CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple SQL Injection vulnerabilities in Kiteworks Secure Data Forms. An authenticated attacker with the FormBuilder role can read and modify other users' form definitions and global configuration parameters.
Reflected XSS vulnerability in Kiteworks Secure Data Forms prior to version 9.3.0. An external attacker can trick a user into executing arbitrary JavaScript code via a crafted link.
Memory corruption occurs when processing fastboot commands to set display mode.
Memory corruption while processing fastboot commands with improperly formatted input.
Cryptographic issue while processing partition table entries allows unauthorized modification of boot flow.
Memory corruption while processing fastboot commands with invalid input.
A cryptographic issue while processing a specific partition allows unauthorized write access to load a customized bootloader.
Memory corruption while processing fastboot OEM commands.
Memory corruption when processing display command line information due to improper initialization of a variable.
Memory corruption occurs when writing to invalid memory locations due to heap memory exhaustion during secure data initialization.
Memory corruption occurs when processing device identifier strings that exceed the expected maximum length.
Memory corruption occurs during a memory copy operation due to invalid writes caused by a null pointer.
A privilege escalation vulnerability in Dräger Infinity Explorer C700 allows attackers to break out of kiosk mode and access the underlying OS through a specific dialog interaction.
Pixa Bank 2.0 contains an SQL injection vulnerability in the 'rib' parameter, allowing unauthenticated attackers to extract sensitive data by sending crafted POST requests to the agence-ajax.php endpoint with UNION-based SQL payloads.
An authentication bypass vulnerability in cf-auth-proxy in Cloud Foundry Foundation allows an unauthenticated remote attacker to read all logs and metrics for every application and platform component by minting a JWT accepted as a valid logs.admin token.
In multiple functions of NotificationChannel.java, there is a possible desync in persistence due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
In the addWindow method of WindowManagerService.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed.
A stack-based buffer overflow vulnerability has been found in UTT HiPER 1200GW up to version 2.5.3-170306 in the strcpy function of the /goform/formFireWall file. Manipulation of the Profile argument leads to buffer overflow. The attack can be launched remotely and the exploit is public.
A stack-based buffer overflow vulnerability was detected in UTT HiPER 1200GW up to version 2.5.3-170306 in the strcpy function of the /goform/formTaskEdit file. The attack can be performed remotely. The exploit is publicly available.
In code-projects Hotel and Tourism Reservation System 1.0, SQL injection vulnerability exists in tour.php. A remote attacker can manipulate the GET parameter 'tour', leading to SQL injection. The exploit is publicly available.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS