CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content. NOTE: this issue exists because of an incomplete fix for CVE-2022-28367.
A vulnerability in the Datagram TLS (DTLS) protocol implementation in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause high CPU utilization, resulting in a denial of service (DoS) condition. This is due to suboptimal processing when establishing a DTLS tunnel as part of an AnyConnect SSL VPN connection. An attacker could exploit this by sending a steady stream of crafted DTLS traffic, exhausting resources on the device.
A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.
An issue was discovered in MISP before version 2.4.158 related to XSS in app/Controller/OrganisationsController.php occurring in a situation with a 'weird single checkbox page.'
An issue was discovered in MISP before version 2.4.158 related to XSS in the cerebrate view. If one administrator inputs a javascript: URL in the URL field and another administrator clicks on it, it may lead to unauthorized script execution.
An issue was discovered in MISP before version 2.4.158 related to stored XSS in the event graph via a tag name.
An issue was discovered in MISP before version 2.4.158 related to stored XSS in galaxy clusters.
An issue was discovered in MISP before version 2.4.158 related to stored XSS in the LinOTP login field.
Vulnerability in Oracle Agile PLM (component: Attachments) version 9.3.6. A low-privileged attacker with network access via HTTP can compromise the system, leading to unauthorized access to critical data or all accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impact).
Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13 and 7.3 fix pack 2 do not properly check user permission when accessing a list of sites/groups. This allows remote authenticated users to view sites/groups via the user's site membership assignment UI.
Cross-site scripting (XSS) vulnerability in the Asset module's asset categories selector in Liferay Portal 7.3.3 through 7.4.0, and Liferay DXP 7.3 before Service Pack 3. Remote attackers can inject arbitrary web script or HTML via the name of an asset category.
Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to abuse this functionality with minimal effort. Additionally, a remote and partially authenticated attacker may be able to inject arbitrary commands into the custom script due to an unsanitized password field.
Multiple XSS vulnerabilities were found in Liferay Portal 7.3.5 through 7.4.0 and Liferay DXP 7.3 before service pack 3. An attacker can inject arbitrary script or HTML via form field help text in the Forms module or App Builder module.
In Spring Framework versions 5.3.0-5.3.18, 5.2.0-5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.
An issue in EasyIO CPT Graphics v0.8 allows attackers to discover valid users in the application. This vulnerability enables unauthorized user enumeration.
A Directory Traversal vulnerability in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0. An attacker can exploit the 'page' parameter in index.php to read arbitrary files on the server.
A Cross Site Scripting (XSS) vulnerability exists in the Exrick XMall Admin Panel in product-add.jsp. An attacker can inject a malicious script via the GET parameter, leading to JavaScript execution in the victim's browser.
The Dr Trust USA iCheck Connect BP Monitor BP Testing 118 version 1.2.1 is vulnerable to transmitting write requests and characters, which may allow an attacker to manipulate device data or functions.
In Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.
A Cross Site Scripting (XSS) vulnerability was found in Chikista Patient Management Software 2.0.2 in the first_name parameter. It affects the following pages: patient/insert, patient_report, appointment_report, visit_report, and bill_detail_report.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS