CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
All versions of the crow package are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values. The set_header and add_header functions do not properly sanitize header values against CRLF injection, allowing an attacker to add \r\n characters and inject malicious content.
A SQL injection vulnerability in the Search functionality of tickets.php page in osTicket 1.15.x allows authenticated attackers to execute arbitrary SQL commands via the combination of 'keywords' and 'topic_id' URL parameters.
A vulnerability in the Embedded Service Router (ESR) of Cisco ISE could allow an authenticated, local attacker to read, write, or delete arbitrary files on the underlying operating system and escalate privileges to root. It is due to improper privilege management in the ESR console, and an attacker could send a crafted request to an affected device.
A stored XSS vulnerability was discovered in REDCap 13.1.35 in the new project creation function. Attackers can inject malicious JavaScript or HTML into the project title parameter, leading to script execution in other users' browsers.
A vulnerability in the remote access VPN feature of Cisco ASA and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a brute force attack to identify valid credentials or an authenticated, remote attacker to establish a clientless SSL VPN session with an unauthorized user. The issue is due to improper separation of authentication, authorization, and accounting (AAA) between the remote access VPN feature and the HTTPS management and site-to-site VPN features.
In vowifiservice, there is a possible missing permission check, which could lead to local information disclosure with no additional execution privileges.
In vowifiservice, there is a possible missing permission check, which could lead to local information disclosure with no additional execution privileges.
In vowifiservice, there is a possible missing permission check, which could lead to local information disclosure with no additional execution privileges.
In vowifiservice, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges.
A critical vulnerability was found in SourceCodester Inventory Management System version 1.0. Manipulation of the 'page' argument in the index.php file leads to file inclusion, allowing for remote attacks.
A critical vulnerability was found in DedeCMS version 5.7.110, affecting unknown code in the file /uploads/tags.php. Manipulation of the argument tag_alias leads to SQL injection.
A critical vulnerability was found in the Byzoro Smart S45F Multi-Service Secure Gateway management platform up to version 20230822. The issue affects an unknown functionality of the file /importexport.php, leading to SQL injection.
A critical vulnerability was found in IBOS OA version 4.5.5, affecting unknown processing of the file ?r=dashboard/user/export&uid=X. Manipulation of this file leads to SQL injection.
A critical vulnerability has been found in IBOS OA version 4.5.5, affecting unknown code in the file ?r=diary/default/del of the Delete Logs Handler component. Manipulation of this vulnerability leads to SQL injection.
A critical vulnerability was found in IBOS OA 4.5.5, affecting an unknown part of the file ?r=email/api/delDraft&archiveId=0 of the Delete Draft Handler component. The manipulation leads to SQL injection.
A critical vulnerability has been found in the Byzoro Smart S85F Management Platform up to version 20230820. The issue affects an unknown functionality of the file /sysmanage/updateos.php, allowing unrestricted file uploads through manipulation of the argument 1_file_upload.
Incorrect certificate validation in InvokeHTTP on Apache NiFi MiNiFi C++ versions 0.13 to 0.14 allows an intermediary to present a forged certificate during TLS handshake negotiation. The Disable Peer Verification property was effectively flipped, disabling verification by default when using HTTPS.
ProVide version 14.5 by Farsight Tech Nordic AB contains multiple XSS vulnerabilities (CWE-79) that can be exploited by a user with administrator privileges.
The Exifography plugin versions up to 1.3.1 have a stored Cross-Site Scripting (XSS) vulnerability with admin authorization. An attacker can exploit this flaw to inject malicious scripts that will be executed in the victim's browser context.
The Visualmodo Borderless plugin versions up to 1.4.8 contain a stored Cross-Site Scripting (XSS) vulnerability with admin authorization. An attacker can exploit this flaw to inject malicious scripts that will execute in the context of users with admin privileges.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS