CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability in Azure Apache Ambari allows attackers to spoof users. As a result, unauthorized users may gain access to system resources.
A vulnerability in Azure Apache Oozie allows attackers to spoof users, potentially leading to unauthorized access to resources.
A vulnerability in Azure DevOps Server allows attackers to spoof users, potentially leading to unauthorized access to resources.
Buffer overflow in Zoom Clients before version 5.14.5 may allow an unauthenticated user to enable a denial of service via network access.
A vulnerability in Azure HDInsight related to Jupyter Notebook allows spoofing, which may lead to unauthorized access to user data.
A vulnerability in Azure Apache Hive allows attackers to spoof users, potentially leading to unauthorized access to data.
A vulnerability in Microsoft Dynamics 365 On-Premises allows for remote code execution. An attacker can exploit this flaw to run unauthorized code on the server.
A vulnerability in the Windows HTML Platforms security feature allows for a bypass of security measures, potentially leading to unauthorized access to the system.
A vulnerability in Microsoft Message Queuing (MSMQ) allows attackers to remotely trigger an error, leading to denial of service. Exploiting this flaw may cause the MSMQ service to stop responding to requests.
A vulnerability in Microsoft Message Queuing (MSMQ) allows attackers to remotely trigger an error, leading to denial of service. Exploiting this flaw may result in the unavailability of MSMQ services.
The Cross Site Scripting (XSS) vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted payload to the PersonView.php component.
Version 5.0.0 of ChurchCRM contains an SQL injection vulnerability that allows a remote attacker to obtain sensitive information via the FundRaiserID parameter within the /FundRaiserEditor.php endpoint.
Cross Site Scripting (XSS) vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted payload to the systemSettings.php component.
Cross Site Scripting vulnerability in wger Workout Manager v.2.2.0a3 allows a remote attacker to gain privileges via the license_author field in the add-ingredient function.
CVE-2023-3653 describes an improper neutralization of input during web page generation, leading to Stored XSS vulnerability in Digital Ant E-Commerce Software.
The Digital Ant E-Commerce Software has a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects versions of the software before 11.
A Cross Site Scripting (XSS) vulnerability in Adiscon Aiscon LogAnalyzer through 4.1.13 allows a remote attacker to execute arbitrary code via the asktheoracle.php, details.php, index.php, search.php, export.php, reports.php, and statistics.php components.
PHPJabbers Class Scheduling System 1.0 lacks encryption on the password when editing a user account, allowing an attacker to capture all user names and passwords in clear text.
Maid Hiring Management System v1.0 has a SQL injection vulnerability in the Search Maid page. Attackers can exploit this flaw to manipulate database queries.
A SQL injection vulnerability was discovered in the Booking Request page of Maid Hiring Management System v1.0. It allows an attacker to manipulate database queries.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS