CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditDocument.php. An attacker can exploit this vulnerability to perform unauthorized actions on behalf of a victim.
Multiple stored cross-site scripting (XSS) vulnerabilities in openMAINT 2.1-3.3-b allow remote attackers to inject arbitrary web script or HTML via any "Add" sections, such as Add Card Building & Floor, or others in the Name and Code Parameters.
Information Disclosure vulnerability in Azure Virtual Machine. Could allow unauthorized access to data.
Unsigned code execution vulnerability in Azure Sphere.
A security feature bypass vulnerability in Windows Admin Center. It allows an attacker to bypass security mechanisms.
An information disclosure vulnerability in Microsoft SharePoint Server.
Security feature bypass vulnerability in Windows Extensible Firmware Interface (EFI).
Denial of Service vulnerability in User Profile Service.
Information disclosure vulnerability in Windows Media Photo Codec.
Information disclosure vulnerability in Windows ActiveX Installer Service.
Information disclosure vulnerability in Windows Event Tracing.
Spoofing vulnerability in Microsoft SharePoint Server. Allows an attacker to impersonate a trusted source.
A stored cross-site scripting (XSS) vulnerability in Maxum Rumpus 8.2.13 and 8.2.14 allows attackers to inject malicious scripts via folder names. Insufficient input validation leads to persistent script storage on the server.
Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to read or write certain local files.
A reflected cross-site scripting (XSS) vulnerability exists in qcubed (all versions including 3.1.1) in profile.php via the stQuery parameter. It allows unauthenticated attackers to steal sessions of authenticated users.
Remote code execution vulnerability in Microsoft Exchange Server. An attacker can exploit this flaw to execute arbitrary code on the server.
An issue was discovered in app/Model/SharingGroupServer.php in MISP 2.4.139, where the implementation of Sharing Groups sometimes provided view access to unintended actors via the 'all org' flag.
The mongodb-client-encryption module version 1.2.0 for Node.js does not correctly validate the KMS server's certificate. In combination with a privileged network position MITM attack, it could allow interception of traffic between the Node.js driver and the KMS service, rendering field level encryption ineffective.
The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure.
Yeastar NeoGate TG400 devices running firmware version 91.3.0.3 are affected by a directory traversal vulnerability. An authenticated user can decrypt the firmware and read sensitive information, such as passwords or decryption keys.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS