CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to Cross Site Scripting (XSS), allowing injection of malicious scripts.
PEEL Shopping CMS 9.4.0 is vulnerable to authenticated SQL injection in utilisateurs.php. An authenticated administrator can inject a malicious SQL query, affecting application logic and retrieving database information.
In Connx version 6.2.0.1269 (20210623), the application may issue a cookie without the Secure flag set. This means the cookie can be transmitted over unencrypted HTTP connections.
In Connx version 6.2.0.1269 (20210623), a cookie can be issued by the application without the HttpOnly flag set. The absence of this flag allows potential client-side script access to the cookie.
A cross-site scripting (XSS) vulnerability exists in Mini CMS V1.11. The vulnerability is located on the post-edit.php page during article upload.
ACEweb Online Portal 3.5.065 was found to have a cross-site scripting (XSS) vulnerability via the txtNmName1 parameter in person.awp. An attacker can inject malicious JavaScript code that executes in the victim's browser.
An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in macOS Monterey 12.3.1, Security Update 2022-004 Catalina, macOS Big Sur 11.6.6. A local user may be able to read kernel memory.
A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is running within the NOSi container. This vulnerability exists because the health check RPM opens TCP port 6379 by default upon activation. An attacker could exploit this vulnerability by connecting to the Redis instance on the open port. A successful exploit could allow the attacker to write to the Redis in-memory database, write arbitrary files to the container filesystem, and retrieve information about the Redis database. Given the configuration of the sandboxed container that the Redis instance runs in, a remote attacker would be unable to execute remote code or abuse the integrity of the Cisco IOS XR Software host system.
The default configuration of the TreeGrid component uses Object::toString as a key in client-side and server communication in Vaadin, potentially disclosing values that should not be available on the client side. Affected versions include Vaadin 14.8.5-14.8.9, 22.0.6-22.0.14, 23.0.0.beta2-23.0.8, and 23.1.0.alpha1-23.1.0.alpha4.
Multiple cross-site scripting (XSS) vulnerabilities were found in the /obcs/user/profile.php component of Online Birth Certificate System v1.2. Attackers can inject malicious JavaScript or HTML via the fname or lname parameters, leading to arbitrary script execution in the victim's browser.
Diary Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name parameter in search-result.php. This allows an attacker to inject malicious scripts into the page.
A vulnerability in the Z-Wave S0 NonceGet protocol specification in Silicon Labs Z-Wave 500 series allows a local attacker to block S0/S2 protected Z-Wave networks by sending crafted S0 NonceGet packets that exploit included but absent NodeIDs.
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier. A remote unauthenticated attacker can execute arbitrary code via the fileToUpload parameter in the uploadFile task.
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK version 10.11 and earlier. A remote unauthenticated attacker can execute arbitrary code via the searchString parameter in the wikiScrapper task.
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier allows remote unauthenticated attackers to execute arbitrary code via the 'key' parameter in the getESRIExtraConfig task.
Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier allows remote unauthenticated attackers to execute arbitrary JavaScript code via the 'key' parameter in the getGoogleExtraConfig task.
Home Owners Collection Management v1 was found to have a reflected XSS vulnerability in the Admin panel via the $_GET['page'] parameter. An attacker can inject malicious script.
Home Owners Collection Management v1 was found to have a reflected XSS vulnerability in the Admin panel via the $_GET['s'] parameter. An attacker can inject malicious script.
A stored XSS vulnerability was found in the Add New Employee form of Sourcecodester Employee Daily Task Management System 1.0. A remote attacker can inject and store arbitrary JavaScript code via the Name field, which executes when the data is viewed.
A directory traversal vulnerability in Bookeen Notea Firmware BK_R_1.0.5_20210608 allows an attacker to obtain sensitive information by manipulating file paths.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS