CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A cross-site scripting (XSS) vulnerability was found in LimeSurvey 3.6.2+180406 in the theme.php controller. Attackers can inject arbitrary web script or HTML via the changes_cp parameter in requests to the index.php/admin/themes/sa/templatesavechanges URI.
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API.
A Cross Site Scripting (XSS) vulnerability exists in the redirect module of Racktables version 0.21.2. An attacker can inject arbitrary web script or HTML via the op parameter.
An issue was discovered in Mahavitaran android application 7.50 and below, allowing local attackers to read cleartext username and password while the user is logged into the application.
Chamilo LMS version 1.11.14 is affected by a Cross Site Scripting (XSS) vulnerability in /plugin/jcapture/applet.php. An attacker can exploit this by passing a hex2bin encoded message in the cookie.
Remote code execution vulnerability in Microsoft Edge (Chromium-based).
Elevation of Privilege Vulnerability in Windows 10 Update Assistant. An attacker could gain elevated privileges.
Elevation of Privilege vulnerability in Windows 10 Update Assistant. An attacker could exploit it to gain elevated privileges on the system.
Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page.
The Video Lessons Manager WordPress plugin before 1.7.2 and Video Lessons Manager Pro WordPress plugin before 3.5.9 do not properly sanitize and escape values when updating their settings, which could allow high privilege users to perform Cross-Site Scripting attacks.
A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could use this issue to install a different revision on a repository, threatening data integrity. The issue is fixed in version 21.1.
An IDOR vulnerability in ICREM H8 SSRMS allows unauthorized access to sensitive information via the Print Invoice Functionality. Attackers can exploit this flaw to read data without proper permissions.
An elevation of privilege vulnerability in Visual Studio. Technical details are not provided in the description.
Spoofing vulnerability in Microsoft Exchange Server. An attacker can impersonate another entity, potentially leading to fraud or unauthorized actions.
Elevation of privilege vulnerability in Azure RTOS. Allows an attacker to gain higher privileges in the system.
Elevation of Privilege Vulnerability in Azure RTOS. An attacker could gain elevated privileges.
Elevation of privilege vulnerability in Azure RTOS. Similar to other flaws in this component, it may allow privilege escalation.
Tampering vulnerability in Azure Sphere. An attacker could modify data or software on Azure Sphere devices.
Security feature bypass vulnerability in Windows Hello. An attacker could bypass authentication mechanisms.
A Denial of Service vulnerability in Windows Hyper-V. An attacker could exploit this to cause crashes or unavailability of virtualization services.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS