CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A stored Cross-Site Scripting (XSS) vulnerability in AvantFAX 3.3.7 allows an authenticated low-privilege user to inject arbitrary JavaScript into their email address, which executes when an administrator views the admin dashboard.
An arbitrary file upload vulnerability in Halo up to v1.6.1 allows attackers to execute arbitrary code via a crafted .md file.
A cross-site scripting (XSS) vulnerability in the check_login function of SIPE s.r.l WI400 versions 8 through 11 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the f parameter.
A cross-site scripting (XSS) vulnerability in /kruxton/navbar.php of Best POS Management System 1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the page parameter.
An arbitrary file upload vulnerability in Poly Trio 8800 version 7.2.2.1094 allows attackers to upload arbitrary files via a crafted ringtone file. This can lead to remote code execution on the device.
The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars (a scalar larger than the order of the curve). This does not impact usages of crypto/ecdsa or crypto/ecdh.
In pqframework, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 through 7.2.3, 7.0.0 through 7.0.9 and before 6.4.11 allows a privileged attacker to read and write files on the underlying Linux system via crafted CLI commands.
QlikView 12.60.2 was found to have a stored cross-site scripting (XSS) vulnerability in the QvsViewClient functionality. This allows an attacker to inject a malicious script that is stored on the server and executed in other users' browsers.
A Cross Site Scripting (XSS) vulnerability was found in VICIdial versions 2.14-610c and 2.10-415c. It allows an attacker to execute arbitrary code via parameters in /agc/vicidial.php, agc/vicidial-greay.php, and /vicidial/KHOMP_admin.php.
Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378.
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376.
Podatność CVE-2023-0578 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w systemie ASOS Information Technologies Book Cites, co umożliwia ataki typu Cross-Site Scripting (XSS). Problem ten dotyczy wersji przed 23.01.05.
W podatności CVE-2023-0577 występuje niewłaściwa neutralizacja danych wejściowych podczas generowania stron internetowych w systemie SOBIAD, co umożliwia ataki typu Cross-Site Scripting (XSS). Problem dotyczy wersji SOBIAD przed 23.02.01.
A stack overflow vulnerability was discovered in the Jensen of Scandinavia Eagle 1200AC router running firmware version V15.03.06.33_en via the wepkey1 parameter in the /goform/WifiBasicSet script.
A stack overflow vulnerability was discovered in the Jensen of Scandinavia Eagle 1200AC router running firmware version V15.03.06.33_en. The issue is triggered via the wepkey4_5g parameter in the /goform/WifiBasicSet script.
A stack overflow vulnerability was discovered in Jensen of Scandinavia Eagle 1200AC firmware version V15.03.06.33_en. The issue is triggered via the wepkey2_5g parameter in the /goform/WifiBasicSet script.
A stack overflow vulnerability was discovered in the Jensen of Scandinavia Eagle 1200AC router running firmware version V15.03.06.33_en. The issue is triggered via the wrlEn parameter in the /goform/WifiBasicSet script.
A stack overflow vulnerability was discovered in the Jensen of Scandinavia Eagle 1200AC router running firmware version V15.03.06.33_en via the wepauth parameter at /goform/WifiBasicSet.
A stack overflow vulnerability was discovered in the Jensen of Scandinavia Eagle 1200AC router running firmware version V15.03.06.33_en via the ssid_5g parameter at /goform/WifiBasicSet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS