CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
rConfig 3.9.6 is affected by a Local File Disclosure vulnerability. An authenticated user may successfully download any file on the server.
Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
An XSS vulnerability in Afian FileRun 2021.03.26 allows an attacker to inject malicious scripts when an administrator uses the HTML Editor to preview or edit a crafted document.
An SSRF vulnerability in NagiosXI up to version 5.8.4 allows authenticated users to create scheduled reports with PDF screenshots of any view. Lack of input sanitization enables replacing the target page with an SSRF payload.
Afian FileRun 2021.03.26 is vulnerable to stored XSS via an HTTP X-Forwarded-For header that is mishandled when rendering Activity Logs. An attacker can inject malicious JavaScript code.
JIZHICMS 1.5.1 contains a cross-site scripting (XSS) vulnerability in the /user/release.html component, allowing attackers to arbitrarily add an administrator cookie.
In Progress WhatsUp Gold before version 21.1.0, an application endpoint failed to adequately sanitize malicious input, which could allow an unauthenticated attacker to execute arbitrary code in a victim's browser.
Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentially leads to DoS.
Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed.
W Kubernetes odkryto problem bezpieczeństwa, który pozwala aktorom kontrolującym odpowiedzi na żądania MutatingWebhookConfiguration lub ValidatingWebhookConfiguration na przekierowanie żądań kube-apiserver do prywatnych sieci apiservera. Użytkownik, który ma dostęp do logów kube-apiserver przy poziomie logowania ustawionym na 10, może zobaczyć przekierowane odpowiedzi i nagłówki w logach.
Information disclosure vulnerability in Microsoft Accessibility Insights for Android. Could allow an attacker to access sensitive data.
Cross-site scripting (XSS) vulnerability in Microsoft Dynamics Business Central. Allows injection of malicious script into the application.
Tampering vulnerability in Microsoft Edge (Chromium-based). Could allow modification of browser data or behavior.
Information Disclosure vulnerability in Microsoft Office Graphics Component. Could allow an attacker to read data from memory.
Information Disclosure vulnerability in Windows Storage. Could allow an attacker to read data from memory.
Information disclosure vulnerability in the Windows Redirected Drive Buffering SubSystem driver. It may allow an attacker to read data they should not have access to.
Information disclosure vulnerability in the Windows Redirected Drive Buffering SubSystem driver. It may allow an attacker to read data they should not have access to.
A vulnerability in Windows BitLocker allows a security feature bypass. An attacker could exploit this flaw to bypass protection mechanisms.
Information disclosure vulnerability in Windows Ancillary Function Driver for WinSock. Could allow access to sensitive data.
A security feature bypass vulnerability in Windows Key Storage Provider allows an attacker to bypass key protection mechanisms. This could lead to unauthorized access to cryptographic keys and protected data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS