CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A stored cross-site scripting (XSS) vulnerability in the Basic Information module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
A stored cross-site scripting (XSS) vulnerability in the Column management module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
A stored cross-site scripting (XSS) vulnerability in the custom variables module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
YznCMS v1.1.0 has a Cross-Site Request Forgery (CSRF) vulnerability in the /public/admin/profile/update.html component, allowing attackers to arbitrarily change the Administrator password via a crafted POST request.
A stored cross-site scripting (XSS) vulnerability in the Management Custom label module of SEACMS v12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
A stored cross-site scripting (XSS) vulnerability in the Site Setup module of SEACMS v12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Bagecms v3.1.0 has a stored XSS vulnerability that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Settings module.
A XSS vulnerability in CMS Made Simple v2.2.17 allows remote attackers to inject arbitrary web scripts or HTML via the File Upload function.
CMS Made Simple v2.2.17 is vulnerable to Remote Command Execution via the File Upload Function.
Novu has an open redirect vulnerability in the 'Sign In with GitHub' functionality in versions prior to 0.16.0. An attacker could force a victim to open a malicious URL, potentially logging into the repository under the victim's account.
TravianZ through version 8.3.4 allows XSS via the Alliance tag/name, the statistics page, the link preferences, the Admin Logs, or the COOKUSR cookie.
A SQL Injection vulnerability detected in Food Ordering System v1.0 allows attackers to run commands on the database by sending crafted SQL queries to the ID parameter.
SQL injection vulnerability in langchain before v0.0.247 allows a remote attacker to obtain sensitive information via the SQLDatabaseChain component.
An issue in langchain v.0.0.64 allows a remote attacker to execute arbitrary code via the PALChain parameter in the Python exec method.
Metersphere is an open source continuous testing platform. In versions prior to 2.10.2 LTS, some key APIs in Metersphere lack permission checks, allowing ordinary users to execute operations reserved for space or project administrators.
Vulnerability in the hang detector module related to kernel raw address leakage. Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2023-37245 describes a buffer overflow vulnerability in the modem pinctrl module. Successful exploitation of this vulnerability may affect the integrity and availability of the modem.
Vulnerability in the atcmdserver module allows interception of commands from the modem. Attackers may exploit this vulnerability to rewrite NVRAM or facilitate the exploitation of other vulnerabilities.
There is an input verification vulnerability in the WMS API. Successful exploitation of this vulnerability may cause the device to restart.
Vulnerability related to missing input length verification in the distributed file system. Successful exploitation of this vulnerability may lead to out-of-bounds read.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS