CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In MISP version 2.4.169, the file app/Lib/Tools/CustomPaginationTool.php allows XSS in the community index.
A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux kernel due to a race condition. This flaw leads to a denial of service issue.
A vulnerability in the IPv6 DHCP (DHCPv6) client module of Cisco Adaptive Security Appliance (ASA) Software, Cisco Firepower Threat Defense (FTD) Software, Cisco IOS Software, and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This is due to insufficient validation of DHCPv6 messages. An attacker could exploit this by sending crafted DHCPv6 messages, causing the device to reload. To exploit, the attacker needs to control the DHCPv6 server or be in a man-in-the-middle position.
W systemie raportowania internetowego As Koc Energy występuje podatność na atak typu Cross-site Scripting (XSS) z powodu niewłaściwego neutralizowania danych wejściowych podczas generowania stron internetowych. Problem ten dotyczy wersji systemu przed 23.03.10.
A heap buffer overflow vulnerability was discovered in swfdump version 0.9.2 in the function swf_GetPlaceObject at swfobject.c. This could lead to program crashes or potentially arbitrary code execution.
The InPost Gallery WordPress plugin in versions before 2.2.2 is affected by a reflected cross-site scripting vulnerability in the 'imgurl' parameter of the add_inpost_gallery_slide_item action. It can only be triggered by an authenticated user.
The Woo Bulk Price Update WordPress plugin in versions < 2.2.2 is affected by a reflected cross-site scripting vulnerability in the 'page' parameter of the techno_get_products action, which can only be triggered by an authenticated user.
Podatność CVE-2023-1154 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w aplikacji Pacsrapor, co prowadzi do możliwości ataku typu Reflected XSS. Problem ten występuje w wersjach przed 1.22.
Podatność CVE-2023-0320 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w systemie UBYS Uniwersytetu Izmira Katip Celebi. Umożliwia to atak typu Stored XSS w wersjach przed 23.03.16.
The js/event-graph.js file in MISP before version 2.4.169 is vulnerable to XSS via the event-graph relationship tooltip.
The js/event-graph.js file in MISP before version 2.4.169 is vulnerable to XSS via event-graph node tooltips.
Sudo before 1.9.13 does not escape control characters in sudoreplay output. This could allow injection of control characters into terminal or output files.
Sudo before 1.9.13 does not escape control characters in log messages. This could allow injection of control characters into log files.
Podatność CVE-2023-0322 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w oprogramowaniu Talent Software UNIS, co prowadzi do możliwości ataku typu Reflected XSS. Problem ten dotyczy wersji UNIS przed 28376.
Windows SmartScreen Security Feature Bypass Vulnerability. Details are not provided in the description.
In RUGGEDCOM CROSSBOW (All versions < V5.2), the client query handler fails to check for proper permissions when assigning groups to user accounts. This could allow an authenticated remote attacker to assign administrative groups to otherwise non-privileged user accounts.
A vulnerability has been identified in RUGGEDCOM CROSSBOW (all versions < V5.2). The client query handler fails to check for proper permissions for specific write queries. This could allow an authenticated remote attacker to perform unauthorized actions.
SAP NetWeaver Application Server for ABAP and ABAP Platform versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791 have multiple vulnerabilities in a class for test purposes. An attacker authenticated as a non-administrative user can craft a request with certain parameters that consumes server resources sufficiently to make it unavailable; there is no ability to view or modify any information.
The Ocean Extra WordPress plugin before 2.1.3 does not ensure that the template loaded via a shortcode is actually a template, allowing any authenticated users such as subscribers to retrieve the content of arbitrary posts, including draft, private, or password-protected ones. The flaw involves insufficient template validation.
An information disclosure vulnerability exists in AvantFAX 3.3.7. Backups of sent/received faxes and database backups are stored with the current date as the filename and hosted on the web server without access controls.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS