CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI). An attacker can exploit this vulnerability to inject malicious code into server templates.
A critical vulnerability was found in the Ruijie RG-BCR860 device version 2.5.13, affecting unknown processing of the Network Diagnostic Page component. Manipulation leads to OS command injection.
A critical vulnerability has been found in IBOS OA 4.5.5 affecting the actionExport function of the file ?r=recruit/interview/export&interviews=x of the Interview Management Export component. Manipulation of the interviews argument leads to SQL injection.
In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or insufficient UI. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
A stack overflow in the UpdateSnat function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
A stack overflow in the UpdateMacClone function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
A stack overflow in the AddWlanMacList function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
A stack overflow in the Edit_BasicSSID_5G function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
A stack overflow in the UpdateWanParams function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
A vulnerability in the hardware-based SSL/TLS cryptography functionality of Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Software for Firepower 2100 Series Appliances could allow an unauthenticated, remote attacker to cause an unexpected reload, resulting in a denial of service (DoS). This is due to an implementation error in cryptographic functions when offloaded to hardware. An attacker could exploit this by sending a crafted stream of SSL/TLS traffic.
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository spinacms/spina prior to version 2.15.1, allowing for the storage of malicious code.
The open source framework AWS data.all in versions 1.2.0 through 1.5.1 does not prevent remote code execution when a user injects Python commands into the 'Template' field while configuring a data pipeline. The issue can only be triggered by authenticated users.
A stack overflow in the UpdateWanMode function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
A stack overflow in the EditWlanMacList function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
A stack overflow in the EditMacList function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
A stack overflow in the AddMacList function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
A stack overflow in the Edit_BasicSSID function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
Reflected XSS vulnerability affects the 'mode' parameter in the /admin functionality of the web application in versions <=2.0.44.
The Subscribe2 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 10.40. This is due to missing or incorrect nonce validation when sending test emails.
The Salon Booking System plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 8.4.6. This is due to missing or incorrect nonce validation on the 'save_customer' function, allowing unauthenticated attackers to change the admin role to customer or modify user meta via a forged request.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS