CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A use-after-free flaw has been found in glibc's getaddrinfo function. In an extremely rare scenario where an NSS module implements only specific hooks and the query meets certain conditions, an application crash may occur.
A reflected cross-site scripting (XSS) vulnerability exists in the File Manager function of Webmin v2.100. It allows attackers to execute malicious scripts by injecting a crafted payload into the 'Find in Results' file.
Webmin version 2.100 contains a stored cross-site scripting (XSS) vulnerability. An attacker can inject malicious HTML or JavaScript code via the cloned module name parameter.
A stored XSS vulnerability was found in Webmin v2.100 in the Usermin Configuration function. Attackers can inject malicious JavaScript or HTML into the Custom field, leading to script execution in the victim's browser.
In Webmin 2.100, a Cross-Site Scripting (XSS) vulnerability was found in the File Manager functionality. An attacker can inject malicious code that executes in the victim's browser during file search or replace operations.
A reflected cross-site scripting (XSS) vulnerability exists in the File Manager function of Webmin v2.100. It allows attackers to execute malicious scripts by injecting a crafted payload into the 'Replace in Results' file.
A flaw was found in GLib related to GVariant deserialization. A crafted GVariant can cause excessive processing, leading to denial of service.
There is a failure in the -fstack-protector feature in GCC-based toolchains targeting AArch64, allowing an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without detection. This issue only affects C99-style dynamically-sized local variables or those created using alloca().
Microsoft Word Information Disclosure Vulnerability. Details of the vulnerability are not provided in the description.
Cross Site Scripting (XSS) vulnerability in the Webmail Calendar of IceWarp 10.3.1 allows remote attackers to inject arbitrary web script or HTML via the "p4" field.
Xpand IT Write-back manager v2.3.1 uses a hardcoded salt in the license class configuration, leading to the generation of hardcoded and predictable symmetric encryption keys for license generation and validation. This allows an attacker to reconstruct the keys and forge licenses.
A SQL injection vulnerability in the Search functionality of tickets.php page in osTicket 1.15.x allows authenticated attackers to execute arbitrary SQL commands via the combination of 'keywords' and 'topic_id' URL parameters.
A vulnerability in the Embedded Service Router (ESR) of Cisco ISE could allow an authenticated, local attacker to read, write, or delete arbitrary files on the underlying operating system and escalate privileges to root. It is due to improper privilege management in the ESR console, and an attacker could send a crafted request to an affected device.
A stored XSS vulnerability was discovered in REDCap 13.1.35 in the new project creation function. Attackers can inject malicious JavaScript or HTML into the project title parameter, leading to script execution in other users' browsers.
A vulnerability in the remote access VPN feature of Cisco ASA and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a brute force attack to identify valid credentials or an authenticated, remote attacker to establish a clientless SSL VPN session with an unauthorized user. The issue is due to improper separation of authentication, authorization, and accounting (AAA) between the remote access VPN feature and the HTTPS management and site-to-site VPN features.
In vowifiservice, there is a possible missing permission check, which could lead to local information disclosure with no additional execution privileges.
In vowifiservice, there is a possible missing permission check, which could lead to local information disclosure with no additional execution privileges.
In vowifiservice, there is a possible missing permission check, which could lead to local information disclosure with no additional execution privileges.
In vowifiservice, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges.
A critical vulnerability was found in SourceCodester Inventory Management System version 1.0. Manipulation of the 'page' argument in the index.php file leads to file inclusion, allowing for remote attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS