CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A Cross-Site Scripting (XSS) vulnerability was found in Chamilo LMS version 1.11.18. A local attacker can exploit the course category parameters to execute arbitrary JavaScript code in the victim's browser.
A Cross Site Scripting (XSS) vulnerability was found in Chamilo LMS version 1.11.18. It allows a local attacker to execute arbitrary code via the resource sequencing parameters.
A Cross-Site Scripting vulnerability was found in Chamilo LMS version 1.11.18. A local attacker can use the skype and linedin_url parameters to execute arbitrary JavaScript code in the victim's browser.
A Cross-Site Scripting (XSS) vulnerability was found in Chamilo LMS version 1.11.18. A local attacker can execute arbitrary JavaScript code via the skills wheel parameter.
A Cross-Site Scripting vulnerability was found in Chamilo LMS version 1.11.18. A local attacker can execute arbitrary JavaScript code via the forum title parameter.
A Cross-Site Scripting (XSS) vulnerability was found in Chamilo LMS version 1.11.18 in the system announcements parameter. It allows a local attacker to execute arbitrary JavaScript code in the victim's browser.
A buffer overflow vulnerability was found in Libtiff version 4.0.7. A local attacker can exploit the tiffcp function in tiffcp.c to cause a denial of service (DoS).
Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR.
Use of out-of-range pointer offset in GitHub repository vim/vim prior to 9.0.1499.
A reflected Cross Site Scripting (XSS) vulnerability was found in Intermesh BV Group-Office version 6.6.145. Attackers can exploit the GO_LANGUAGE cookie to escalate privileges and obtain sensitive information.
A cross-site scripting (XSS) vulnerability in ToolJet v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comment Body component.
Critical SQL injection vulnerability in Campcodes Retro Basketball Shoes Online Store 1.0 in file details.php via manipulation of the id argument. The attack can be performed remotely and the exploit is publicly available.
Critical SQL injection vulnerability in Campcodes Retro Basketball Shoes Online Store 1.0 in file contactus1.php via manipulation of the email argument. The attack can be performed remotely and the exploit is publicly available.
Critical SQL injection vulnerability in Campcodes Retro Basketball Shoes Online Store 1.0 in file contactus.php via manipulation of the email argument. The attack can be performed remotely and the exploit is publicly available.
A critical vulnerability was found in Campcodes Retro Basketball Shoes Online Store 1.0 in the file /function/login.php. Manipulation of the email argument leads to SQL injection, allowing remote attack. The exploit has been disclosed publicly.
A critical vulnerability was found in Campcodes Retro Basketball Shoes Online Store 1.0 in the file faqs.php. Manipulation of the id argument leads to SQL injection, allowing remote attack. The exploit has been disclosed publicly.
gatsby-plugin-sharp is a plugin for the gatsby framework which exposes functions built on the Sharp image processing library. The gatsby-plugin-sharp plugin prior to versions 5.8.1 and 4.25.1 contains a path traversal vulnerability exposed when running the Gatsby develop server (`gatsby develop`). It should be noted that by default gatsby develop is only accessible via the localhost 127.0.0.1, and one would need to intentionally expose the server to other interfaces to exploit this vulnerability by using server options such as --host 0.0.0.0, -H 0.0.0.0, or the GATSBY_HOST=0.0.0.0 environment variable. Attackers exploiting this vulnerability will have read access to all files within the scope of the server process. A patch has been introduced in [email protected] and [email protected] which mitigates the issue by ensuring that included paths remain within the project directory. As stated above, by default gatsby develop is only exposed to the localhost 127.0.0.1. For those using the develop server in the default configuration no risk is posed. If other ranges are required, preventing the develop server from being exposed to untrusted interfaces or IP address ranges would mitigate the risk from this vulnerability. Users are non the less encouraged to upgrade to a safe version.
Auto Dealer Management System v1.0 contains a cross-site scripting (XSS) vulnerability via the name parameter in /classes/SystemSettings.php?f=update_settings. An attacker can inject malicious JavaScript code that will be executed in the victim's browser.
A vulnerability in the web-based management interface of Cisco Small Business Routers RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary commands on an affected device. This vulnerability is due to improper validation of user input within incoming HTTP packets. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web-based management interface. A successful exploit could allow the attacker to gain root-level privileges and access unauthorized data. To exploit this vulnerability, an attacker would need to have valid administrative credentials on the affected device. Cisco has not and will not release software updates that address this vulnerability. However, administrators may disable the affected feature as described in the Workarounds section.
A stored HTML injection vulnerability in LiveAction LiveSP v21.1.2 allows attackers to execute arbitrary code via a crafted payload.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS