CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An out-of-bounds read vulnerability exists in libjxl. An attacker can cause an out-of-bounds read in the EXIF handler by using a specially crafted file.
A cross-site scripting (XSS) vulnerability in LiveAction LiveSP v21.1.2 allows attackers to execute arbitrary web scripts or HTML.
Insecure permissions were discovered in BMC firmware version 1.63 for the Supermicro X11SSL-CF HW Rev 1.01 motherboard. This vulnerability could allow unauthorized users to access sensitive system management functions.
Cross-site scripting (XSS) vulnerability in Simple Guestbook Management System 1 allows attackers to inject malicious JavaScript via Name, Referrer, Location, and Comments fields.
A Server-Side Request Forgery (SSRF) vulnerability was discovered in request-baskets up to version 1.2.1 via the /api/baskets/{name} component. Attackers can access network resources and sensitive information by crafting a malicious API request.
Podatność CVE-2023-1060 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w systemie YKM CRM, co pozwala na ataki typu Reflected XSS. Problem ten dotyczy wersji YKM CRM przed 23.03.30.
Podatność CVE-2023-1013 dotyczy niewłaściwej neutralizacji tagów HTML związanych z skryptami w aplikacji Vira-Investing, co umożliwia ataki typu Cross-Site Scripting (XSS). Problem ten występuje w wersjach przed 1.0.84.86.
Suprema BioStar 2 v2.8.16 was discovered to contain a SQL injection vulnerability via the 'values' parameter at /users/absence?search_month=1. An attacker can exploit this flaw to manipulate database queries.
In Stimulsoft Designer (Desktop) versions 2023.1.5 and 2023.1.4, after decompiling the Stimulsoft.report.dll library, an attacker can decrypt any connection string stored in .mrt files because a static secret is used. This secret is identical across all tested versions and operating systems.
An access control issue in Argo CD v2.4.12 and below allows unauthenticated attackers to enumerate existing applications. The problem stems from missing proper access controls.
In MISP version 2.4.169, the file app/Lib/Tools/CustomPaginationTool.php allows XSS in the community index.
A vulnerability in the IPv6 DHCP (DHCPv6) client module of Cisco Adaptive Security Appliance (ASA) Software, Cisco Firepower Threat Defense (FTD) Software, Cisco IOS Software, and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This is due to insufficient validation of DHCPv6 messages. An attacker could exploit this by sending crafted DHCPv6 messages, causing the device to reload. To exploit, the attacker needs to control the DHCPv6 server or be in a man-in-the-middle position.
W systemie raportowania internetowego As Koc Energy występuje podatność na atak typu Cross-site Scripting (XSS) z powodu niewłaściwego neutralizowania danych wejściowych podczas generowania stron internetowych. Problem ten dotyczy wersji systemu przed 23.03.10.
A heap buffer overflow vulnerability was discovered in swfdump version 0.9.2 in the function swf_GetPlaceObject at swfobject.c. This could lead to program crashes or potentially arbitrary code execution.
Podatność CVE-2023-1154 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w aplikacji Pacsrapor, co prowadzi do możliwości ataku typu Reflected XSS. Problem ten występuje w wersjach przed 1.22.
Podatność CVE-2023-0320 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w systemie UBYS Uniwersytetu Izmira Katip Celebi. Umożliwia to atak typu Stored XSS w wersjach przed 23.03.16.
The js/event-graph.js file in MISP before version 2.4.169 is vulnerable to XSS via the event-graph relationship tooltip.
The js/event-graph.js file in MISP before version 2.4.169 is vulnerable to XSS via event-graph node tooltips.
Podatność CVE-2023-0322 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w oprogramowaniu Talent Software UNIS, co prowadzi do możliwości ataku typu Reflected XSS. Problem ten dotyczy wersji UNIS przed 28376.
Windows SmartScreen Security Feature Bypass Vulnerability. Details are not provided in the description.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS