CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In MISP before version 2.4.146, there is a stored XSS vulnerability in the sharing groups view located in app/View/SharingGroups/view.ctp.
An XSS vulnerability in Chevereto before version 3.17.1 allows an attacker to inject malicious script via the image title during file upload.
A stored cross-site scripting (XSS) vulnerability was discovered in the TrippLite SU2200RTXL2Ua firmware version 12.04.0055 in the /Forms/device_vars_1 script. It allows authenticated attackers to inject malicious scripts via a crafted POST request, leading to theft of other users' data.
The vgacon subsystem in the Linux kernel before 5.8.10 mishandles software scrollback. There is a vgacon_scrolldelta out-of-bounds read.
In kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can be mispredicted (e.g., because of type confusion), allowing an unprivileged BPF program to read arbitrary memory locations via a side-channel attack, aka CID-9183671af6db.
A Cross-Site Scripting (XSS) vulnerability was found in Typesetter 5.1 via the className and Description fields in index.php/Admin/Classes. An attacker can inject malicious JavaScript code that executes in the victim's browser.
A Cross Site Scripting (XSS) vulnerability was found in MetInfo 7.0.0 via the gourl parameter in login.php. It allows injection of malicious JavaScript code into the login page.
D-Link DIR-2640-US router version 1.01B04 stores the system account password in plain text. It does not use Linux user management, and all devices share the same unchangeable password. An attacker can easily log in via the serial port and gain root privileges.
In InsydeH2O 5.x, certain SMM drivers did not correctly validate CommBuffer and CommBufferSize parameters, allowing callers to corrupt firmware or OS memory. Affected drivers include AhciBusDxe, IdeBusDxe, NvmExpressDxe, SdHostDriverDxe, and SdMmcDeviceDxe.
A vulnerability in SafeNet KeySecure Management Console 8.12.0 allows HTTP response splitting attacks. A remote attacker can exploit a specially crafted URL to cause the server to return a split response when the URL is clicked.
net/can/bcm.c in the Linux kernel through 5.12.10 allows local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. The flaw involves uninitialized memory exposed to local users.
curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.
A CWE-552 vulnerability in Easergy T300 firmware versions V2.7.1 and older allows unauthorized attackers to access system files and directories. Lack of proper access restrictions can lead to exposure of sensitive data.
W urządzeniach PowerLogic PM55xx, PM8ECC, EGX100 i EGX300 występuje podatność CWE-287: Niewłaściwa autoryzacja, która może prowadzić do utraty łączności z urządzeniem za pośrednictwem protokołu Modbus TCP, gdy atakujący wyśle specjalnie przygotowane żądanie HTTP.
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled.
A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check given a radio privilege is compromised.
A use after free vulnerability via race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows arbitrary write given a radio privilege is compromised.
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.
Cross-site scripting (XSS) vulnerability in the Portal Workflow module's edit process page in Liferay DXP. Allows remote attackers to inject arbitrary web script or HTML via the currentURL parameter.
Improper initialization in the firmware for some Intel processors may allow a privileged user to potentially enable a denial of service via local access.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS