CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
PyroCMS version 3.9 was found to contain multiple cross-site scripting (XSS) vulnerabilities.
An issue in the login and reset password functionality of Backdrop CMS v1.22.0 allows attackers to enumerate usernames via password reset requests and distinct responses returned based on usernames.
Niewystarczające egzekwowanie polityki w DevTools w Google Chrome na systemie Windows przed wersją 103.0.5060.53 umożliwia atakującemu, który przekonał użytkownika do zainstalowania złośliwego rozszerzenia, uzyskanie potencjalnie wrażliwych informacji z lokalnych plików użytkownika za pomocą spreparowanej strony HTML.
A cross-site scripting (XSS) vulnerability was found in Online Fire Reporting System v1.0 in /index.php/?p=report. Attackers can inject malicious JavaScript or HTML via the "Contac #" text field.
Cross Site Scripting (XSS) vulnerability in Gollum versions 5.0 through 5.1.2. The attack is possible via the filename parameter in the 'New Page' dialog.
A stored XSS vulnerability was found in osTicket-plugins Storage-FS before commit a7842d494889fd5533d13deb3c6a7789768795ae in the audit/class.audit.php component. Attackers can execute arbitrary web scripts or HTML via a crafted SVG file.
A cross-site scripting (XSS) vulnerability was discovered in the Mediacenter by EGT-Kommunikationstechnik UG before version 2.0, specifically in the Online_Update.php component. It allows injection of malicious scripts into the page.
Magnolia CMS v6.2.19 contains a cross-site scripting (XSS) vulnerability in the Edit Contact function. An attacker can inject arbitrary JavaScript or HTML by uploading a crafted SVG document as a profile picture.
A vulnerability in iTop VPN 3.2 allows an attacker to steal another user's token by creating a named pipe with the same name used by the iTopVPNmini.exe component. The attacker listens for connections and abuses the ImpersonateNamedPipeClient() function.
IObit products (Advanced System Care 15, iTop Screen Recorder 2.1, iTop VPN 3.2, Driver Booster 9, iTop Screenshot) use unencrypted HTTP connections to download configuration files during updates. An attacker can intercept this traffic and supply a malicious config file pointing to fake update locations, leading to remote code execution with administrative privileges.
A stored cross-site scripting (XSS) vulnerability in the Add Classification function of Zoo Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via unspecified vectors.
A vulnerability classified as problematic was found in TrueConf Server 4.3.7. It affects unknown code of the file /admin/service/stop/. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
SourceCodester Zoo Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the msg parameter in the register_visitor script. An attacker can inject malicious JavaScript code that will be executed in the victim's browser.
A stored cross-site scripting (XSS) vulnerability in LightCMS v1.3.11 allows attackers to execute arbitrary web scripts or HTML via uploading a crafted PDF file.
A Cross Site Scripting (XSS) vulnerability has been discovered in Ruckus Wireless ZoneDirector version 9.8.3.0. It allows a remote attacker to inject malicious scripts into the management interface.
Persistent XSS in Galaxkey Secure Mail Client up to version 5.6.11.5 allows an attacker to intercept an HTTP POST request when sending an email and inject a crafted XSS payload in the 'subject' field, which executes when the recipient logs into their mailbox.
Missing access control in the backup system of Telesoft VitalPBX before version 3.2.1 allows attackers to access PJSIP and SIP extension credentials, cryptographic keys, and voicemail files via unspecified vectors.
Unioncms version 1.0.13 contains a stored XSS vulnerability in the Default settings. An attacker can inject a malicious script that will be executed in the administrator's browser.
ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to Cross Site Scripting (XSS), allowing injection of malicious scripts.
PEEL Shopping CMS 9.4.0 is vulnerable to authenticated SQL injection in utilisateurs.php. An authenticated administrator can inject a malicious SQL query, affecting application logic and retrieving database information.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS