code or cause a device crash. It is due to insufficient validation of attributes in GDOI and G-IKEv2 protocols.
A stored cross-site scripting (XSS) vulnerability was found in DedeBIZ v6.2.11 in the Website column management function. Attackers can inject malicious JavaScript or HTML into the title parameter, leading to script execution in the victim's browser.
A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to upload and download arbitrary files via J-Web, leading to loss of integrity or confidentiality, and may allow chaining to other vulnerabilities.
A flaw was found in Red Hat's AMQ-Streams, which affects the OKHttp component. The issue involves information disclosure via an exception triggered by a header containing an illegal value.
A cross-site scripting (XSS) vulnerability in Froala Editor v4.1.1 allows remote attackers to execute arbitrary code via the 'Insert link' parameter in the 'Insert Image' component.
XSS vulnerability in Roundcube before 1.4.14, 1.5.4, and 1.6.3 allows XSS via text/plain email messages with crafted links.
A certificate validation issue was addressed. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A malicious app may be able to bypass signature validation. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.
A Cross-site scripting (XSS) vulnerability in Nagios XI version 5.11.1 and below allows authenticated attackers with access to the custom logo component to inject arbitrary JavaScript or HTML via the alt-text field. This affects all pages containing the navbar including the login page, enabling the attacker to steal plaintext credentials.
A SQL injection vulnerability in Nagios XI versions 5.11.0 through 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via the ID parameter in a POST request to /nagiosxi/admin/banner_message-ajaxhelper.php.
A Cross-Site Scripting (XSS) vulnerability was found in Jodit Editor version 4.0.0-beta.86. The flaw allows a remote attacker to inject malicious JavaScript code through the rich text editor component.
An information leak in Coffee-jumbo v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
An information leak in youmart-tokunaga v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
An information leak vulnerability in TonTon-Tei_waiting Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
An information leak vulnerability in THE_B_members card version 13.6.1 allows attackers to obtain the channel access token and send crafted messages.
An information leak in YKC Tokushima_awayokocho Line v13.6.1 allows attackers to obtain the channel access token. With this token, they can send crafted messages.
An information leak vulnerability in Cheese Cafe Line v13.6.1 allows attackers to obtain the channel access token. This token can be used to send crafted messages.
An information leak in Camp Style Project Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS