CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Affected versions: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.
A Cross-Site Scripting (XSS) vulnerability was discovered in SeedDMS 6.0.13 via the folderid parameter in views/bootstrap/class.DropFolderChooser.php. An attacker can inject malicious JavaScript code that executes in the victim's browser.
MISP version 2.4.135 has an XSS vulnerability in the authkey comment field in the genericField.ctp file.
W jądrze Linuxa przed wersją 5.6.8 odkryto problem związany z funkcją do_madvise w pliku mm/madvise.c. Występuje warunek wyścigu pomiędzy operacjami coredump a implementacją IORING_OP_MADVISE.
In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker can inject malicious JavaScript code, leading to stored/blind XSS in the admin panel.
In Crafter CMS Crafter Studio 3.0.1 an IDOR vulnerability exists which allows unauthenticated attackers to view and modify administrative data.
An SSRF vulnerability in PDF generation in MicroStrategy 10.4, 2019 before Update 6, and 2020 before Update 2 allows authenticated users to access internal network resources or leak files from the local system via HTML containers embedded in a dossier/dashboard document. Version 10.4 will not receive a fix as it reaches end-of-life on 31/12/2020.
W Modicon M221 (wszystkie wersje) występuje podatność CWE-200, która umożliwia ujawnienie niepoufnych informacji. Atakujący może wykorzystać tę lukę, przechwytując ruch między oprogramowaniem EcoStruxure Machine - Basic a kontrolerem Modicon M221.
W Modicon M221 (wszystkie wersje) występuje podatność CWE-311: Brak szyfrowania wrażliwych danych, która może umożliwić atakującemu odnalezienie hasha hasła. Podatność ta występuje, gdy atakujący przechwyci ruch między oprogramowaniem EcoStruxure Machine - Basic a kontrolerem Modicon M221 i złamie klucze szyfrujące.
W jądrze Linuxa do wersji 5.9.9 odkryto problem w pliku spk_ttyio.c, który może prowadzić do lokalnego ataku typu denial of service przez lokalnych napastników korzystających z sterownika speakup. Problem ten występuje z powodu nieprawidłowego zwolnienia pamięci, gdy dyscyplina linii jest używana więcej niż raz.
In MISP version 2.4.134, there is an XSS vulnerability in the template element index view due to mishandling of the id parameter.
Firma Western Digital zidentyfikowała podatność bezpieczeństwa w protokole Replay Protected Memory Block (RPMB), który jest określony w wielu standardach interfejsów urządzeń pamięci masowej, w tym we wszystkich wersjach eMMC, UFS i NVMe. Istnieje kilka scenariuszy, w których stan RPMB może być zmieniony przez atakującego bez wiedzy zaufanego komponentu korzystającego z funkcji RPMB.
A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading a user to copy and paste crafted HTML code into one of the editor inputs.
A vulnerability in Microweber v1.1.18 causes the user session not to expire after logout. This allows an attacker to reuse a valid session for unauthorized access.
A cross-site scripting (XSS) vulnerability in QNAP QTS systems could allow remote attackers to inject malicious code. Fixed in specific QTS versions.
Vulnerability in Firefox related to the EC scalar point multiplication algorithm (wNAF) that leaks partial information about the nonce used during signature generation. Based on electromagnetic traces, the private key could be computed.
Multiple stored XSS vulnerabilities exist in the YOURLS Admin Panel, versions 1.5-1.7.10. An authenticated user can inject malicious code by modifying a PHP plugin and uploading it.
A vulnerability in the TLS handler of Cisco ASA and FTD Software for Firepower 1000 Series firewalls could allow an unauthenticated, remote attacker to gain access to sensitive information. The issue is due to improper implementation of countermeasures against the Bleichenbacher attack for RSA-based cipher suites. An attacker could send crafted TLS messages, enabling a chosen-ciphertext attack and potential decryption of previously captured TLS sessions.
Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. The vulnerabilities are due to insufficient validation of user-supplied input. An attacker could exploit these by persuading a user to click a crafted link.
Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. The vulnerabilities are due to insufficient validation of user-supplied input. An attacker could exploit these by persuading a user to click a crafted link.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS