CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Cross-Site Scripting (XSS) vulnerability in Gazie 7.29 allows an attacker to inject JavaScript code via the 'user_name' parameter in admin_utente.php. The injected code is stored persistently by the application.
A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user.
Zidentyfikowano podatność w rodzinie CPU SIMATIC S7-300, S7-400, WinAC RTX (F) 2010 oraz SINUMERIK 840D sl. Protokół uwierzytelniania między klientem a PLC przez port 102/tcp (ISO-TSAP) niewystarczająco chroni przesyłane hasło.
A Cross-site scripting (XSS) vulnerability in 'user-profile.php' in SourceCodester Daily Tracker System v1.0 allows remote attackers to inject arbitrary web script or HTML via the 'fullname' parameter.
A vulnerability in directory permissions of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to perform a directory traversal attack on a limited set of restricted directories. The issue is due to a flaw in the logic governing directory permissions. Successful exploitation could allow overwriting files on the device.
Stored XSS vulnerability in Spiceworks version 7.5.00107 and earlier. An attacker can inject malicious JavaScript via the name field in the Custom Groups function, which is displayed without sanitization on the /inventory/groups/ page.
An XSS vulnerability in osTicket before version 1.14.3 allows an attacker to inject malicious script via a crafted filename uploaded to the _uploadInlineImage() function in include/ajax.draft.php.
An XSS vulnerability in osTicket before version 1.14.3 exists due to missing input validation in include/staff/banrule.inc.php, where the echo statement outputs $info['notes'] without sanitization. An attacker can inject malicious JavaScript code that executes in other users' browsers.
Występuje podatność na zdalne wykonanie kodu w bibliotece kodeków Microsoft Windows, związana z obsługą obiektów w pamięci. Atakujący, który skutecznie wykorzysta tę podatność, może wykonać dowolny kod, pod warunkiem, że program przetworzy specjalnie przygotowany plik graficzny.
An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access.
A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server.
A rogue webpage could override the injected WKUserScript used by the download feature, this exploit could result in the user downloading an unintended file. This vulnerability affects Firefox for iOS < 28.
A rogue webpage could override the injected WKUserScript used by the logins autofill, potentially leaking a password for the current domain. Affects Firefox for iOS < 28.
Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (Issue 2 of 2). This enables injection of malicious script into the user interface.
Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (issue 1 of 2). This enables injection of malicious script into the user interface.
In Apache ActiveMQ Artemis versions 2.5.0 to 2.13.0, there is an XSS vulnerability that can be exploited through a specially crafted MQTT packet containing an XSS payload in the client-id or topic name. The XSS payload is injected into the admin console's browser.
Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in limited information disclosure to low privileged users.
Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in limited information disclosure to low privileged users.
Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows unauthenticated access to certain URL endpoints.
IndexedDB should be cleared when leaving private browsing mode and it is not, the API for WKWebViewConfiguration was being used incorrectly and requires the private instance of this object be deleted when leaving private mode. This vulnerability affects Firefox for iOS < 27.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS