CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.01)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Versions of Zoho ManageEngine Active Directory 360 and other products are vulnerable to 2FA bypass using certain TOTP authenticators. A valid pair of username and password is required to leverage this vulnerability.
A vulnerability in the CPIO command of Busybox v1.33.2 allows attackers to perform a directory traversal. The issue stems from improper handling of file paths when extracting CPIO archives.
Multiple cross-site scripting (XSS) vulnerabilities in the inventory management system version 1.0 allow attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the Name, Address, and Company parameters under the Add Member section.
GPAC v2.3-DEV-rev449-g5948e4f70-master was found to contain a heap-use-after-free vulnerability in the gf_bs_align function at bitstream.c. This vulnerability allows attackers to cause a Denial of Service (DoS) by supplying a crafted file.
CVE-2023-40590 affects the GitPython library, which can execute a malicious `git` program from a local repository if the user runs GitPython from that directory. This issue primarily occurs on Windows systems where Python improperly resolves paths to executables.
Cross Site Scripting vulnerability in Spipu HTML2PDF before v.5.2.8 allows a remote attacker to execute arbitrary code via a crafted script to the forms.php.
A SQL injection vulnerability was discovered in ECTouch v2 via the $arr['id'] parameter in the insert.php file. An attacker can exploit this flaw to execute unauthorized database queries.
Tenda AC6 version US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to buffer overflow in function sub_90998.
A stored cross-site scripting (XSS) vulnerability in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Add New parameter under the New Buy section.
User enumeration is found in PHPJabbers Make an Offer Widget v1.0 during password recovery. Differences in messages could allow an attacker to determine if the user is valid, enabling a brute force attack on valid users.
User enumeration is found in PHPJabbers Ticket Support Script v3.2. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
User enumeration is found in PHPJabbers Event Booking Calendar v4.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
User enumeration is found in PHP Jabbers Car Rental Script v3.0 during the password recovery process. Differences in messages could allow an attacker to determine if a user is valid, facilitating a brute force attack on user accounts.
User enumeration is found in PHPJabbers Taxi Booking Script v2.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
User enumeration is found in PHPJabbers Fundraising Script v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
User enumeration is found in PHPJabbers Yacht Listing Script v2.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
User enumeration is found in PHP Jabbers Hotel Booking System v4.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
User enumeration is found in PHP Jabbers Restaurant Booking Script v3.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
User enumeration is found in PHPJabbers Document Creator v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
User enumeration is found in PHPJabbers Food Delivery Script v3.1. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS